Recover

Recover is the stage where an organisation puts its disaster recovery plan into action after an attack. The plan is prepared in advance. It sets out who is responsible for each task, the expected timeline for getting things working again and the remedial action required.

Recover covers restoring systems and data, then taking remedial action so the organisation can return to normal operation. A worked example: a small chain of climbing centres finds that its online booking system has been tampered with and some bookings are missing. Its disaster recovery plan names the IT coordinator as the person who restores the booking system and its data from the backup taken at 2am. It gives a five-hour target for the booking system to be available again. The centre manager checks the day's bookings against the restored records, and the finance officer checks payments. These jobs, and their deadlines, come from the plan rather than being invented during the incident.

Recover does not stop at getting back to normal. It also includes longer-term remedial action to reduce the risk of a similar attack happening again. For the climbing centres, that could mean setting the booking system to email the duty manager whenever a booking is edited outside normal opening hours, and adding an audit trail that shows which staff account made each change. Without these changes, restoring the backup would not stop the same problem from happening again.

Recover has a practical advantage: normal work can continue while repairs and security improvements are carried out. The climbing centres can take bookings by phone and at reception while the online system is restored, and the improvements make another long disruption less likely. Recover is therefore more than switching systems back on: it restores service and makes the organisation safer for the future.