Operate recovery capability aligned with FIPS 199 impact level + NIST RMF integration per NIST SP 800-34 Rev 1 Appendix F (Sample Plans per Impact Level) + Chapter 4 (Information System Contingency Plan Development). Recovery capability per impact level: (a) Low impact systems per Section F.2: minimum capability covering tape backup + cold site or commercial recovery + tabletop exercise annually + plan walkthrough annually, (b) Moderate impact systems per Section F.3: enhanced capability covering more frequent backups + warm site + functional test annually + technical recovery exercise annually, (c) High impact systems per Section F.4: full capability covering real-time replication + hot site or mirrored site + multiple geographic regions + full-scale exercise annually + continuous improvement programme. RTO and RPO must be set per system aligned with BIA mission criticality + verified by exercise + tracked over time + adjusted when business requirements change. Integration with NIST RMF per Chapter 2: ISCP is required for RMF Authorize step + evidence of plan + exercise + maintenance feeds the Authorising Officials authorisation decision + ISCP updates trigger RMF Monitor step considerations. Integration with NIST SP 800-53 Rev 5 CP family (CP-1 through CP-13) provides the control specification + SP 800-34 provides the implementation guidance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.