<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-incident-recovery-planning
description: >-
  Design and execute structured recovery plans that restore services
  after security incidents with prioritized restoration sequences,
  integrity verification, and enhanced monitoring during recovery.
domain: cybersecurity
subdomain: incident-management
tags:
  - recovery
  - restoration
  - business-continuity
  - disaster-recovery
  - service-restoration
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0040"]
  nist-csf: ["RC.RP-1", "RC.IM-1", "RC.CO-1", "RC.CO-2"]
  frameworks: ["NIST SP 800-34", "NIST SP 800-61", "ISO 22301"]
---

# Implementing Incident Recovery Planning

## Overview

Incident recovery planning defines how to restore affected services
to normal operation after containment and eradication. Effective recovery
plans prioritize service restoration by business criticality, verify
system integrity before reconnection, and implement enhanced monitoring
during the recovery period to detect threat actor persistence.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Service dependency map | Restoration order based on dependencies |
| Backup inventory | Known-good backups with integrity verification |
| Integrity baselines | File hashes, config snapshots, golden images |
| Recovery time objectives (RTO) | Maximum acceptable downtime per service |

## Key Concepts

### Recovery Phases

```
ERADICATION COMPLETE
       │
       ▼
┌──────────────┐    ┌──────────────┐    ┌──────────────┐
│ Phase 1:     │───▶│ Phase 2:     │───▶│ Phase 3:     │
│ Verify Clean │    │ Restore Core │    │ Restore      │
│ Environment  │    │ Services     │    │ Dependent Svc│
└──────────────┘    └──────────────┘    └──────┬───────┘
                                               │
┌──────────────┐    ┌──────────────┐    ┌──────▼───────┐
│ Phase 6:     │◀───│ Phase 5:     │◀───│ Phase 4:     │
│ Normal Ops   │    │ Validate &   │    │ Enhanced     │
│ Declaration  │    │ Monitor      │    │ Monitoring   │
└──────────────┘    └──────────────┘    └──────────────┘
```

### Restoration Priority Matrix

| Priority | Service Type | RTO | Example |
|----------|-------------|-----|---------|
| P0 | Life safety, auth/identity | < 1 hour | SSO, DNS, DHCP |
| P1 | Revenue-generating | < 4 hours | Payment processing, API |
| P2 | Business-critical | < 8 hours | Email, collaboration |
| P3 | Internal operations | < 24 hours | Dev tools, analytics |
| P4 | Non-critical | < 72 hours | Archive, training |

### Integrity Verification Checklist

```
PRE-RESTORATION CHECKS:
├── OS integrity: Compare file hashes against golden image
├── Configuration: Diff against known-good config baseline
├── Credentials: All service accounts rotated
├── Certificates: Verify chain of trust, check for rogue certs
├── Network: Firewall rules verified, segmentation intact
├── Data: Backup integrity verified, no signs of tampering
└── Persistence: Check for scheduled tasks, cron jobs, services
```

## Workflow

1. Verify eradication is complete across all affected systems
2. Prioritize restoration order by service criticality and dependencies
3. Restore from verified clean backups or rebuilt images
4. Rotate all credentials on restored systems
5. Verify integrity before reconnecting to production network
6. Enable enhanced monitoring during recovery window
7. Declare normal operations after validation period

```bash
# Generate recovery plan for incident
node agent.js generate-plan --incident-id INC-2026-0200 \
  --affected-systems '["web-srv-01","db-srv-01","app-srv-02"]'

# Verify system integrity before restoration
node agent.js verify-integrity --hostname web-srv-01

# Track recovery progress
node agent.js track-recovery --incident-id INC-2026-0200
```

## Verification

- [ ] All affected systems verified clean before restoration
- [ ] Restoration follows dependency-ordered sequence
- [ ] Credentials rotated on all restored systems
- [ ] Enhanced monitoring active for 72-hour recovery window
- [ ] Normal operations declared only after validation period

## References

- NIST SP 800-61 Rev. 2 — Computer Security Incident Handling Guide
- MITRE ATT&CK Framework — https://attack.mitre.org/
- NIST SP 800-34
