Eradication and Transition to Recovery

Control Statement

Incidents shall be eradicated, the eradication verified, and the transition to recovery made against defined criteria with recovery actions selected, scoped and prioritized.

Purpose. To ensure the adversary is actually gone before the mission is restored, and that the transition is a decision rather than a drift.

Discussion

The transition from M8 Isolation to M11 Reconstitution is the most consequential judgment in an engagement and is usually made informally, under pressure to restore availability, on the basis that nothing further has been observed. Absence of observation is not verification, particularly where EN-2 found visibility gaps. The recovery-action scoping requirement addresses the other half: RC-3 sequences rebuild paths and RC-5 exercises them, but nothing selected which actions this particular incident requires, and restoring more than necessary extends outage while restoring less leaves the adversary a foothold.

Goals and Metrics

A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.

Accountability

Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.

Inputs and Outputs

Activities

1. L2Eradicate the adversary's presence and access.
2. L2Define the criteria for transition from containment to recovery.
3. L2Select and scope the recovery actions this incident requires.
4. L3Verify eradication actively — by hunting against the reconstructed tradecraft from EN-2 — rather than concluding from absence of further observation.
5. L3Include identity-plane eradication explicitly: credential, token and assertion revocation across every plane identified under ID-1, since access persists there after endpoint eradication.
6. L3Prioritize recovery actions against mission and terrain, and record the basis.
7. L3Require the transition decision to be taken by the authority defined in EN-4 and recorded, rather than occurring by default.
8. L3Withhold transition where EN-2 recorded visibility gaps material to the eradication claim, or record the residual risk acceptance under CG-4.
9. L4Measure recurrence: an incident recurring through the same avenue within a defined window is an eradication failure and should be counted as one.
10. L4Measure elapsed time from containment to verified eradication, which is a distinct interval from the containment measured under TA-1.
11. L5Feed eradication failures into M10 avenue closure verification and into the detection engineering backlog, since a recurrence is a detection gap as much as an eradication one.

Measurement

Evidence and Assessment

Related Guidance

Position in the Chain

Derived from the other controls’ own declarations, so the two directions cannot disagree.

Where This Control Is Used

Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.