Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Guide for Cybersecurity Event Recovery



Michael Bartock, Jeffrey Cichonski, Murugiah Souppaya, Matthew C. Smith, Gregory Witte, Karen Scarfone


In light of an increasing number of cybersecurity events, organizations can improve resilience by ensuring that their risk management processes include comprehensive recovery planning. Identifying and prioritizing organization resources helps to guide effective plans and realistic test scenarios. This preparation enables rapid recovery from incidents when they occur and helps to minimize the impact on the organization and its constituents. Additionally, continually improving recovery planning by learning lessons from past events, including those of other organizations, helps to ensure the continuity of important mission functions. This publication provides tactical and strategic guidance regarding the planning, playbook developing, testing, and improvement of recovery planning. It also provides an example scenario that demonstrates guidance and informative metrics that may be helpful for improving resilience of information systems.
Special Publication (NIST SP) - 800-184
Report Number


cyber event, cybersecurity, Cybersecurity Framework (CSF), Cybersecurity National Action Plan (CNAP), Cybersecurity Strategy and Implementation Plan (CSIP), metrics, planning, recovery, resilience


Bartock, M. , Cichonski, J. , Souppaya, M. , Smith, M. , Witte, G. and Scarfone, K. (2016), Guide for Cybersecurity Event Recovery, Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD, [online],, (Accessed May 22, 2024)


If you have any questions about this publication or are having problems accessing it, please contact

Created December 21, 2016, Updated January 4, 2022