# CP-10 — System Recovery and Reconstitution

- **Control ID:** CP-10
- **Family:** [CP](/md/families/CP.md)
- **Baselines:** low, moderate, high
- **Enhancement of:** No content available.

## Description

Provide for the recovery and reconstitution of the system to a known state within \[assignment\] after a disruption, compromise, or failure.

## Discussion

Recovery is executing contingency plan activities to restore organizational mission and business functions. Reconstitution takes place following recovery and includes activities for returning systems to fully operational states. Recovery and reconstitution operations reflect mission and business priorities; recovery point, recovery time, and reconstitution objectives; and organizational metrics consistent with contingency plan requirements. Reconstitution includes the deactivation of interim system capabilities that may have been needed during recovery operations. Reconstitution also includes assessments of fully restored system capabilities, reestablishment of continuous monitoring activities, system reauthorization (if required), and activities to prepare the system and organization for future disruptions, breaches, compromises, or failures. Recovery and reconstitution capabilities can include automated mechanisms and manual procedures. Organizations establish recovery time and recovery point objectives as part of contingency planning.

## Implementation guidance

No content available.

## CSF 2.0 subcategories

- [RC.RP-01](/md/csf/RC.RP-01.md) — The recovery portion of the incident response plan is executed once initiated from the incident response process
- [RC.RP-02](/md/csf/RC.RP-02.md) — Recovery actions are selected, scoped, prioritized, and performed
- [RC.RP-05](/md/csf/RC.RP-05.md) — The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed

## Related controls

- [CP-2](/md/controls/CP-2.md)
- [CP-4](/md/controls/CP-4.md)
- [CP-6](/md/controls/CP-6.md)
- [CP-7](/md/controls/CP-7.md)
- [CP-9](/md/controls/CP-9.md)
- [IR-4](/md/controls/IR-4.md)
- [SA-8](/md/controls/SA-8.md)
- [SC-24](/md/controls/SC-24.md)
- [SI-13](/md/controls/SI-13.md)

---

Derived from official NIST publications (NIST SP 800-53 Rev 5 and NIST CSF 2.0). nistcontrols.com is not affiliated with NIST.