Requirement
The entity identifies, develops, and implements activities to recover from identified security incidents.
Points of Focus
Restores the Affected Environment
Requirement: The activities restore the affected environment to functional operation by rebuilding systems, updating software, installing patches, modifying access controls, and changing configurations, as needed.
Communicates Information About the Incident
Requirement: Communications about the nature of the incident, recovery actions taken, and activities required for the prevention of future security incidents are made to management and others as appropriate (internal and external).
Determines Root Cause of the Incident
Requirement: The root cause of the incident is determined.
Implements Changes to Prevent and Detect Recurrences
Requirement: Additional architecture or changes to preventive and detective controls are implemented to prevent and detect incident recurrences in a timely manner.
Improves Response and Recovery Procedures
Requirement: Lessons learned are analyzed and the incident-response plan and recovery procedures are improved.
Implements Incident-Recovery Plan Testing
Requirement: Incident-recovery plan testing is performed on a periodic basis. The testing includes (1) development of testing scenarios based on threat likelihood and magnitude; (2) consideration of relevant system components from across the entity that can impair availability; (3) scenarios that consider the potential for the lack of availability of key personnel; and (4) revision of resilience posture and continuity plans based on test results.
Explanation
After an incident is contained, the organization must recover: rebuild affected systems, determine the root cause, and change controls so the same thing cannot happen again. Auditors review post-incident reports, root-cause analyses, and periodic recovery-plan tests to confirm the organization can actually restore normal operations, not just react.
