CIP-009 aims to ensure recovery plans are tested how often?

CIP-009, which is part of the NERC Critical Infrastructure Protection standards, specifically focuses on the recovery plans related to cybersecurity incidents. The standard requires that recovery plans be tested at least once every 15 months to ensure they remain effective and up-to-date. This testing is crucial for validating the procedures and strategies in place to recover from a security breach or other incidents impacting the reliability of critical infrastructure.

Regular testing of recovery plans ensures that personnel are familiar with their responsibilities, that the plans are practical, and that any weaknesses can be identified and addressed before they can lead to significant operational issues. This periodical review reinforces an organization's resilience and helps maintain compliance with NERC requirements, which aim to protect the reliability of the electric grid.

The other options do not align with the standard's requirements: testing monthly may be excessive for many organizations, while only testing during incidents or in response to audits would not provide the proactive approach necessary for effective cybersecurity management and preparedness.