Definition
Recovery is the process of restoring systems, services and an organisation's operating capabilities to an acceptable level after a Security Incident.
Human Explanation
After an Incident has been contained, the organisation restores the normal operation of systems and services.
Why it Matters
Effective Recovery reduces Downtime and minimises the effect of an Incident on organisational activity.
Conceptual Boundary
Recovery is not limited to restoring data from a Backup. It also covers rebuilding services, configurations and processes and verifying that the environment operates securely again.
Practical Perspective
Returning to operation should be planned as carefully as the response to the Incident itself.