NIST SP 800-184 Guide for Cybersecurity Event Recovery
NIST's guide for recovering from cyber events: resilience and recovery planning, asset and dependency prioritisation, roots of trust, recovery plan contents, staged playbooks, invocation and termination, communications and sharing, validation through feedback and exercises, lessons learned, recovery metrics, and the tactical and strategic recovery phases.
NIST SP 800-184 Guide for Cybersecurity Event Recovery is a compliance framework from United States with 4 domains and 19 controls. The largest domains are Section 2: Planning for cyber event recovery – NIST SP 800-184 Guide for Cybersecurity Event Recovery (13 controls), Section 3: Continuous improvement – NIST SP 800-184 Guide for Cybersecurity Event Recovery (3 controls), Section 5: Building the playbook – NIST SP 800-184 Guide for Cybersecurity Event Recovery (2 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (4)
Section 2: Planning for cyber event recovery – NIST SP 800-184 Guide for Cybersecurity Event Recovery
| Code | Title |
|---|---|
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::2.1a | Plan to operate in a diminished capacity and restore services in priority order |
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::2.1b | Identify the key recovery personnel and make sure they know their roles |
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::2.1c | Keep a complete inventory of mission-enabling assets and their dependencies, including hosted services |
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::2.1d | Categorise assets by importance and map interdependencies to set the restoration sequence |
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::2.2a | Identify critical systems and model threats before an event to produce a dependency map |
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::2.2b | Protect the recovery plan like a system security plan and contain resources that need not touch key assets |
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::2.2c | Understand the roots of trust: identities and boundaries, management access control and data integrity |
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::2.3.1 | Document a recovery plan covering agreements, authority, team, procedures, communications, off-site storage and workarounds |
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::2.3.2a | Develop recovery processes as a staged playbook with exit criteria plus automated technical procedures |
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::2.3.2b | Set continuity requirements with stakeholders, weigh cost against resilience and involve the privacy team |
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::2.3.3 | Define invocation conditions, authority, notification, milestones, termination criteria and planning assumptions |
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::2.4 | Plan recovery communications for every stakeholder, with contacts, reporting lines, sharing rules and alternate channels |
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::2.5 | Share recovery insights with other organisations after setting sharing goals and rules |
Section 3: Continuous improvement – NIST SP 800-184 Guide for Cybersecurity Event Recovery
| Code | Title |
|---|---|
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::3.1a | Gather feedback on recovery plans from everyone with a recovery role |
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::3.1b | Run recovery exercises and tests at a set frequency, with realistic objectives and roles, and review the results |
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::3.2 | Learn from real recoveries to improve recovery, operations and security posture, documenting issues as they arise |
Section 4: Recovery metrics – NIST SP 800-184 Guide for Cybersecurity Event Recovery
| Code | Title |
|---|---|
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::4 | Decide in advance which recovery metrics to collect, make them an automated by-product, and control their sharing |
Section 5: Building the playbook – NIST SP 800-184 Guide for Cybersecurity Event Recovery
| Code | Title |
|---|---|
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::5a | Execute the tactical recovery playbook through initiation, execution and termination |
| nist-sp-800-184-guide-for-cybersecurity-event-recovery::5b | Run the strategic phase: improvement plan, continued communications and review of milestones and metrics |
What is NIST SP 800-184 Guide for Cybersecurity Event Recovery and who does it apply to?
NIST SP 800-184 Guide for Cybersecurity Event Recovery is a compliance framework from United States with 4 domains and 19 controls. NIST's guide for recovering from cyber events: resilience and recovery planning, asset and dependency prioritisation, roots of trust, recovery plan contents, staged playbooks, invocation and termination, communications and sharing, validation through feedback and exercises, lessons learned, recovery metrics, and the tactical and strategic recovery phases. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does NIST SP 800-184 Guide for Cybersecurity Event Recovery actually require?
NIST SP 800-184 Guide for Cybersecurity Event Recovery has 19 controls organised across 4 domains. The largest domains are Section 2: Planning for cyber event recovery – NIST SP 800-184 Guide for Cybersecurity Event Recovery (13 controls), Section 3: Continuous improvement – NIST SP 800-184 Guide for Cybersecurity Event Recovery (3 controls), Section 5: Building the playbook – NIST SP 800-184 Guide for Cybersecurity Event Recovery (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of NIST SP 800-184 Guide for Cybersecurity Event Recovery do I already cover?
NIST SP 800-184 Guide for Cybersecurity Event Recovery does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement NIST SP 800-184 Guide for Cybersecurity Event Recovery?
Start your NIST SP 800-184 Guide for Cybersecurity Event Recovery compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST SP 800-184 Guide for Cybersecurity Event Recovery requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 19 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required