[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-184":3},{"item":4,"lessons":16,"controls":66,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-184","SP 800-184","SP 800-184: Guide for Cybersecurity Event Recovery",14,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST guidance on planning for and carrying out recovery after a cybersecurity event. It focuses on the recover function of the Cybersecurity Framework, covering planning, playbooks, metrics and continuous improvement for restoring normal operations.\n\n**In practice.** Applying it well means understanding dependencies and priorities of systems before an event, preparing recovery playbooks for likely scenarios such as ransomware or data breach, and defining how to restore from trusted sources. Communications with staff, customers and partners are part of recovery. Evidence includes recovery plans, playbooks, test results and post-event improvement records.\n\n**Common gaps.** Typical gaps are recovery plans that assume backups are clean, no prioritisation of which services to restore first and no review after real incidents. Recovery metrics are also seldom defined.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fsp800","Find it among NIST SP 800 publications","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"qilin-ransomware-core-member-arrested-after-international-extradition","Qilin Ransomware Core Member Arrested After International Extradition","2026-10-09T16:20:38.53+00:00",{"slug":23,"title":24,"published_at":25},"fraudulent-recovery-firm-exploited-ransomware-victims-for-11m","Fraudulent Recovery Firm Exploited Ransomware Victims for $11M","2026-10-08T10:20:22.998+00:00",{"slug":27,"title":28,"published_at":29},"clickfix-lure-drives-lunex-stealer-across-100-ukrainian-sites","ClickFix Lure Drives Lunex Stealer Across 100+ Ukrainian Sites","2026-10-07T10:20:38.802+00:00",{"slug":31,"title":32,"published_at":33},"ryuk-ransomware-operator-sentenced-lessons-for-ransomware-defense","Ryuk Ransomware Operator Sentenced: Lessons for Ransomware Defense","2026-09-23T20:22:31.001+00:00",{"slug":35,"title":36,"published_at":37},"ryuk-ransomware-member-jailed-lessons-from-a-15m-extortion-campaign","Ryuk Ransomware Member Jailed: Lessons from a $15M Extortion Campaign","2026-09-23T10:22:49.905+00:00",{"slug":39,"title":40,"published_at":41},"uk-cyber-attacks-surge-26-as-global-ransomware-activity-doubles","UK Cyber Attacks Surge 26% as Global Ransomware Activity Doubles","2026-08-13T12:20:50.656+00:00",{"slug":43,"title":44,"published_at":45},"deadlock-ransomware-uses-blockchain-to-evade-takedowns","DeadLock Ransomware Uses Blockchain to Evade Takedowns","2026-08-12T00:20:22.918+00:00",{"slug":47,"title":48,"published_at":49},"deadlock-ransomware-leverages-blockchain-to-evade-takedown-efforts","DeadLock Ransomware Leverages Blockchain to Evade Takedown Efforts","2026-08-11T18:21:42.392+00:00",{"slug":51,"title":52,"published_at":53},"gunra-ransomware-targets-critical-infrastructure-with-double-extortion-tactics","Gunra Ransomware Targets Critical Infrastructure with Double-Extortion Tactics","2026-08-11T12:22:35.925+00:00",{"slug":55,"title":56,"published_at":57},"deadlock-ransomware-uses-rust-and-decentralized-infrastructure-for-double-extortion","DeadLock Ransomware Uses Rust and Decentralized Infrastructure for Double Extortion","2026-08-10T18:21:59.219+00:00",{"slug":59,"title":60,"published_at":61},"ransom-cartel-creator-sentenced-raas-operations-demand-stronger-ransomware-defenses","Ransom Cartel Creator Sentenced: RaaS Operations Demand Stronger Ransomware Defenses","2026-08-06T00:21:09.139+00:00",{"slug":63,"title":64,"published_at":65},"ryuk-ransomware-operator-pleads-guilty-after-crippling-us-organizations","Ryuk Ransomware Operator Pleads Guilty After Crippling U.S. Organizations","2026-07-10T22:20:38.435+00:00",[67,72,77,82,86,91],{"slug":68,"name":69,"problem":70,"stories":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",8,{"slug":73,"name":74,"problem":75,"stories":76},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",7,{"slug":78,"name":79,"problem":80,"stories":81},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",2,{"slug":83,"name":84,"problem":85,"stories":81},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",{"slug":87,"name":88,"problem":89,"stories":90},"patch-management","Automated patch management","Known holes get closed in days, not months.",1,{"slug":92,"name":93,"problem":94,"stories":90},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[96,102,108,113,118,122,126,130],{"family":97,"item":98,"code":99,"title":100,"together":101},"cis","11","Control 11","Data Recovery",12,{"family":103,"item":104,"code":105,"title":106,"together":107},"nist-csf","rs-rp","RS.RP-1","Response Planning (CSF 1.1)",11,{"family":109,"item":110,"code":111,"title":112,"together":107},"gdpr","32","Article 32","Security of processing",{"family":5,"item":114,"code":115,"title":116,"together":117},"800-61","SP 800-61","SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management",9,{"family":97,"item":119,"code":120,"title":121,"together":117},"13","Control 13","Network Monitoring and Defense",{"family":123,"item":124,"code":125,"title":125,"together":117},"itil","overview","ITIL",{"family":109,"item":127,"code":128,"title":129,"together":71},"33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":103,"item":131,"code":132,"title":133,"together":76},"rc-rp","RC.RP-1","Recovery Planning (CSF 1.1)"]