Objective
Eradicate, verify, and preserve availability through the recovery.
Joint meaning. Stabilize.
Discussion
The adversary is out; the estate is not yet trustworthy. Stabilize eradicates what remains, verifies what is restored, and preserves availability through the recovery — which is frequently the hardest of the three, because recovery pressure and statutory deadlines arrive together.
The distinguishing feature of this phase is that everything in it is a claim requiring proof. This system is clean. This backup is good. This credential is new. Each is a statement that can be wrong, and the phase’s entire discipline is refusing to accept any of them without an independent check.
Authority narrows here, deliberately and counter-intuitively. The same automation that contained the adversary will happily contain the restoration: a pre-authorized isolation rule firing on a rebuilt system’s first unusual behavior is a self-inflicted outage during the exact window in which availability is most contested.
What the Main Effort Typically Is
Restoration without verification returns the estate to service with an unproved claim at its center — and the claim that fails is usually the one nobody thought to check, because it was the one everybody assumed. Verification against an independently held integrity record is the only step that converts a restored system into a trusted one.
Typical, not prescribed. The main effort is designated per campaign against the decisive points the terrain analysis produced; what this phase does is narrow the field of sensible answers.
Dominant Forms of Maneuver
- M8 Isolation / RetrogradeGive ground deliberately to preserve the force. Degrade gracefully; never fail open. Indicator: Containment is achieved without losing statutory availability.
- M10 Exploitation & PursuitConvert contact into durable advantage rather than closing the ticket. Indicator: The same avenue of approach is never successfully used twice.
- M11 ReconstitutionRestore the mission on evidence, not on hope — and prove it before you need it. Indicator: Every recovery objective has been demonstrated within its stated period.
Entry and Exit Conditions
A phase is declared on an observable condition and ended on one. Declaring on a feeling produces a phase nobody can argue with and nobody can end.
Declare This Phase When
- Eviction verified. Declaring Stabilize while the adversary may still hold access is how a recovery becomes a second incident.
- Recovery objectives and the trusted rebuild paths are to hand — not being written now.
Leave This Phase When
- Every affected mission service is back inside its declared recovery objective, and restored data has been verified against an independent integrity record.
- The pre-authorized set has been restored to its phase-appropriate width and the suspensions applied during recovery have been lifted deliberately, item by item.
- Closing the tickets is not exit. Exit is the objectives being met and the verification being recorded.
What Changes in Cadence and Authority
These are the two operational consequences of the declaration. A phase change that moves neither has changed a word on a slide.
- Cadence
- Daily, driven by the recovery sequence rather than by the analytic cycle. The loop still turns, but its rhythm is set by dependency order and statutory priority — which service comes back first is a mission decision that was made in Phase 0 and is executed here.
- Authority
- Narrows, deliberately. Destructive pre-authorizations are suspended for the duration of the recovery and the suspension is itself recorded, with an owner and a restoration point. The Authorizing Official re-enters the decision path for anything that would take a restored service back down.
How It Differs from the Phases Beside It
Against Dominate
Dominate fights an adversary. Stabilize proves claims. The skills, the tempo and the authority posture are all different, and treating the two as one continuous incident response is why recovery so often runs on the fumes of the response team.
Against Enable / Restore
Stabilize restores the service. Restore restores the program — the exploited avenue closed, the overlay and requirements updated, the doctrine changed. Stopping at Stabilize is the commonest way a campaign ends without the organization learning anything.
The Controls Most Active in This Phase
- RC-3 Trusted Rebuild PathThe trusted rebuild path is walked in earnest, against the time budget declared in Phase 0.
- RC-4 Recovery Integrity VerificationRestored data is verified against the independently held integrity record. This is the phase’s main effort in control form.
- RC-1 Recovery ObjectivesRecovery objectives are the exit criteria, and they were set before the incident for exactly this reason.
- FC-4 Environmental ContinuityEnvironmental endurance becomes a live constraint when a recovery runs long.
- TA-4 Pre-authorized ResponseDestructive pre-authorizations are suspended and the suspension is recorded with a restoration point.
- FO-5 Statutory Availability FloorThe availability floor now governs restoration order rather than degradation.
The Failure Mode Particular to This Phase
Recovery contained by the program’s own automation.
- The tell
- A rebuilt system is isolated by a pre-authorized rule during restoration, and the outage is recorded as a recovery delay rather than as an authority failure.
- The correction
- Suspend destructive pre-authorizations at the declaration of Stabilize, with a named owner and a restoration point per suspension. Both halves matter — an unrecorded suspension becomes a permanent hole in the response posture.
Caveats That Hold Across Every Phase
- A phase is declared against a scope, not against an agency. An estate can be in Dominate on one mission service and Shape on everything else. The phase declaration control is written to carry a scope for exactly this reason, and a declaration without one is a statement nobody can act on.
- Phases are not maturity. Being in Phase III is not progress. It means an adversary is on or adjacent to key terrain. A program that reads the phase list as a ladder will start reporting phase advancement as achievement, which inverts the meaning of the entire model.
- Regression must be declarable without embarrassment. Campaigns go backwards. An eviction that turns out to be incomplete returns the campaign to Dominate from Stabilize. If declaring that costs someone their credibility, it will not be declared, and the campaign will be fought in the wrong phase.