Cyber Continuity Checklist

ISPI-branded title page with the standards it is built on, version and date, fill-in fields for your organization, document owner and local version, and the disclaimer.

• Assign a continuity coordinator and an incident response lead to complete the checklist together.
• Start with Part 2: list essential functions and their supporting systems, and agree recovery objectives with function owners. The rest of the checklist depends on those answers.
• Mark each item Done or N/A and record evidence in Notes. Items marked N/A should have a short reason.

Plus purpose, scope, who it is for and 3 more how-to steps.

Table with an assigned-to field for each role: Executive or continuity authority, Continuity coordinator, Incident response lead, IT manager or managed service provider, OT and system owners, Cybersecurity Officer (MTSA facilities), Legal counsel and privacy lead, Public information officer, Finance and procurement, Emergency manager.

Basis: CSF 2.0 GV.OC, GV.RM, GV.RR, GV.PO, GV.SC; NIST SP 800-61r3 (preparation); FEMA CGC (program management)

Set the authority, priorities and obligations before an incident.

Fill-in fields: Organization; Continuity coordinator; Incident response lead; Managed service provider and contract reference; Cyber insurance carrier and policy number; Date of last plan review.

• A cyber continuity policy assigns roles and authority and is approved by leadership.
• Cyber scenarios (ransomware, loss of connectivity, OT compromise) are included in the continuity of operations plan.
• Legal and regulatory obligations are listed in a register: breach notification, sector reporting, Coast Guard reporting for MTSA facilities, records law and insurer conditions.

+ 4 more checklist items, each with Done and N/A boxes and a notes field.

Basis: NIST SP 800-34 Rev. 1 (business impact analysis); FEMA CGC (essential functions); CSF 2.0 ID.AM, ID.RA

Essential functions are the services you must keep running or restore first. Record the systems each one depends on and how long it can be down. MTD is the maximum tolerable downtime; RTO is the recovery time objective; RPO is the recovery point objective, the amount of data loss that is acceptable.

Table: Business impact analysis (columns: Essential function, Supporting systems and data, MTD, RTO, RPO, Manual workaround, Owner).

• Essential functions are identified and ranked with their owners.
• An inventory of IT and OT assets, software and cloud services is current, with owners.
• A network map shows internet, cable and satellite paths, remote access and links between IT and OT.

+ 3 more checklist items, each with Done and N/A boxes and a notes field.

Basis: CSF 2.0 PR.AA, PR.AT, PR.DS, PR.PS, PR.IR; CISA Cross-Sector Cybersecurity Performance Goals 2.0

Reduce the chance that an incident becomes a continuity event, and make recovery possible.

Fill-in fields: Backup tool and location of offline or immutable copy; Date of last successful full restore test.

• Multifactor authentication protects email, remote access, administrator accounts and cloud consoles.
• Administrators use separate privileged accounts, and least privilege is applied.
• Default passwords are changed on IT and OT devices.

+ 6 more checklist items, each with Done and N/A boxes and a notes field.

Basis: CSF 2.0 DE.CM, DE.AE; NIST SP 800-61r3 (incident response)

Know who watches for trouble, who answers at night and on weekends, and how alerts become decisions.

Fill-in fields: Monitoring provider or tool; After-hours on-call contact; Escalation time target from alert to incident lead.

• Security alerts from endpoints, email, firewalls and cloud services reach a named person or provider at all hours.
• On-call coverage accounts for time-zone differences with mainland or overseas vendors.
• Staff know the signs of ransomware and account compromise and how to report them.

+ 2 more checklist items, each with Done and N/A boxes and a notes field.

Basis: NIST SP 800-61r3 (CSF RS.MA, RS.AN, RS.CO, RS.MI); 33 CFR 101.650 and 101.305 (ports); FEMA CGC (continuity communications)

Act quickly, preserve evidence, keep people safe and tell the right people. Keep this part on paper.

Table: Notification and contact list (columns: Who, When to notify, How (out-of-band), Contact, Done). Rows include Executive or continuity authority, Incident response lead and managed service provider, Legal counsel, Cyber insurer, CISA (cisa.gov/report), FBI field office or IC3 (ic3.gov) and more.

• The incident is declared, logged with times and actions, and an incident lead is named.
• The response is organized under the Incident Command System where it affects public services.
• Containment decisions (isolating systems or networks, disabling accounts, disconnecting OT) are made with system owners and with safety first.

+ 4 more checklist items, each with Done and N/A boxes and a notes field.

Basis: FEMA Continuity Guidance Circular (essential functions, orders of succession, delegations of authority, continuity facilities, continuity communications, essential records management, human capital, devolution, reconstitution); FEMA continuity plan template for non-federal governments

Assume key systems are unavailable for days or weeks. Plan how each essential function continues by hand.

Table: Manual operations plan (columns: Essential function, Manual or alternate procedure, Paper forms and records needed, Staff and location, Owner).

• Orders of succession and delegations of authority cover the incident lead and continuity authority.
• Paper copies of contact lists, procedures, vendor details and account numbers are current and stored securely.
• Manual procedures exist for payroll and payments, permitting, public records requests, utility billing, and for ports gate access and cargo documentation.

+ 4 more checklist items, each with Done and N/A boxes and a notes field.

Basis: CSF 2.0 RC.RP, RC.CO; NIST SP 800-61r3; NIST SP 800-34 Rev. 1 (recovery and reconstitution); NIST SP 800-184

Restore in priority order from clean sources, verify, and only then reconnect.

Table: Restoration order (columns: Priority, System, Restore source, Validation check, Owner, Restored (date and time)).

• Restoration follows the priority order agreed in Part 2.
• Backups are checked for integrity and for signs of the threat actor before restore.
• Systems are rebuilt from known-good images where compromise is suspected.

+ 5 more checklist items, each with Done and N/A boxes and a notes field.

Basis: IMO MSC-FAL.1/Circ.3/Rev.3 (govern, identify, protect, detect, respond, recover); Resolution MSC.428(98); 33 CFR Part 101, Subpart F (sections 101.620 to 101.665)

For port authorities, marine terminals and other facilities that must have a Facility Security Plan under 33 CFR Part 105. Confirm current compliance dates and any amendments in the Code of Federal Regulations.

Fill-in fields: Cybersecurity Officer and alternate; Facility Security Plan reference; Cybersecurity Plan status and approval date; Cyber Incident Response Plan reference.

• A Cybersecurity Officer (and alternate, if designated) is named in writing.
• A Cybersecurity Assessment has been completed, and a Cybersecurity Plan and Cyber Incident Response Plan exist.
• Account security measures are in place: lockout, no default passwords, minimum password strength, multifactor authentication, least privilege, separate credentials on critical IT and OT, and prompt removal of credentials at departure.

+ 6 more checklist items, each with Done and N/A boxes and a notes field.

Basis: CSF 2.0 ID.IM; NIST SP 800-61r3 (lessons learned); NIST SP 800-34 Rev. 1 (testing, training and exercises; plan maintenance); FEMA CGC (test, training and exercise)

A plan nobody has practiced will not work under pressure. Schedule, run and learn.

Table: Exercise and maintenance schedule (columns: Activity, Frequency, Owner, Last done, Next due). Rows include Tabletop exercise (ransomware with loss of connectivity), Full restore test of an essential system, Contact list verification, Manual operations drill, Plan and checklist review.

• At least one cyber tabletop a year includes leadership, the managed service provider and, where relevant, OT owners and the emergency manager.
• A scenario combining a cyber incident with a natural hazard is exercised.
• After-action reports produce an improvement plan with owners and dates.

+ 1 more checklist items, each with Done and N/A boxes and a notes field.

Basis: NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0; NIST SP 800-61r3

Shows where each CSF 2.0 function is addressed, for auditors and grant applications.

Table: CSF 2.0 crosswalk (columns: CSF 2.0 function, Checklist part, Related guidance, Notes). Rows include Govern (GV), Identify (ID), Protect (PR), Detect (DE), Respond (RS), Recover (RC).

Name, signature and date for: Continuity coordinator, Incident response lead, Executive or continuity authority, Legal counsel, Cybersecurity Officer (ports, if applicable).

Version, date, description of change, changed by and approved by, starting with version 1.0 (October 30, 2026).

1. National Institute of Standards and Technology, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 26, 2024). Source
2. Nelson A, Rekhi S, Souppaya M, Scarfone K. Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile, NIST SP 800-61r3 (April 2025). Source
3. National Institute of Standards and Technology, Contingency Planning Guide for Federal Information Systems, NIST SP 800-34 Rev. 1 (May 2010, includes updates as of November 11, 2010). Source
4. National Institute of Standards and Technology, Guide for Cybersecurity Event Recovery, NIST SP 800-184 (December 2016). Source
5. Federal Emergency Management Agency, Continuity Guidance Circular (February 2018, 2024 update). Source
6. Federal Emergency Management Agency, Continuity Plan Template and Instructions for Non-Federal Governments. Source
7. International Maritime Organization, Guidelines on Maritime Cyber Risk Management, MSC-FAL.1/Circ.3/Rev.3 (April 4, 2025). Source
8. International Maritime Organization, Resolution MSC.428(98), Maritime Cyber Risk Management in Safety Management Systems (June 16, 2017). Source
9. U.S. Coast Guard, Cybersecurity in the Marine Transportation System, final rule, 90 FR 6298 (January 17, 2025; effective July 16, 2025), codified at 33 CFR Part 101, Subpart F. Source
10. Cybersecurity and Infrastructure Security Agency, Cross-Sector Cybersecurity Performance Goals, Version 2.0 (December 2025). Source