Under CSF 2.0, restoring assets and operations affected by a cybersecurity incident is the outcome of which Function?

1. RECOVER is defined as: "Assets and operations affected by a cybersecurity incident are restored." 2. The expansion adds the purpose: RECOVER "supports the timely restoration of normal operations to reduce the effects of cybersecurity incidents and enable appropriate communication during recovery efforts". 3. RESPOND is the near neighbour and the one most often confused with it. RESPOND is "Actions regarding a detected cybersecurity incident are taken", and it "supports the ability to contain the effects" of the incident. 4. So the split is containment versus restoration: RESPOND stops the bleeding, RECOVER puts things back. 5. PROTECT applies safeguards before anything happens, and DETECT finds the incident in the first place. _Source: NIST CSWP 29 "The NIST Cybersecurity Framework (CSF) 2.0" (Feb 2024), section 2 "Introduction to the CSF Core"_