📢 New post: Is It Even in Your Boundary? CVE-2026-0257 and the Question a KEV Clock Asks First · 📝 Also fresh: 20x Is Permanent Now: The Rehearsal's Over, the Rules Land in June · 🚦 Beacon — the FedRAMP 20x KSI emitter — design partners open ✨ · 🆕 20x Hub: program reference, kept current · 🧪 Free tool: KSI Quick Check — paste, run, get the verdict

FedRAMP Controls / CP

CP-10 System Recovery and Reconstitution

Family CP
Baselines moderate
Mapped KSIs 4

Control statement

Provide for the recovery and reconstitution of the system to a known state within {{ insert: param, cp-10_prm_1 }} after a disruption, compromise, or failure.

Parameter placeholders {{ insert: param, … }} reference FedRAMP-set values in the resolved profile. Full parameter map is preserved in the catalog database.

Covered by these Key Security Indicators

KSITitleCategory
KSI-RPL-01Recovery Objectives
_Persistently_ review desired Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).
Recovery Planning
KSI-RPL-02Recovery Plan
_Persistently_ review the alignment of recovery plans with defined recovery objectives.
Recovery Planning
KSI-RPL-03System Backups
_Persistently_ review the alignment of machine-based information resource backups with defined recovery objectives.
Recovery Planning
KSI-RPL-04Recovery Testing
_Persistently_ test the capability to recover from incidents and contingencies, including alignment with defined recovery objectives.
Recovery Planning