Intent, Mechanism and Indicator
Restore the mission on evidence, not on hope — and prove it before you need it.
Role. The form that is asserted and not demonstrated
Recovery objectives declared per mission service; means of recovery held outside the production identity plane; a tested rebuild path that includes the identity plane itself; restored data verified against an independent integrity record.
Every recovery objective has been demonstrated within its stated period.
Terrain It Consumes
Derived from where the form’s techniques are actually emplaced. The highlighted layer is the one the catalog names as its principal ground — the rest is terrain the form still has to touch, and that spread is how much of the estate employing it implicates.
- T1IdentityThe high ground1 technique
- T2DevicesThe entry fords1 technique
- T4Applications and WorkloadsThe urban terrain3 techniques
- T5DataThe objective2 techniques
- T7WorkforceTerrain that is also the force1 technique
- T8FacilitiesThe physical boundary1 technique
- T9Supply ChainThe lines of communication1 technique
- TXCross-CuttingThe enablers of movement1 technique · principal ground
Campaign Phasing
Dominance is taken from the campaign model; participation is derived from the techniques themselves. A form is usually present in more phases than it leads, and confusing the two is how a scheme ends up with no main effort.
| Phase | Role | Phase objective | Techniques employed |
|---|---|---|---|
| Phase 0 — ShapeSet conditions | Supporting | Continuous terrain preparation, zero-trust hardening, partnerships, threat intelligence. | 5 of 11 |
| Phase IV — StabilizeRestore secure operations | Dominant — main effort | Eradicate, verify, and preserve availability through the recovery. | 8 of 11 |
| Phase V — Enable / RestoreHand back to garrison | Dominant — main effort | Recover, harden, and update the doctrine and the intelligence requirements. | 5 of 11 |
Phase 0 — Shape
Set conditions
- Role
- Supporting
- Phase objective
- Continuous terrain preparation, zero-trust hardening, partnerships, threat intelligence.
- Techniques employed
- 5 of 11
Phase IV — Stabilize
Restore secure operations
- Role
- Dominant — main effort
- Phase objective
- Eradicate, verify, and preserve availability through the recovery.
- Techniques employed
- 8 of 11
Phase V — Enable / Restore
Hand back to garrison
- Role
- Dominant — main effort
- Phase objective
- Recover, harden, and update the doctrine and the intelligence requirements.
- Techniques employed
- 5 of 11
Employment
When to Choose It
Reconstitution is not chosen under contact; it is resourced in Phase 0 and exercised on a cadence, and the only decision available during an incident is whether to invoke what already exists. Choose to invest in it when the agency cannot answer, from evidence, how it would rebuild the identity plane if the identity plane were the thing that was compromised. Almost every program asserts recovery. Very few have demonstrated recovering the trust anchors from means that production credentials cannot reach, and the assertion and the demonstration are not the same claim.
Precondition
A recovery objective per mission service, signed by the service owner. Without a stated time and a stated tolerable data loss, recovery cannot succeed or fail — it can only take however long it takes.
What It Costs
Expensive and unglamorous: a second copy of the estate’s trust anchors held outside its blast radius, storage that cannot be reached with production credentials, and exercises that take real services down on purpose to prove a number. The exercise cost is the one that gets cut, and cutting it converts a capability back into a document.
Rules of Engagement
Invoking recovery is an AO decision, because it is a declaration that the estate is being rebuilt rather than repaired. The preconditions for restoring a service after containment should be written down in advance — restoring into an uncleared estate is how a single incident becomes two.
How It Fails
Not whether it fails — how. Each of these is a state in which the form is still reported as implemented and has stopped producing the advantage it was chosen for.
- Recovery depends on the plane that was compromised. The backup system authenticates against the same identity provider the adversary owns, so the means of recovery is inside the blast radius.
- Backups are reachable with production credentials. Immutability is configured but the retention lock can be lifted by an administrator the adversary has already become.
- Restoration is verified for completeness rather than integrity, so the adversary’s edits are restored faithfully along with everything else.
- The sequence was never rehearsed, so restoration order is improvised and the first service back is the one whose owner shouted loudest rather than the one the others depend on.
- A recovery-critical role is one person deep, and the plan silently assumes that person is reachable, available and not themselves the subject of the investigation.
- The plan has been reviewed but never executed. A recovery objective that has never been met under exercise conditions is an aspiration with a number attached.
Techniques (11)
Grouped by the terrain layer each is emplaced on. Techniques are the perishable layer of the framework — they churn, the form does not — so each is stated as what it does and the observable that shows it is working, never as a product.
T1 · Identity — 1 technique
- M11.04
Identity Plane Reconstitution
Rehearse rebuilding the identity plane itself, the one system every other recovery depends on.
IndicatorThe identity plane can be re-established without trusting the compromised one.
Phases- IV
T2 · Devices — 1 technique
- M11.03
Golden Image and Rebuild Path
Maintain a trusted, tested build path so rebuilding is a procedure rather than an improvisation under pressure.
IndicatorA decisive system can be rebuilt from trusted media within its recovery objective.
Phases- 0
- IV
T4 · Applications and Workloads — 3 techniques
- M11.01
Recovery Objective Declaration
Declare, per mission service, how quickly it must return and how much data loss is survivable — before an incident forces the answer.
IndicatorEvery mission service has a stated recovery objective its owner has signed.
Phases- 0
- M11.06
Service Restoration Sequencing
Restore in a declared order that respects dependency and statutory priority, so the first service back is the one that must be.
IndicatorRestoration follows the declared sequence under exercise conditions.
Phases- IV
- V
- M11.11
Mailbox and Message Restoration
Restore mailboxes and messages removed during eviction or lost in the incident, verified against an integrity record, before returning the service to use.
IndicatorLegitimate messages removed during response are restored and verified.
Phases- IV
- V
T5 · Data — 2 techniques
- M11.02
Isolated Recovery Environment
Hold the means of recovery outside the blast radius of the production identity plane, so compromise cannot reach what rebuilds you.
IndicatorRecovery is possible after total compromise of production identity.
Phases- 0
- IV
- M11.05
Recovery Data Integrity Verification
Prove restored data is what it was before contact, rather than restoring the adversary's edits along with it.
IndicatorRestored records are verified against an independent integrity record.
Phases- IV
Assessed by
T7 · Workforce — 1 technique
- M11.08
Key Personnel Continuity
Name the roles without which recovery cannot proceed, and make sure none of them is one person deep.
IndicatorEvery recovery-critical role has a rehearsed alternate.
Phases- 0
- V
T8 · Facilities — 1 technique
- M11.09
Alternate Facility Activation
Be able to run the mission from somewhere else, and prove it by doing so rather than by documenting it.
IndicatorThe alternate facility has carried the mission within its stated period.
Phases- IV
- V
T9 · Supply Chain — 1 technique
- M11.10
Supplier-Independent Rebuild
Ensure recovery does not depend on the availability or the integrity of the supplier who may be the reason you are recovering.
IndicatorA decisive system can be rebuilt without supplier assistance.
Phases- IV
Controls That Assess It
Derived from the controls the form’s own techniques name, so the assessment surface cannot disagree with the catalog. A control reached by many techniques is load-bearing for this form; one reached by a single technique is not, and an assessor sampling it will learn very little.
By Family
- RCReconstitution and Recovery5 controls · reaches 11 of 11 techniques
- FOFederal Obligations2 controls · reaches 2 of 11 techniques
- KTKey Terrain and Decisive Points2 controls · reaches 2 of 11 techniques
- CECycle Execution and Assurance1 control · reaches 1 of 11 techniques
- DVDevices Terrain1 control · reaches 1 of 11 techniques
- ENEngagement and Pursuit1 control · reaches 1 of 11 techniques
- FCFacilities Terrain1 control · reaches 1 of 11 techniques
- IDIdentity Terrain1 control · reaches 1 of 11 techniques
- LCLines of Communication1 control · reaches 1 of 11 techniques
- WFWorkforce Terrain1 control · reaches 1 of 11 techniques
By Control
- RC-3 Trusted Rebuild Path4 techniques — To ensure that what must not be lost can be rebuilt, from a source the adversary did not touch, inside the time the mission requires.
- RC-5 Reconstitution Exercise4 techniques — To convert declared recovery capability into demonstrated capability, so that objectives are proven before they are needed.
- RC-1 Recovery Objectives3 techniques — To establish what recovery must achieve, so that restoration can succeed or fail rather than simply take however long it takes.
- FO-5 Statutory Availability Floor2 techniques — To identify the point at which a defensive action becomes a legal one, so that degradation decisions are bounded before they are needed.
- FO-7 Obligation Profile Declaration2 techniques — To make the scope of the `FO` family an approved position, so that coverage figures are comparable and exclusions are decisions rather than silences.
- RC-4 Recovery Integrity Verification2 techniques — To ensure restoration returns the mission to a known-good state rather than reinstating the compromise.
- CE-1 Cycle Cadence1 technique — To keep the loop turning, so that defensive posture is a maintained position rather than a periodic assessment.
- DV-5 Device Lifecycle and Sanitization1 technique — To close the ends of the device lifecycle — the point of entry and the point of exit — where trust is granted and where it is most often left behind.
- EN-5 Eradication and Transition to Recovery1 technique — To ensure the adversary is actually gone before the mission is restored, and that the transition is a decision rather than a drift.
- FC-4 Environmental Continuity1 technique — To know how long the physical ground holds without support, so that recovery objectives are not contradicted by the buildings the services sit in.
- ID-1 Identity Plane Definition1 technique — To make identity positional, so that the plane controlling movement everywhere else is itself defensible ground rather than an assumed service.
- KT-1 Decisive Point Identification1 technique — To concentrate defensive effort on the small number of elements whose loss is decisive, so that priority is a stated judgment rather than an emergent property of the asset register.
- KT-2 Decisive Point Protection Floor1 technique — To ensure designation produces protection, so that identifying a decisive point is an act with consequences rather than an annotation.
- LC-5 Supplier Severance Capability1 technique — To retain the option of cutting a line of communication, so that a compromised or failed supplier is a decision rather than a dependency.
- RC-2 Isolated Recovery Capability1 technique — To ensure the recovery capability survives the compromise it exists to recover from.
- WF-1 Workforce Terrain Identification1 technique — To make the workforce positional, so that defensive effort concentrates on the roles an adversary would actually target.
The reconstitution controls carry this form end to end: declared objectives, isolation of the means of recovery, a tested rebuild path including the identity plane, integrity verification of restored data, and demonstration on a stated cadence. The federal-obligation controls test recovery against statutory availability rather than against internal preference. There is exactly one question worth asking an assessor to ask: show me the last exercise, and show me the objective it missed.
Sequencing
A scheme names a sequence, not a set. These are the ordinary neighbors of this form — not a mandatory order, but the order in which each one’s preconditions are usually met.
Typically Preceded By
- M8 Isolation / RetrogradeGround given deliberately during retrograde is the ground reconstitution takes back.
Typically Followed By
- M10 Exploitation & PursuitWhat the recovery exposed is the last and most expensive lesson of the cycle.
- M2 Defense in DepthA rebuilt estate is the cheapest estate to layer correctly, and the window is short.
Named as a successor by M8 Isolation / Retrograde. Derived from those forms’ own declarations, so the two directions of the sequence cannot disagree.