RC.CO-04 involves sharing public updates on incident recovery using approved channels and messaging, such as breach notifications or preventative steps, to inform affected parties or the broader community. This ensures transparency about recovery efforts and future safeguards, maintaining public trust. It addresses external expectations post-incident.

This subcategory aligns with legal and risk requirements, ensuring communications are consistent and controlled to avoid misinformation. It supports reputation management by explaining recovery actions clearly and responsibly. RC.CO-04 bridges organizational recovery with public accountability.

RC.CO-03 ensures recovery activities and progress are shared with designated stakeholders—like leadership and suppliers—consistent with response plans and agreements. This includes regular updates on restoration status, adhering to contractual protocols for information sharing. It keeps all parties informed and aligned during recovery.

This subcategory aligns communication with risk and operational needs, fostering trust and coordination with critical partners. It supports a unified recovery effort by ensuring transparency on progress and challenges. RC.CO-03 sustains stakeholder engagement through the restoration phase.

RC.RP-06 declares the end of recovery once predefined criteria are met, finalizing the process with a comprehensive after-action report detailing the incident, actions, and lessons learned. This formal closure ensures all steps are documented for review and improvement. It marks the return to full normalcy.

This subcategory aligns with risk management by tying closure to measurable outcomes, ensuring accountability and transparency in recovery efforts. It supports future resilience by capturing insights for refinement. RC.RP-06 concludes recovery with clarity and foresight.

RC.RP-05 verifies the integrity of restored assets—checking for lingering threats or root causes—before returning systems to production, confirming normal operations. This involves testing restoration adequacy to ensure functionality and security are fully restored. It finalizes recovery with assurance.

This subcategory aligns with risk goals by ensuring restored systems are secure and operational, preventing recurrence from overlooked issues. It supports confidence in recovery outcomes through rigorous validation. RC.RP-05 completes the restoration process with integrity.

RC.RP-04 considers critical mission functions and cybersecurity risks to define post-incident operational norms, using impact records to prioritize restoration order. This involves collaboration with system owners to confirm successful recovery and monitor performance for adequacy. It ensures recovery aligns with strategic goals.

This subcategory aligns restoration with risk and mission priorities, ensuring essential services resume first while maintaining security standards. It establishes a sustainable post-incident state, balancing functionality and protection. RC.RP-04 shapes a resilient operational recovery.

RC.RP-03 ensures backups and restoration assets are checked for integrity—free of compromise or corruption—before use in recovery efforts. This verification prevents reintroducing threats or using unreliable data, safeguarding the restoration process. It guarantees a clean starting point for recovery.

This subcategory aligns with risk management by prioritizing the reliability of recovery tools, reducing the chance of failed restorations. It supports operational continuity by ensuring only trusted assets are deployed. RC.RP-03 underpins a secure recovery foundation.

RC.RP-02 involves selecting, scoping, and prioritizing recovery actions based on incident response plan criteria and available resources, adapting as needs shift. This ensures efforts focus on critical systems first, balancing speed with effectiveness in execution. It operationalizes recovery with precision.

This subcategory aligns actions with risk and operational goals, ensuring resources address the most impactful areas efficiently. It supports flexibility by allowing reassessment of plans mid-recovery, optimizing outcomes. RC.RP-02 drives a targeted restoration process.

RC.RP-01 initiates the recovery phase of the incident response plan once triggered, ensuring all responsible parties are aware of their roles and required authorizations. This begins during or after containment, focusing on restoring affected systems and services systematically. It transitions the organization from response to recovery.

This subcategory aligns recovery with risk and operational priorities, ensuring a coordinated effort to regain normalcy with minimal disruption. It sets the stage for restoring availability, leveraging predefined plans for efficiency. RC.RP-01 launches the path to operational restoration.

RS.MI-02 ensures incidents are fully eradicated, removing threats like malware or unauthorized access through automated system features or manual responder actions. This can involve third-party support, such as MSSPs, to eliminate root causes and residual risks. It restores systems to a secure state.

This subcategory aligns eradication with risk goals, ensuring complete threat removal to prevent recurrence, balancing speed with thoroughness. It supports recovery by clearing the path for safe restoration. RS.MI-02 finalizes the mitigation process with decisive action.

RS.MI-01 focuses on containing incidents to prevent their expansion, using automated tools like antivirus or manual actions by responders to isolate threats. This can involve third-party assistance (e.g., ISPs) or redirecting compromised endpoints to remediation VLANs, limiting damage. It stops incidents from spreading further.

This subcategory aligns containment with risk priorities, ensuring rapid action protects critical assets and minimizes disruption. It supports a proactive stance by leveraging both technology and human intervention as needed. RS.MI-01 is the first line of defense in incident mitigation.