RS.MA-05 - Initiating Incident Recovery
Notes de l’épisode
RS.MA-05 applies predefined criteria to determine when to shift from response to recovery, based on incident characteristics and operational considerations. This decision balances containment success with potential disruptions from recovery actions, ensuring a smooth transition. It marks the pivot to restoring normalcy.
This subcategory aligns recovery initiation with risk and operational priorities, preventing premature or delayed action that could worsen impacts. It ensures a deliberate, criteria-driven approach to recovery planning. RS.MA-05 facilitates a seamless move from mitigation to restoration.
Tous les épisodes de Framework: The NIST Cybersecurity Framework (CSF)