System Recovery and Reconstitution CP-10
Contingency Planning · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds CP-10 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Contingency Planning family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
CP-10 (System Recovery and Reconstitution) is about bringing the system back to a known, secure state after a disruption, compromise, or failure - within the recovery time objective (RTO, the target time to be back online). It builds on backups: recovery restores service, and reconstitution returns the host to full, hardened operation.
What good looks like
- Have a documented, tested procedure to recover the system to a known-good state within the defined RTO.
- Reconstitute fully - reapply the hardened baseline, patches, and configuration, not just a bare operating system.
- Verify integrity after recovery so you do not restore a compromised or drifted state.
- Exercise the recovery periodically so it is proven to work, not merely assumed.
Framework mapping
- NIST CSF 2.0 — RC.RP-01 — The recovery portion of the incident response plan is executed once initiated
- CIS Controls v8 — Control 11 — Data Recovery
How to move it toward Implemented
- You have the rollback mechanism (the
pinkteam-baselineProxmox snapshot) but the runbook never restores it, so recovery is unproven and there is no RTO. - Exercise it in a maintenance window -
qm rollback 607 pinkteam-baseline- and record how long the restore takes; set that against a stated RTO so recovery has a target, not just a tool. - After rollback, run
sudo aide --checkand re-run the as-built capture to confirm the recovered host matches the hardened baseline with no drift. - Save the dated restore-test result as evidence naming CP-10 to move it from 'partial' toward 'Completed'.