What it asks for. The Recover function asks organisations to restore assets and operations affected by a cybersecurity incident. It covers executing recovery plans and communicating recovery activities, so that normal operations return in a timely way and the impact is reduced.
In practice. Recovery plans are based on business impact analysis with defined recovery time and recovery point objectives. Restoration is prioritised by criticality, the integrity of backups and restored assets is verified before return to service, and the end of recovery is formally declared. Communication with stakeholders runs alongside. Evidence includes recovery plans, backup and restore test results, recovery exercise reports and post-incident records showing actual recovery times.
Common gaps. Common gaps are backups that are never tested in a realistic scenario, backups reachable by the same attacker, and recovery objectives that do not match what the technology can deliver. Recovery from ransomware across many systems at once is rarely rehearsed.