CP-4(4)

Requirement

Include a full recovery and reconstitution of the system to a known state as part of contingency plan testing.

Discussion

Recovery is executing contingency plan activities to restore organizational mission and business functions. Reconstitution takes place following recovery and includes activities for returning systems to fully operational states. Organizations establish a known state for systems that includes system state information for hardware, software programs, and data. Preserving system state information facilitates system restart and return to the operational mode of organizations with less disruption of mission and business processes.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Contingency planning policy; procedures addressing system recovery and reconstitution; contingency plan; contingency plan test documentation; contingency plan test results; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with contingency plan testing responsibilities; organizational personnel with system recovery and reconstitution responsibilities; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Organizational processes for contingency plan testing; mechanisms supporting contingency plan testing; mechanisms supporting recovery and reconstitution of the system].

ID	Assessment Objectives
CP-04(04)[01]	a full recovery of the system to a known state is included as part of contingency plan testing;
CP-04(04)[02]	a full reconstitution of the system to a known state is included as part of contingency plan testing.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!