Knowledge is Power
BARE METAL CYBERKnowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search exact control and technique identifiers, Cyber Wiki articles, framework records, playbooks, books, podcasts, Academy courses, individual lessons, and BMC Cyber Challenge activities.

NIST CSF Category profileIntermediate

Incident Recovery Plan Execution (RC.RP) — NIST CSF 2.0 Category

Use RC.RP to manage plan execution, prioritization, restoration, verification, post-incident norms, and recovery closure within the Recover Function.

Framework mapping

NIST Cybersecurity Framework 2.0

CSF 2.0
CategoryRC.RP — Incident Recovery Plan Execution
FunctionRC — RecoverCategoryRC.RP — Incident Recovery Plan Execution
Official CSF Core outcome

Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents.

CSF outcomes describe what an organization may seek to achieve. They do not prescribe one implementation or turn the Core into a universal checklist.

Category outcome

NIST CSF 2.0 places Incident Recovery Plan Execution (RC.RP) within the Recover Function. The official Category outcome is: “Restoration activities are performed to ensure operational availability of systems and services affected by cybersecurity incidents.”

This Category provides a structured way to address plan execution, prioritization, restoration, verification, post-incident norms, and recovery closure. It groups related Subcategory outcomes without prescribing a specific technology, organizational model, or implementation sequence.

What this means in practice

A credible Incident Recovery Plan Execution capability connects policy and risk decisions to repeatable operating practices. The organization should define scope, ownership, expected outcomes, evidence, exceptions, and reassessment triggers.

Implementation should be proportionate to mission needs, legal and contractual obligations, threat exposure, business impact, and the organization’s risk appetite. The same Category may be implemented differently across systems and business contexts.

Implementation priorities

The following priorities translate the Category into an operating capability. They are starting points for design and governance, not a replacement for architecture, procedures, or risk analysis.

  • Activate recovery plans using defined authority and dependencies.
  • Prioritize restoration by mission impact, safety, service dependencies, and risk.
  • Verify backups and restoration assets before use.
  • Validate integrity, security, functionality, and monitoring before returning to normal operations.
  • Declare the end of recovery using explicit criteria and lessons learned.

Evidence and measurement

Evidence should show that the Category’s outcomes are achieved in the intended scope, remain effective, and are reviewed when conditions change. A policy, tool purchase, or completed checklist is not sufficient by itself.

  • Recovery plans, runbooks, and activation records
  • Restoration priorities and dependency maps
  • Backup integrity and restoration test results
  • Security, functionality, and business acceptance checks
  • Recovery closure, residual-risk, and after-action records

Subcategories within RC.RP

This Category contains 6 CSF 2.0 Subcategory outcomes. Each outcome has a dedicated Bare Metal Cyber profile with the official NIST statement and original implementation guidance.

  • RC.RP-01 — Execute the Recovery Plan: The recovery portion of the incident response plan is executed once initiated from the incident response process
  • RC.RP-02 — Select and Perform Recovery Actions: Recovery actions are selected, scoped, prioritized, and performed
  • RC.RP-03 — Verify Backups and Restoration Assets: The integrity of backups and other restoration assets is verified before using them for restoration
  • RC.RP-04 — Establish Post-Incident Operational Norms: Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms
  • RC.RP-05 — Verify Restored Assets and Normal Operations: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed
  • RC.RP-06 — Declare the End of Recovery: The end of incident recovery is declared based on criteria, and incident-related documentation is completed

Using this Category in Current and Target Profiles

For a Current Profile, record which Subcategory outcomes are achieved, the scope of the assessment, and the evidence supporting the judgment. For a Target Profile, select the outcomes needed to meet risk management objectives and describe the target conditions.

Prioritize the resulting gaps by mission consequence, risk exposure, dependencies, obligations, implementation effort, and the value of the improvement. Record the owner and the evidence that will demonstrate closure.

Common failure modes

The following conditions can create the appearance of coverage without reliable outcome achievement. Treat them as hypotheses to test during assessments, exercises, and operational reviews.

  • Recovery order ignores application and identity dependencies.
  • Backups are restored without verifying cleanliness or integrity.
  • Services return to production before security monitoring and access controls are ready.
  • Recovery is declared complete before business owners validate normal operations.

Source, scope, and attribution

The Category identifier, name, description, and Subcategory outcomes are from NIST CSWP 29. Bare Metal Cyber’s implementation, evidence, failure-mode, and Profile guidance is original educational material.

The CSF describes outcomes, not mandatory implementation steps. Use NIST’s current online Implementation Examples and Informative References when selecting practices and controls for a specific environment.

Certification relevance

This subject appears in or supports the following certification bodies of knowledge:

NIST CSF 2.0CompTIA Security+ISC2 CISSPGIAC GSEC

Authoritative sources