CP-10 (4) Information System Recovery and Reconstitution | Restore Within Time Period (H)

NIST 800-53 (r4) Control:

The organization provides the capability to restore information system components within [FedRAMP Assignment: (H) time period consistent with the restoration time-periods defined in the service provider and organization SLA] from configuration-controlled and integrity-protected information representing a known, operational state for the components.

NIST 800-53 (r4) Supplemental Guidance:

Restoration of information system components includes, for example, reimaging which restores components to known, operational states. Related control: CM-2.

NIST 800-53 (r5) Discussion:

Restoration of system components includes reimaging, which restores the components to known, operational states.

38North Guidance:

Meets Minimum Requirement:

• Must have the capability to reimage information system components immediately from configuration-controlled and integrity-protected disk images representing a secure, operational state for the components.

  1. • The restoration time-period of the information system shall be consistent with the RTOs and RPOs addressed in SLAs.

Best Practice:

• TBD.

Unofficial FedRAMP Guidance: None.

Assessment Evidence:

• A copy of the CP highlighting the organization's re-imaging capabilities of information system components.

CSP Implementation Tips:

• Amazon Web Services (AWS): TBD

• Microsoft Azure: TBD

• Google Cloud Platform: TBD