| name | PR.IP-09_prip-09 |
| description | Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed |
| category | authorization |
| version | 2.0 |
| author | cyberstrike-official |
| tags | ["nist","csf","v2.0","pr-ip-09","pr","subcategory"] |
| tech_stack | ["aws","azure","gcp","linux","windows"] |
| cwe_ids | ["CWE-284"] |
| chains_with | [] |
| prerequisites | ["Information Protection Processes and Procedures (PR.IP)"] |
| severity_boost | {} |
PR.IP-09 PR.IP-09
Subcategory of: Information Protection Processes and Procedures (PR.IP)
High-Level Description
Function: PROTECT (PR)
Framework: NIST Cybersecurity Framework v2.0
Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed
What to Check
How to Test
Step 1: Identify Current Profile
Determine the organization's current and target CSF profile tier for PR.IP-09.
Step 2: Assess Outcome Achievement
# Review organizational policies and procedures
# Check for evidence that PR.IP-09 outcome is met
# Interview stakeholders responsible for PROTECT
Step 3: Map to Technical Controls
Identify which SP 800-53 controls implement this CSF outcome and verify their operating effectiveness.
Tools
| Tool | Purpose | Usage |
|---|
| cloud-audit-mcp | Assess cloud security posture | cloud_audit_* tools |
| Manual Review | Policy and procedure review | Interviews and documentation |
Remediation Guide
Achieve the PR.IP-09 PR.IP-09 outcome:
Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed
Risk Assessment
| Finding | Severity | Impact |
|---|
| PR.IP-09 PR.IP-09 outcome not achieved | High | PROTECT Function Gap |
CWE Categories
| CWE ID | Title |
|---|
| CWE-284 | Improper Access Control |
