When should recovery begin after containment?¶

Begin recovery when the immediate threat is sufficiently controlled, proportionate evidence has been preserved and the organisation has an authorised, testable restoration plan.

Confirm readiness rather than relying on quiet alerts¶

Verify the containment objective and identify identities, devices, services and access routes that remain at risk. Preserve affected systems, logs, sessions, malware indicators, audit trails and responder actions before rebuilding or reconnecting. Complete urgent provider preservation and organisational holds where required.

Define what must be cleaned, rebuilt, reset, replaced or monitored. Backups, software, credentials and configuration should come from trusted and validated sources; age alone does not show a backup predates compromise.

Restore in controlled stages¶

Record the plan, authority, sequence, dependencies, validation criteria and rollback options. Bring critical services online in an order that supports monitoring for renewed access, alerts and unusual activity. Record each reconnection, configuration and test separately from the original incident evidence.

Uncertainty about persistence, identity systems or administrative control warrants specialist advice before wider restoration. Functioning services show availability, not necessarily secure recovery; completion requires the defined security and operational criteria to be met.