Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms

frameworkNIST Cybersecurity Framework 2.0 sectionRecover (RC) topicsBusiness Continuity frameworks5 3 5

gap from NIST CSF 2.0 → gap to NIST CSF 2.0 →

Wrong or missing mapping? Report it

Equivalents of RC.RP-04 in other frameworks
Framework	Requirement	Title	Link	Source / reason
ISO 27001	A.5.29 A.5.30 A.8.14	Information security during disruption; ICT readiness for business continuity…	Crosswalk	Same topic: Business Continuity 1 loosely related (not mappings) Clause 8.1 Operational planning and control Loosely related Only shares CSF RC.RP-04: related, not a mapping
CIS v8.1	—	No requirement	No mapping in our data	No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards).
SOC 2	A1.1 A1.2 CC9.1	Capacity management to meet availability commitments; Environmental protections, backups and recovery infrastructure…	Editorial	Same topic: Business Continuity (editorial pick)
PCI DSS	12.10.1	Incident response plan ready to activate	Crosswalk	Same topic: Business Continuity 4 loosely related (not mappings) 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF RC.RP-04: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF RC.RP-04: related, not a mapping 10.2.1 Audit logs enabled and active Loosely related Only shares CSF RC.RP-04: related, not a mapping 12.5.1 Inventory of in-scope system components Loosely related Only shares CSF RC.RP-04: related, not a mapping
CMMC	—	No requirement	No mapping in our data	No mapping in our data.
800-53	CP-2(8)CP-7	Identify Critical Assets; Alternate Processing Site	Crosswalk	Same topic: Business Continuity 4 loosely related (not mappings) IR-8 Incident Response Plan Loosely related Only shares CSF RC.RP-04: related, not a mapping PM-8 Critical Infrastructure Plan Loosely related Only shares CSF RC.RP-04: related, not a mapping PM-9 Risk Management Strategy Loosely related Only shares CSF RC.RP-04: related, not a mapping PM-11 Mission and Business Process Definition Loosely related Only shares CSF RC.RP-04: related, not a mapping
HIPAA	§164.308(a)(7)(ii)(C)	Emergency Mode Operation Plan	Crosswalk	Same topic: Business Continuity 4 loosely related (not mappings) §164.308(a)(6) Security Incident Procedures Loosely related Only shares CSF RC.RP-04: related, not a mapping §164.308(a)(6)(ii) Response and Reporting Loosely related Only shares CSF RC.RP-04: related, not a mapping §164.316(b)(2)(ii) Availability Loosely related Only shares CSF RC.RP-04: related, not a mapping §164.316(b)(2)(iii) Updates Loosely related Only shares CSF RC.RP-04: related, not a mapping
GDPR	Art.32(1)(b)	Security of processing	Editorial	Same topic: Business Continuity (editorial pick)
NIS2	4.1 4.3	Business continuity and disaster recovery plan; Crisis management	Crosswalk	Same topic: Business Continuity
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.11(1)Art.11(4)Art.11(6)	Response and recovery; Response and recovery…	Editorial	Same topic: Business Continuity (editorial pick)
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.