RC.RP-04.352
Does your organization have a documented process for verifying successful system restoration and confirming the return to normal operations after an incident or outage?
Explanation
This question assesses whether your organization has formal procedures to validate that systems have been properly restored following incidents, maintenance, or outages. The process should include verification steps with system owners to confirm functionality, data integrity, and that business operations can resume normally. Evidence could include a system restoration checklist, post-incident verification procedures, or restoration sign-off forms that require system owner approval before declaring an incident closed. These documents should outline specific criteria for determining when a system is considered fully operational.
Implementation Example
Work with system owners to confirm the successful restoration of systems and the return to normal operations
ID: RC.RP-04.352
Context
- Function
- RC: RECOVER
- Category
- RC.RP: Incident Recovery Plan Execution
- Sub-Category
- Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms

