// Level 3 · Controls

RECOVER

NIST CSF 2.0 RECOVER function — categories and subcategories.

Restoration activities are coordinated with internal and external parties

Public relations are managed

Reputation is repaired after an incident

Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders

Public updates on incident recovery are shared using approved methods and messaging

Recovery plans incorporate lessons learned

Recovery strategies are updated

Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents

The recovery portion of the incident response plan is executed once initiated from the incident response process

Recovery actions are selected, scoped, prioritized, and performed

The integrity of backups and other restoration assets is verified before using them for restoration

Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms

The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed

The end of incident recovery is declared based on criteria, and incident-related documentation is completed