R3 - Recovery Plan Review and Update

The R3 requirement in NERC CIP-009 obligates entities to periodically review and update their recovery plans to keep them current with system changes and operational lessons learned. Reviews must be documented, incorporate findings from tests or real events, and result in revisions that maintain compliance and enhance the organization's ability to restore critical infrastructure after an outage.