[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Frc-rp":3},{"item":4,"lessons":16,"controls":65,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","rc-rp","RC.RP-1","Recovery Planning (CSF 1.1)",25,"US National Institute of Standards and Technology (NIST)","**What it asks for.** In CSF 1.1 this Recover category required recovery processes and procedures to be executed and maintained to restore systems or assets affected by incidents. CSF 2.0 renamed it Incident Recovery Plan Execution and broadened it to include verifying backups, prioritising restoration and declaring the end of recovery.\n\n**In practice.** Recovery plans define priorities based on business impact, recovery time and point objectives, and the steps to restore systems from trusted sources. The integrity of restored assets is verified before return to production. Evidence includes recovery plans, restore tests, recovery records from incidents and post recovery reviews.\n\n**Common gaps.** Recovery objectives are often set without testing whether they are achievable. Restoring from backups that may contain the attacker's foothold is a frequent risk in ransomware cases.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,37,41,45,49,53,57,61],{"slug":19,"title":20,"published_at":21},"qilin-ransomware-core-member-arrested-after-international-extradition","Qilin Ransomware Core Member Arrested After International Extradition","2026-10-09T16:20:38.53+00:00",{"slug":23,"title":24,"published_at":25},"ransomware-encrypts-36-pb-of-cloud-data-across-495-japanese-government-and-corporate-clients","Ransomware Encrypts 3.6 PB of Cloud Data Across 495 Japanese Government and Corporate Clients","2026-10-08T22:21:40.501+00:00",{"slug":27,"title":28,"published_at":29},"teen-alleged-to-lead-killsec-ransomware-gang-behind-500-victims","Teen Alleged to Lead KillSec Ransomware Gang Behind 500 Victims","2026-10-01T22:20:19.419+00:00",{"slug":31,"title":32,"published_at":33},"ryuk-ransomware-operator-sentenced-lessons-for-ransomware-defense-1790245269589","Ryuk Ransomware Operator Sentenced: Lessons for Ransomware Defense","2026-09-24T10:21:09.356+00:00",{"slug":35,"title":32,"published_at":36},"ryuk-ransomware-operator-sentenced-lessons-for-ransomware-defense","2026-09-23T20:22:31.001+00:00",{"slug":38,"title":39,"published_at":40},"ryuk-ransomware-member-jailed-lessons-from-a-15m-extortion-campaign","Ryuk Ransomware Member Jailed: Lessons from a $15M Extortion Campaign","2026-09-23T10:22:49.905+00:00",{"slug":42,"title":43,"published_at":44},"ransomware-true-cost-why-bcdr-is-non-negotiable","Ransomware True Cost: Why BCDR Is Non-Negotiable","2026-09-16T16:21:08.719+00:00",{"slug":46,"title":47,"published_at":48},"msps-must-go-beyond-basic-backups-to-survive-ransomware","MSPs Must Go Beyond Basic Backups to Survive Ransomware","2026-09-02T16:22:27.372+00:00",{"slug":50,"title":51,"published_at":52},"boston-scientific-cyberattack-disrupts-global-operations-and-medical-device-activations","Boston Scientific Cyberattack Disrupts Global Operations and Medical Device Activations","2026-08-31T12:20:37.914+00:00",{"slug":54,"title":55,"published_at":56},"iran-linked-hackers-knock-uk-power-plant-offline-for-four-days","Iran-Linked Hackers Knock UK Power Plant Offline for Four Days","2026-08-24T10:20:47.083+00:00",{"slug":58,"title":59,"published_at":60},"medusa-ransomware-breaches-500-critical-infrastructure-orgs","Medusa Ransomware Breaches 500+ Critical Infrastructure Orgs","2026-08-19T10:21:32.363+00:00",{"slug":62,"title":63,"published_at":64},"deadlock-ransomware-uses-blockchain-to-evade-takedowns","DeadLock Ransomware Uses Blockchain to Evade Takedowns","2026-08-12T00:20:22.918+00:00",[66,71,76,81,86,91],{"slug":67,"name":68,"problem":69,"stories":70},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",15,{"slug":72,"name":73,"problem":74,"stories":75},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",10,{"slug":77,"name":78,"problem":79,"stories":80},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",9,{"slug":82,"name":83,"problem":84,"stories":85},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",7,{"slug":87,"name":88,"problem":89,"stories":90},"patch-management","Automated patch management","Known holes get closed in days, not months.",2,{"slug":92,"name":93,"problem":94,"stories":90},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[96,102,107,111,117,122,127,131],{"family":97,"item":98,"code":99,"title":100,"together":101},"cis","11","Control 11","Data Recovery",22,{"family":103,"item":104,"code":105,"title":105,"together":106},"itil","overview","ITIL",17,{"family":97,"item":108,"code":109,"title":110,"together":70},"13","Control 13","Network Monitoring and Defense",{"family":112,"item":113,"code":114,"title":115,"together":116},"gdpr","32","Article 32","Security of processing",14,{"family":97,"item":118,"code":119,"title":120,"together":121},"17","Control 17","Incident Response Management",13,{"family":97,"item":123,"code":124,"title":125,"together":126},"12","Control 12","Network Infrastructure Management",12,{"family":5,"item":128,"code":129,"title":130,"together":75},"rs-rp","RS.RP-1","Response Planning (CSF 1.1)",{"family":132,"item":133,"code":134,"title":135,"together":75},"nist-sp","800-61","SP 800-61","SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management"]