Recovery actions are selected, scoped, prioritized, and performed

frameworkNIST Cybersecurity Framework 2.0 sectionRecover (RC) topicsRecovery Planning, Disaster Recovery frameworks5 5 2

gap from NIST CSF 2.0 → gap to NIST CSF 2.0 →

Wrong or missing mapping? Report it

Equivalents of RC.RP-02 in other frameworks
Framework	Requirement	Title	Link	Source / reason
ISO 27001	A.5.29 A.5.30 A.8.14	Information security during disruption; ICT readiness for business continuity…	Crosswalk	Same topic: Recovery Planning, Disaster Recovery 1 loosely related (not mappings) A.5.26 Response to information security incidents Loosely related Only shares CSF RC.RP-02: related, not a mapping
CIS v8.1	CIS 11.1	Establish and Maintain a Data Recovery Process	Editorial	Same topic: Recovery Planning, Disaster Recovery (editorial pick)
SOC 2	A1.2 A1.3 CC7.5	Environmental protections, backups and recovery infrastructure; Testing recovery plan procedures…	Editorial	Same topic: Disaster Recovery, Recovery Planning (editorial pick)
PCI DSS	12.10.1	Incident response plan ready to activate	Crosswalk	Same topic: Recovery Planning, Disaster Recovery 4 loosely related (not mappings) 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF RC.RP-02: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF RC.RP-02: related, not a mapping 12.10.2 Incident response plan reviewed and tested annually Loosely related Only shares CSF RC.RP-02: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Loosely related Only shares CSF RC.RP-02: related, not a mapping
CMMC	IR.L2-3.6.1	Incident Handling	Loosely related	No mapping. Only shares CSF RC.RP-02: related, not a mapping
800-53	CP-2 CP-10 CP-7	Contingency Plan; System Recovery and Reconstitution…	Crosswalk	Same topic: Recovery Planning, Disaster Recovery 2 loosely related (not mappings) IR-4 Incident Handling Loosely related Only shares CSF RC.RP-02: related, not a mapping IR-8 Incident Response Plan Loosely related Only shares CSF RC.RP-02: related, not a mapping
HIPAA	§164.308(a)(7)§164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(D)	Contingency Plan; Disaster Recovery Plan…	Crosswalk	Same topic: Recovery Planning, Disaster Recovery 3 loosely related (not mappings) §164.308(a)(6) Security Incident Procedures Loosely related Only shares CSF RC.RP-02: related, not a mapping §164.308(a)(6)(ii) Response and Reporting Loosely related Only shares CSF RC.RP-02: related, not a mapping §164.308(a)(7)(ii)(C) Emergency Mode Operation Plan Loosely related Only shares CSF RC.RP-02: related, not a mapping
GDPR	Art.32(1)(c)	Security of processing	Editorial	Same topic: Recovery Planning, Disaster Recovery (editorial pick)
NIS2	4.1 4.2	Business continuity and disaster recovery plan; Backup management	Crosswalk	Same topic: Recovery Planning, Disaster Recovery
Essential Eight	ISM-1515	Restoration of data, applications and settings from backups to a common point in time…	Editorial	Same topic: Disaster Recovery (editorial pick)
DORA	Art.11(3)Art.11(6)Art.12(4)Art.12(6)	Response and recovery; Response and recovery…	Editorial	Same topic: Recovery Planning, Disaster Recovery (editorial pick)
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.