Recovery Plan Execution with AI: From Incident to Restored Operations

All courses / AI Red Team / Module 7 / Chapter 22

Learning objectives

After the lesson the participant can:

State the five things a recovery plan must record for each business service, including the difference between RTO and RPO.
Explain why the restore point is defined relative to the earliest indicator of compromise.
Assign autonomy levels to recovery steps by reversibility, for production and for rehearsal.
Draft a recovery plan as code and the checks of a return-to-service record.

Key concepts

RTO and RPO: The recovery time objective is the longest time a service may be unavailable before the impact becomes unacceptable; the recovery point objective is the largest amount of data, measured in time, the organisation can afford to lose. Both are business decisions made by the service owner.
Restore point before the compromise: The restore point is the latest one before the earliest indicator of compromise, because a backup taken after persistence was established preserves the compromise. AI proposes it from the timeline and the backup catalogue; the recovery lead decides.
Clean room: An isolated recovery environment, built from trusted definitions and kept apart from the production network and identity plane, in which restored systems are assembled and verified before they are trusted. It is sized for tier-0 and tier-1 services, not the whole estate.
Two confirmations for return to service: The incident-response lead confirms that the adversary has been removed, and the system owner approves that the service is fit to resume. AI evaluates the verification set and drafts the summary, but it does not decide.
End of recovery: Declared by the incident commander on criteria held in the plan: services verified or carried as recorded deviations, the re-entry watch clear, emergency access revoked and documentation complete. The declaration ends the authority under which the incident team has acted.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Put in order

Executing a recovery plan

Put these steps of the chapter's recovery guide in order, from initiation to the end of recovery.

Interactive exercise 2 · Scenario

Ready to reconnect?

Apply the return-to-service rule, as recovery lead at Hansa Mutual.

Teaching plan

15 min	The teacher presents why recovery is neglected, what a plan must state, and the obligations in NIS 2 Article 21(2)(c) and DORA Articles 11 and 12 as one design.
15 min	Read the plan RP-HM-CLM-001: dependencies and restore order, restore point selection, step levels and the two confirmations.
15 min	Discuss restore versus repair, immutable backups designed on the assumption that production administrators are compromised, and the five practices of a contested recovery.
35 min	Exercise: groups write a recovery plan as code for one service and the checks of its return-to-service record.
10 min	Groups check each other's plans: is any RTO shorter than that of a dependency, and which objective would the proposed sequence miss?

Discussion

The worked return-to-service record shows data loss beyond the RPO as a deviation. Why is recording it better than restoring from the latest backup to meet the objective?
Which components in your estate have no known-good definition, and how long would manual reconstruction take?
Why is Level 4 Autonomous not used in recovery, even for steps that are reversible?

Written exercise

Exercise · 35 minutes

Write a recovery plan as code

Choose one business service in your organisation, or a citizen-facing service at Nordvik Region that depends on suppliers. Write its recovery plan in the structure of RP-HM-CLM-001: owner, business impact tier with rationale, RTO and RPO, dependencies with tier and whether each is restored first, restore sources for infrastructure, images and data with the rule for selecting the restore point, the clean room, and four steps each marked reversible or not with an autonomy level for production and for rehearsal. Add supplier steps with their contractual commitment. List the verification set, who confirms and who approves return to service, and the end-of-recovery criteria including the re-entry watch.

Deliverable: A recovery plan as code with objectives, dependencies, restore sources, levelled steps, verification, return-to-service confirmations and end criteria.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

How is the restore point for data defined in Hansa Mutual's recovery plan for the motor claims service?
Show the answer
C. As the point before the earliest indicator of compromise
The plan selects the point before the earliest indicator of compromise, because the latest backup may contain the attacker's changes. Immutability does not stop a backup from preserving a compromise.
At which level does the irreversible step of reconciling transactions run in the plan?
Show the answer
A. Level 1 Assisted, in production and in rehearsal
Reversible steps run at Level 2 Supervised in production and Level 3 Bounded in rehearsal, but the irreversible reconciliation step never rises above Level 1 Assisted.
Which is the first of the chapter's practices for a contested recovery?
Show the answer
D. Restore the identity plane first and treat every existing credential as compromised
The five practices begin with restoring the identity plane first and treating every existing credential as compromised, followed by out-of-band communication, staged reconnection, protecting recovery tooling and watching for re-entry.