Trusted Rebuild Path

Control Statement

For every decisive point, the organization shall maintain a documented and tested path to rebuild the element from trusted media within its declared recovery time objective.

Purpose. To ensure that what must not be lost can be rebuilt, from a source the adversary did not touch, inside the time the mission requires.

Discussion

Most rebuild procedures assume a working identity plane — they begin with authenticating to something. Where identity is itself the decisive point that was compromised, the procedure contains a circular dependency, and it surfaces at the worst possible moment. The identity plane's own rebuild path therefore has to be tested independently and first, because every other path in the estate depends on it. The trusted-media requirement carries the second half of the problem: media stored, indexed or validated by the compromised environment is not trusted media regardless of where it physically sits.

Goals and Metrics

A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.

Accountability

Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.

Inputs and Outputs

Activities

1. L2Document a rebuild path for every designated decisive point.
2. L2Identify the media source each path rebuilds from.
3. L2Record the most recent rebuild test and its elapsed time.
4. L3Verify that each media source is independently trusted — not stored, indexed or validated by the environment being rebuilt.
5. L3Test the rebuild path for the identity plane itself, and sequence it first, since every other path depends on a working identity service.
6. L3Record the dependency order across rebuild paths, so reconstitution can be sequenced rather than attempted in parallel.
7. L3Compare each tested elapsed time against the element's declared recovery time objective (RC-1) and raise a finding where it exceeds.
8. L4Test each decisive point's rebuild path on a defined cadence and trend the elapsed times, since procedures decay as platforms change.
9. L4Measure the proportion of decisive points whose rebuild path has been tested at all, distinguishing documented from tested.
10. L5Re-engineer paths whose tested time persistently exceeds the objective, rather than repeatedly recording the same finding.

Measurement

Evidence and Assessment

Related Guidance

Position in the Chain

Derived from the other controls’ own declarations, so the two directions cannot disagree.

Where This Control Is Used

Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.