Response, Recovery and Resilience Tools

All courses / Tools / Module 4 / Chapter 13

Learning objectives

After the lesson the participant can:

Draft a clock sheet for one service that names each reporting regime, its owner and its limits as the organisation reads them.
State a recoverability claim with its six parts and derive its status from a restore-test record.
Select the kind of restore test that proves a given claim and its default clock.
Review an incident so that each action closes only on a signed re-test.

Key concepts

Incident record: The single account of an incident, family INC, from AI Operations: clocks, timeline, hypotheses by author, the assistant's contributions and the decisions with their holders. It must never contain a cause written by the assistant and stated as fact.
Clock sheet and incident clock: Complements. The clock sheet is written once per service before any incident and says which reporting clocks could open and who owns each; the incident clock, family CLK, is created per incident and opens the clocks from the moment of awareness.
Recoverability claim: A claim defined in AI Operations, Chapter 19, by six parts: subject, scenario, objective, result, date and expiry. A claim that lacks one is an assertion, and the test clock stops when an independent probe confirms an acceptable state.
Resilience register: A register of every recoverability claim, one row per claim, with six statuses derived from the latest test record and never edited. Its denominator includes untested and asserted claims.
Degradation-mode definition: An artefact of AI Red Team on the rule lose speed, never lose the defence: named modes from normal to manual with entry conditions. The monitor runs outside the agent's runtime, and the agent never chooses its own mode.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Sort

Clock sheet or incident clock?

The two records are complements. Sort each statement to the record it describes in Chapter 13.

Interactive exercise 2 · Scenario

The assistant's top-ranked cause

Choose what the incident commander should do, following the rules of the incident record in AI Operations.

Teaching plan

15 min	Present Figure 13.1 and the incident records. Explain the four classes of AI incident in AI Operations and the rule that every time is written by a system or a named role.
20 min	Read the Hansa Mutual clock sheet for underwriting support and compare it with the incident clock of AI Blue. Participants explain the awareness rule and the date the instruments were read.
20 min	Teach recovery: the recovery plan whose restore point is defined relative to the earliest indicator of compromise, the five kinds of restore test with default clocks, and the failed record RST-HM-2027-004.
10 min	Teach review and register: the two post-incident reviews, the action closure rule, the six statuses and the quarterly review checklist.
30 min	Exercise: participants write recoverability claims and a register extract for one service and plan the next test.
10 min	Debrief: how many claims were verified, asserted or untested, and what the board would be told.

Discussion

The restore test clock stops when an independent probe confirms an acceptable state, never when the restore command returns. What changes in a team's reported recovery times when this rule is applied?
In the review example an action stays open because the re-test took 14 minutes against a 10-minute target. What pressure does a closure rule of this kind put on an organisation, and is it healthy?
The chapter says a register with every claim in the denominator gives a board a smaller and more honest number. How would you introduce that number to a board used to a list of passed tests?

Written exercise

Exercise · 30 minutes

Recoverability claims and a register extract

Take one Tier 1 service of your organisation, or the claims core system of Hansa Mutual. Write three recoverability claims for it, each with the six parts: subject, scenario, objective, result, date and expiry. For each claim choose the kind of restore test that would prove it (restore from backup into a segregated environment, failover, rebuild from code, degraded or manual mode, restore at scale) and note the default clock. Then build a register extract of three rows giving the latest record, its age and a status. Where no test exists, say so. Finish by naming the next test to schedule, the independent probe and the attester.

Deliverable: Three six-part claims, a three-row register extract with status and evidence age, and a scheduled next test with probe and attester named.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

Which default clock does AI Operations propose for a rebuild-from-code test of a Tier 1 service?
Show the answer
B. 90 days
The table of five test kinds gives 180 days for restore from backup and failover, 90 days for rebuild from code and 365 days for degraded mode and restore at scale. Tier 2 clocks double.
How is the restore point defined in the recovery plan as code of AI Red Team?
Show the answer
D. Relative to the earliest indicator of compromise
The restore point is defined relative to the earliest indicator of compromise, not as the latest backup, because the latest backup may already contain the adversary's changes.
What happens to a failed restore-test result when the test is later repeated and passes?
Show the answer
C. The failed result is never overwritten; the later passing record supersedes it
The chapter states that a failed result is never overwritten and that a later passing record supersedes it. A failed result withdraws the claim and opens a problem record in the meantime.