Proactive Recovery: Recoverability, Rehearsal and Communication

All courses / AI Red Team / Module 7 / Chapter 24

Learning objectives

After the lesson the participant can:

Distinguish a recovery plan from recoverability and list what a recoverability profile tracks per service.
Apply the three rules that keep predicted recovery times honest.
Route a drill finding to the Function, owner and backlog that can close it.
Draft a recoverability test definition and the four prepared elements of recovery communication.

Key concepts

Recoverability profile: Per service: the date of the last successful drill, the measured restore time, the achieved recovery point, the dependencies not restored and the time to release the first prepared message. Each measurement has an age.
Assume breach: Proactive recovery assumes the adversary will destroy or corrupt something that matters and will target the means of restoring. Drills therefore use the same protected sources and separated credentials as a real recovery.
Prediction is not evidence: A predicted restore time that exceeds the objective triggers a drill or a finding, and one that meets it does not extend the drill interval. Predictions are recalibrated against every drill and never published as a commitment.
Findings as pull requests: A dependency, a missing backup or an unrealistic objective found in a drill becomes a change to the plan, inventory, backup policy or objective. AI drafts the pull request, a person merges it, and the drill is re-run to prove the finding closed.
Four prepared elements of communication: A message library with pre-approved wording and marked slots for facts, an approver rota with deputies reachable out of hours, channels independent of the affected systems, and release targets measured in exercises.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Sort

Assumed or measured

Sort each statement: is it what a reactive organisation assumes, or what a proactive organisation measures?

Interactive exercise 2 · Scenario

A prediction above the objective

Apply the three rules for predictions, as head of resilience at an organisation like yours.

Teaching plan

10 min	The teacher contrasts what a reactive organisation assumes with what a proactive one measures, and introduces the recoverability profile.
15 min	Walk through what a drill restores, the mundane dependencies that break drills, and the four points where AI reduces the cost without executing.
15 min	Read Nordvik Region's test definition NR-SEC-004-RD-07 and route its possible findings using the table of findings by Function.
25 min	Exercise: groups write a recoverability test definition for one service and the record for one prepared recovery message.
10 min	Groups name the three errors specific to recovery communication and show how their message record prevents each.

Discussion

A drill that succeeds only because it uses an administrator's everyday account proves nothing. What else makes a drill unrepresentative of a real recovery?
Which dependencies in your estate are shared by everything and therefore owned by nobody in the plan?
Why can a message with pre-approved wording and verified facts be approved quickly without being rubber-stamped?

Written exercise

Exercise · 25 minutes

Define a monthly restore drill and a prepared message

Part one: for one critical service in your organisation, write a recoverability test definition in the structure of NR-SEC-004-RD-07: objectives, cadence and blackouts, the isolated environment and its data, each component restored with its source and verification, supplier steps with commitments, the assistant's autonomy level and access, acceptance criteria, an abort condition independent of the assistant, the evidence records, and where each kind of finding is routed and when it closes. Part two: write the record, not the wording, of one prepared recovery message: audience, where each slot's fact comes from, what may never be said, who approves and the deputy, the channels and the release target.

Deliverable: A recoverability test definition for one service and one prepared message record with fact sources, prohibitions, approver, channels and release target.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

From which source may the drafting assistant take the state of a service for a recovery message?
Show the answer
C. The verified return-to-service record
To avoid the error of premature restoration, the assistant takes service state only from the verified return-to-service record, not from an orchestration report that the service is running.
Where does the chapter route a drill finding that an RTO has never been met by any drill?
Show the answer
B. To Govern and the risk register: the business owner funds faster recovery or accepts a longer objective
An unrealistic objective is a Govern finding on risk appetite (GV.RM): it goes to the risk register, and the business owner funds faster recovery or accepts a longer objective.
In Nordvik Region's drill programme, what does the assistant at Level 0 Advisory do?
Show the answer
A. It predicts, compares and drafts, while people and the supplier execute every step
The assistant runs on the Region's self-hosted capacity at Level 0 Advisory with read access to drill logs and range telemetry; the platform team, the MSSP and suppliers carry out every step.