---

id: "CP-10(06)" title: "Component Protection" family: "CP" family_name: "Contingency Planning" sort_id: "cp-10.06" priority: "P2" implementation_level: "organization" parent: "CP-10" enhancement: True

---

Statement

Protect system components used for recovery and reconstitution.

Guidance

Protection of system recovery and reconstitution components (i.e., hardware, firmware, and software) includes physical and technical controls. Backup and restoration components used for recovery and reconstitution include router tables, compilers, and other system software.

Assessment Objective

system components used for recovery and reconstitution are protected.

Contingency planning policy

procedures addressing system recovery and reconstitution

contingency plan

system design documentation

system configuration settings and associated documentation

logical access credentials

physical access credentials

logical access authorization records

physical access authorization records

system security plan

other relevant documents or records

Organizational personnel with system recovery and reconstitution responsibilities

organizational personnel with information security responsibilities

Organizational processes for protecting backup and restoration of hardware, firmware, and software

mechanisms supporting and/or implementing protection of backups and restoration of hardware, firmware, and software