Recovery procedures and technical system features must exist so recovery is performed in a secure and verifiable manner. The ISSO will document circumstances inhibiting a trusted recovery.

From Application Security and Development Security Technical Implementation Guide

Associated with: CCI-000448

SV-84975r1_rule Recovery procedures and technical system features must exist so recovery is performed in a secure and verifiable manner. The ISSO will document circumstances inhibiting a trusted recovery.

Vulnerability discussion

Without a disaster recovery plan, the application is susceptible to interruption in service due to damage within the processing site.If the application is part of the site’s disaster recovery plan, ensure that the plan contains detailed instructions pertaining to the application. Verify that recovery procedures indicate the steps needed for secure and trusted recovery.

Check content

Review disaster recovery plan. Verify that a disaster recovery plan is in place for the application. Verify that the recovery procedures include any special considerations for trusted recovery. If the application is not part of the site’s disaster recovery plan, or if any special considerations for trusted recovery are not documented, this is a finding.

Fix text

Create and maintain a disaster recovery plan.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.