CIP-009-6: recovery plan contents, backup and verification, testing every 15 months (and operational exercises every 36 months for high impact), and plan maintenance.
What each documented recovery plan must include: activation conditions, responder roles, backup and storage of information needed for recovery, backup verification, and preservation of data for incident analysis.
Testing recovery plans every 15 calendar months, test-restoring a representative sample of backups, and running an operational recovery exercise at least every 36 months for high impact systems.
Recording lessons learned and updating the recovery plan within 90 days after a test or real recovery, and within 60 days after changes to roles, teams or technology.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.