---
name: framework-financial-services-controls-cp-10
title: CP-10 - System Recovery and Reconstitution
description: 'Provide for the recovery and reconstitution of the system to a known state within _[Assignment: organization-defined time period consistent with recovery time and recovery point objectives]_ after a disruption, compromise, or failure.'
last-updated: 2025-02-26
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/framework-financial-services-controls?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# CP-10 - System Recovery and Reconstitution
{: #cp-10}

## Control requirements
{: #control-requirements}



### CP-10 - 0


Provide for the recovery and reconstitution of the system to a known state within _[Assignment: organization-defined time period consistent with recovery time and recovery point objectives]_ after a disruption, compromise, or failure.






## Additional IBM Cloud for Financial Services specifications
{: #additional-ibm-cloud-for-financial-services-specifications}

Contingency plans must include procedures for validating successful recovery and reconstitution.  Recovery and reconstitution activities include resuming operational capabilities at the original location.     




## Implementation guidance
{: #implementation-guidance}

See the resources that follow to learn more about how to implement this control.


- [Business continuity and disaster recovery overview](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-bcdr&format=markdown)


- [Operational logging](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-operational&format=markdown)


- [Operational monitoring](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-operational&format=markdown)






## NIST supplemental guidance
{: #nist-supplemental-guidance}

Recovery is executing contingency plan activities to restore organizational mission and business functions. Reconstitution takes place following recovery and includes activities for returning systems to fully operational states. Recovery and reconstitution operations reflect mission and business priorities; recovery point, recovery time, and reconstitution objectives; and organizational metrics consistent with contingency plan requirements. Reconstitution includes the deactivation of interim system capabilities that may have been needed during recovery operations. Reconstitution also includes assessments of fully restored system capabilities, reestablishment of continuous monitoring activities, system reauthorization (if required), and activities to prepare the system and organization for future disruptions, breaches, compromises, or failures. Recovery and reconstitution capabilities can include automated mechanisms and manual procedures. Organizations establish recovery time and recovery point objectives as part of contingency planning.