The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed

frameworkNIST Cybersecurity Framework 2.0 sectionRecover (RC) topicsComms & Restore, Disaster Recovery frameworks7 4 2

gap from NIST CSF 2.0 → gap to NIST CSF 2.0 →

Wrong or missing mapping? Report it

Equivalents of RC.RP-05 in other frameworks
Framework	Requirement	Title	Link	Source / reason
ISO 27001	A.5.26 A.5.30 A.8.14 Clause 7.4	Response to information security incidents; ICT readiness for business continuity…	Crosswalk	Same topic: Comms & Restore, Disaster Recovery
CIS v8.1	CIS 17.6 CIS 11.1	Define Mechanisms for Communicating During Incident Response; Establish and Maintain a Data Recovery Process	Crosswalk	Same topic: Comms & Restore, Disaster Recovery
SOC 2	A1.2 A1.3 CC2.3 CC7.5	Environmental protections, backups and recovery infrastructure; Testing recovery plan procedures…	Editorial	Same topic: Disaster Recovery, Comms & Restore (editorial pick)
PCI DSS	12.10.1	Incident response plan ready to activate	Crosswalk	Same topic: Disaster Recovery 3 loosely related (not mappings) 6.2.3 Custom code reviewed before release Loosely related Only shares CSF RC.RP-05: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Loosely related Only shares CSF RC.RP-05: related, not a mapping 11.4.4 Penetration test findings corrected and retested Loosely related Only shares CSF RC.RP-05: related, not a mapping
CMMC	IR.L2-3.6.2	Incident Reporting	Crosswalk	Same topic: Comms & Restore
800-53	CP-10 IR-6 CP-7	System Recovery and Reconstitution; Incident Reporting…	Crosswalk	Same topic: Comms & Restore, Disaster Recovery
HIPAA	§164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(D)	Disaster Recovery Plan; Testing and Revision Procedure	Crosswalk	Same topic: Disaster Recovery 1 loosely related (not mappings) §164.308(a)(7)(ii)(C) Emergency Mode Operation Plan Loosely related Only shares CSF RC.RP-05: related, not a mapping
GDPR	Art.32(1)(c)Art.34(1)	Security of processing; Communication of a personal data breach to the data subject	Editorial	Same topic: Disaster Recovery, Comms & Restore (editorial pick)
NIS2	4.1 4.2 4.3	Business continuity and disaster recovery plan; Backup management…	Crosswalk	Same topic: Disaster Recovery, Comms & Restore
Essential Eight	ISM-1515	Restoration of data, applications and settings from backups to a common point in time…	Editorial	Same topic: Disaster Recovery (editorial pick)
DORA	Art.11(2)(e)Art.11(6)Art.11(7)Art.12(4)	Response and recovery; Response and recovery…	Editorial	Same topic: Comms & Restore, Disaster Recovery (editorial pick)
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.