RC.RP-01 Recovery plan executed
Executing the recovery portion of the incident response plan once incident response initiates it, with everyone in a recovery role aware of the plans and authorizations.
RC.RP Incident recovery plan execution
Incident Recovery Plan Execution: running the recovery plan, prioritizing actions, verifying backups and restored assets, setting post-incident norms and declaring recovery complete; six Subcategories.
RC.RP-02 Recovery actions prioritized
Selecting, scoping, prioritizing and performing recovery actions based on plan criteria and available resources, and adjusting them as needs are reassessed.
RC.RP-03 Backup integrity verified before restore
Verifying the integrity of backups and other restoration assets before restoring from them, by checking for indicators of compromise and corruption.
RC.RP-04 Post-incident operational norms
Setting post-incident operating norms around critical mission functions: restoring essential services in the right order from business impact records and monitoring restored systems.
RC.RP-05 Restored assets verified
Verifying the integrity of restored assets, restoring systems and services and confirming normal operating status, including checks that root causes were remediated.
RC.RP-06 End of recovery declared
Declaring the end of incident recovery against defined criteria and completing incident documentation, including an after-action report with lessons learned.
