Reconstitution Exercise

Control Statement

The organization shall exercise reconstitution against a stated failure scenario on a defined cadence, and every declared recovery objective shall have been demonstrated within its stated period.

Purpose. To convert declared recovery capability into demonstrated capability, so that objectives are proven before they are needed.

Discussion

This is the control that makes the rest of the family real, and it is the one the framework's own analysis identifies as most often asserted rather than demonstrated. The scenario is where exercises usually fall short: an exercise that restores a single application from a clean environment demonstrates a procedure, not a reconstitution. The scenarios that test what RC-2 and RC-3 actually claim are the uncomfortable ones — loss of the identity plane, loss of the management plane, recovery under an assumption that production credentials are held by the adversary. An exercise program that has never run those has not tested the family's central dependency.

Goals and Metrics

A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.

Accountability

Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.

Inputs and Outputs

Activities

1. L2Exercise reconstitution against a stated failure scenario.
2. L2Record the scenario, participants, measured elapsed times and findings raised.
3. L2Compare measured times against declared objectives.
4. L3Define the exercise cadence with provenance per GA4, and flag objectives overdue for demonstration.
5. L3Include at least one scenario per period in which the identity plane is unavailable and production credentials are assumed adversary-held.
6. L3Exercise the dependency sequence across services (RC-3) rather than single services in isolation.
7. L3Disposition findings raised by exercise through CG-4 rather than closing them with the exercise report.
8. L4Measure the proportion of declared objectives demonstrated within their stated period, and treat a shortfall as a reportable condition.
9. L4Trend measured recovery times across exercises, since drift upward indicates decay in procedures that still pass.
10. L5Derive scenarios from observed adversary tradecraft and from engagements under M10, rather than repeating a scenario library that the estate has learned to pass.

Measurement

Evidence and Assessment

Related Guidance

Position in the Chain

Derived from the other controls’ own declarations, so the two directions cannot disagree.

Where This Control Is Used

Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.