Following a disaster, a system is recovered onto a new hardware platform at a new permanent facility. Before the contingency plan is deactivated, what must be determined?

Answer: D) Whether the change calls for reassessment and reauthorization

SP 800-34 Rev. 1 states that during reconstitution the ISCP Coordinator, with the system owner, ISSO, and senior agency information security officer and the concurrence of the authorizing official, must determine whether the system has undergone significant change requiring reassessment and reauthorization; it cites a new hardware platform and a move to a new facility as examples. Lease, contract, and user-acceptance questions matter, but they do not decide whether the recovered system is still securely authorized.