Frameworks / NIST SP 800-144 / NISTSP144-6 NIST SP 800-144
Availability and Resilience
NIST SP 800-144 NISTSP144-6: Availability, Resilience, BCP/DR, and SLA Management Apply Section 7.4 availability and resilience planning including: cloud availability SLA assessment (99.95% + 99.99% + 99.999%) + outage credits + service-level objectives (SLOs) + Service Level Indicators (SLIs) + multi-AZ + multi-region + multi-cloud + active-active + active-passive architectures. Develop BCP/DR per cloud-native disaster recovery (Pilot Light + Warm Standby + Hot Standby + Active-Active multi-region) + RTO/RPO targets + chaos engineering (Chaos Monkey + Gremlin + AWS Fault Injection Service + Azure Chaos Studio) + game days. Manage SLA per Section 7.20 including monitoring + reporting + escalation + outage credits + customer compensation.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 60 controls across 27 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
API1164-17 Wireless and Field Communications API1164-18 Field Device Security API1164-19 Safety Instrumented Systems Interface ASD37-34 Regular backups (Essential) ASD37-35 Business continuity and disaster recovery plans (Very Good) ASD37-36 System recovery capabilities (Very Good) IEC62443-16 Incident response plan for operational disruptions IEC62443-17 Recovery plan for critical systems IEC62443-20 Exercises and drills for OT incidents ISO27019-16 Incident response plan for operational disruptions ISO27019-18 Reporting obligations to authorities ISO27019-20 Exercises and drills for OT incidents 27031-8.1 Exercising and Testing 27031-8.2 Maintaining IRBC 27031-9.3 Management Review NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process NIST-CSF-RC.RP-06 The end of incident recovery is declared based on criteria, and incident-related documentation is completed NIST-CSF-RS.MA-05 The criteria for initiating incident recovery are applied ISO22316-08 Recovery time and point objectives ISO22316-12 Recovery strategy for critical activities ISO22317-08 Recovery time and point objectives ISO22317-12 Recovery strategy for critical activities ISO22318-08 Recovery time and point objectives ISO22318-12 Recovery strategy for critical activities NFPA1600-5.3 Resource Needs Assessment NFPA1600-6.4 Continuity and Recovery NISTSP34-2 Business Impact Analysis (BIA): Critical Resources, Recovery Priorities NISTSP34-4 Information System Contingency Plan (ISCP) Development IM8-RES.2 Disaster Recovery IM8-RES.4 Resilience Testing ISMSP-PI-06 Personal Information Destruction ISMSP-SYS-06 Business Continuity and Disaster Recovery 4.4.8 Business Continuity and Recovery DIQ-1 Data Integration and Interoperability FFIEC-12 Disaster recovery procedures FEDRAMP-CP-9 System Backup ISO-22320-5.2 Incident management process 27011-8.6 Data protection and backup ISO27043-23 Backup and recovery procedures ISO21434-23 Backup and recovery procedures NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) OWASPMASVS-7 MASVS-RESILIENCE: Resilience Against Reverse Engineering CYB-5 Cyber Incident Response Plan Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 60 it maps to, and the evidence behind each claim, over MCP and REST.