Recovery - NIST 800-61 Incident Response Phase

Recovery is the NIST SP 800-61 incident response phase in which systems are restored to normal operation with confidence that the adversary is no longer present and re-infection is prevented. Recovery follows eradication and precedes post-incident activity. The recovery phase is the most visible to business stakeholders and is the most common source of post-incident dispute (insurance, regulators, customers).

What Recovery Includes

• Rebuild or restore affected systems from known-good images and backups
• Re-integrate restored systems into production with appropriate monitoring
• Restore data to the appropriate Recovery Point Objective (RPO)
• Meet the Recovery Time Objective (RTO) for each restored function
• Verify that all restored systems are operational and free of the adversary
• Heightened monitoring of restored systems for residual indicators

Recovery Validation

Recovery is not complete until each restored function meets pre-defined success criteria. For ransomware incidents this typically includes validated backup integrity (restored backups themselves are not infected), credential rotation across all affected and dependent systems, and a defined monitoring window during which any residual adversary activity would be detected.

Common Recovery Mistakes

• Restoring from backups created during the dwell window (which contain adversary persistence)
• Skipping eradication validation before declaring recovery complete
• Restoring connectivity before credential rotation is complete
• Declaring recovery complete based on availability alone, not on absence of adversary
• Insufficient heightened monitoring after recovery (the adversary often tests re-entry within days)