Reconstitution and Recovery
Recovery held outside the blast radius and proven by exercise
Every mission service shall have a declared recovery time objective and recovery point objective, approved by the service owner, recorded on the terrain overlay before an incident occurs.
PurposeTo establish what recovery must achieve, so that restoration can succeed or fail rather than simply take however long it takes.Activities10 · Metrics2The means of recovery shall be held outside the trust boundary of the production identity plane, such that compromise of production credentials cannot reach, alter, or destroy them.
PurposeTo ensure the recovery capability survives the compromise it exists to recover from.Activities10 · Metrics2For every decisive point, the organization shall maintain a documented and tested path to rebuild the element from trusted media within its declared recovery time objective.
PurposeTo ensure that what must not be lost can be rebuilt, from a source the adversary did not touch, inside the time the mission requires.Activities10 · Metrics2Restored data and rebuilt systems shall be verified against an integrity record maintained independently of the system being restored, before the service is returned to use.
PurposeTo ensure restoration returns the mission to a known-good state rather than reinstating the compromise.Activities10 · Metrics2The organization shall exercise reconstitution against a stated failure scenario on a defined cadence, and every declared recovery objective shall have been demonstrated within its stated period.
PurposeTo convert declared recovery capability into demonstrated capability, so that objectives are proven before they are needed.Activities10 · Metrics3