GCRI · Cybersecurity and Digital Resilience
Incident response recovery
When prevention fails, the speed and quality of response decide the damage: detecting the intrusion, containing it, restoring systems from clean backups, communicating honestly and learning. Ransomware has made recovery capability central, because attackers target backups and threaten to publish data. This page sets out how incidents unfold and how organisations recover, how response is measured, and what evidence serves those who plan for it.
How the work runs.
Incident response timeline
Incident response recovery · Critical service A · Incident IR-3812
CSF 2.0 functions
- GovernGV
- IdentifyID
- ProtectPR
- DetectDE
- RespondRS
- RecoverRC
Timeline
- T+00:00DE.AEAnomalous logins flagged on identity platform
- T+00:30RS.MAIncident declared, commander assigned
- T+01:30RS.ANScope: 6 hosts, one service account
- T+02:16RS.MIAccount disabled, hosts isolated
- T+04:00RS.CORegulator notification window opens
Affected assets
| IDP-01 | Identity | Compromised | Identity platform |
| APP-07 | Payments API | Isolated | Service owner |
| DB-02 | Customer data | Forensics | Data owner |
| BK-01 | Backups | Clean | Operations |
Response actions
- RS.MIRotate keys for affected service accountsIdentity team28 min
- RC.RPRestore APP-07 from clean backupAfter containment6 h
- RS.CODraft customer noticeLegal review7 h
Fig.Incident response timeline: example names and illustrative values, not a record or a live system.
Incident response recovery: how the risk develops.
Detection, containment, restoration and evidence. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Dwell time sets the damage
The longer attackers stay undetected, the more systems they reach and data they take. Detection and logging decide how early response can begin.
Ransomware targets recovery
Attackers delete or encrypt backups and steal data before encrypting systems, so organisations face both outage and extortion.
Rebuilding needs trusted foundations
Recovery must restore identity systems and infrastructure first and confirm they are clean. Restoring quickly from compromised systems invites reinfection.
Communication shapes trust
Customers, staff, regulators and the public need timely, accurate information. Delay and spin damage trust and may breach notification rules.
Hazards now in Europe.
Population density, flood water, active fires and true-colour imagery over Europe, from NASA GIBS. Each layer carries its own date.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 4
Hazards now, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
Hazards now, framed on Europe.Satellite and model products as NASA publishes them, each with its own date. They are indicators, not assessments of any place.
Data: NASA GIBS · ASTER GDEM · Blue Marble · © OpenStreetMap contributors · Natural Earth · NASA EONET · U.S. Geological Survey · NASA HLS S30Sources and licences
- We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- Center for International Earth Science Information Network (CIESIN), Columbia University. 2018. Gridded Population of the World, Version 4 (GPWv4): Population Density, Revision 11. NASA Socioeconomic Data and Applications Center (SEDAC). Licensed under CC BY 4.0. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). doi:10.7927/H49C6VHW. CC BY 4.0
- VIIRS near-real-time products (flood, land surface temperature, snow cover, corrected reflectance), NASA LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- NASA Fire Information for Resource Management System (FIRMS), VIIRS 375 m active fire product, NASA LANCE; vector tiles via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- VIIRS Black Marble night-time lights, NASA Goddard Space Flight Center; distributed by the NASA Level-1 and Atmosphere Archive and Distribution System (LAADS DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- MODIS land products (vegetation indices, gross primary production, land cover), NASA LP DAAC and LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- ASTER GDEM is a product of METI and NASA (ASTER Global Digital Elevation Model V003, NASA LP DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). Cite as: NASA/METI/AIST/Japan Spacesystems and U.S./Japan ASTER Science Team (2019). ASTER Global Digital Elevation Model V003. doi:10.5067/ASTER/ASTGTM.003. NASA open data
- Made with Natural Earth. Free vector and raster map data @ naturalearthdata.com. Public domain
- © OpenStreetMap contributors (ODbL), via NASA GIBS (coastlines, boundaries, roads and place names). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). ODbL
- Blue Marble, NASA Earth Observatory; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- Context on the globe and flat map: coastlines, boundaries, roads and place names from NASA GIBS reference layers (OpenStreetMap data, ODbL, © OpenStreetMap contributors); Blue Marble imagery as an optional base; 3D terrain and the elevation read-out from the ASTER GDEM elevation colour index (5 m to 200 m classes, exaggerated for legibility). Boundaries are drawn as published and imply no position on any territory.
- Live events: NASA Earth Observatory Natural Event Tracker (EONET); events are indicative and keep their original source links.
- Live: NASA EONET Events are indicative, not authority warnings.
- Live: U.S. Geological Survey Events are indicative, not authority warnings.
- Observed (EO): NASA HLS S30 (contains modified Copernicus Sentinel data 2026). We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS).
- NASA GIBS: We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS).
- River discharge forecast, 30 days with range (GloFAS via Open-Meteo): Contains modified Copernicus Emergency Management Service information 2026; not a flood warning.
- Weather data by Open-Meteo.com (https://open-meteo.com/), licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
- Optional layers (20 sources in the layer list: live, forecast, observed and context) print their provider credit on the map and here when switched on; forecasts are model output and derived indices are estimates.
Layers and dates
- Population density, 2020: Population: CIESIN, Columbia University, Gridded Population of the World v4.11 (2018), NASA SEDAC, CC BY 4.0 · static
- Flood water, 3-day composite: VIIRS Global Flood Product, NASA LANCE · 14 Oct 2026
- Active fires and thermal anomalies: VIIRS NOAA-20 375 m (FIRMS), NASA LANCE FIRMS · 13 Oct 2026
- True colour: VIIRS NOAA-20 corrected reflectance, NASA LANCE · 13 Oct 2026
- Night-time lights, daily: VIIRS Black Marble (VNP46A2), NASA LAADS DAAC · 12 Oct 2026
- Land cover type (IGBP), yearly: MODIS Terra and Aqua land cover (MCD12Q1), NASA LP DAAC · 2024
Incident recovery restores services that every domain needs.
- HealthCouplingHospitals run on paper while systems recover.What to watchRecovery time for clinical systems
- WaterCouplingUtilities may run manually after an attack.What to watchManual operation readiness
- EnergyCouplingGrid recovery after cyber incidents follows restoration plans.What to watchRecovery exercises
Recovery evidence is designed for the Global Sector Risk and Resilience series. NIST SP 800-61 revision 3 (2025) aligns incident response with CSF 2.0; the Global Centre for Risk and Innovation (GCRI) responds to no incidents.
- Post-incident reviews organisations publish.
- Exercise results.
Hazard to loss: the exceedance curve.
How often a given loss is exceeded, from a Gumbel hazard, a lognormal fragility and a protection standard; the area under the curve is the average annual loss. Teaching model with stated illustrative values, not a prediction. The map on this page shows Europe; the model itself is not tied to a place.
Controls
- Typical annual hazard intensity (location)
- 1.00 intensity index
- Spread of extremes (scale)
- 0.80 intensity index
- Intensity at which half the value is lost
- 4.00 intensity index
- Dispersion of vulnerability
- 0.55
- Share of value in the hazard footprint
- 40%
- Protection standard (return period)
- 50 years
Readouts
- Average annual loss
- 0.51% of value
- Loss at 1 in 100 years
- 24.5% of value
- Loss at 1 in 250 years
- 28.4% of value
- Intensity at 1 in 100 years
- 4.68 intensity index
Numbers, methods and sources
| Return period (years) | Intensity (intensity index) | Loss (% of value) |
|---|---|---|
| 1 | 0.09 | 0.00 |
| 2 | 1.27 | 0.00 |
| 4 | 1.91 | 0.00 |
| 7 | 2.47 | 0.00 |
| 13 | 3.00 | 0.00 |
| 24 | 3.51 | 0.00 |
| 44 | 4.02 | 0.00 |
| 82 | 4.53 | 23.55 |
| 154 | 5.03 | 26.44 |
| 287 | 5.53 | 28.87 |
| 536 | 6.03 | 30.88 |
| 1,000 | 6.53 | 32.53 |
Methods
- Gumbel extreme-value hazard Gumbel (1958), Statistics of Extremes, Columbia University Press
- Lognormal fragility (vulnerability) FEMA (2003), HAZUS-MH Technical Manual
- Exceedance-probability curve and average annual loss Grossi and Kunreuther (2005), Catastrophe Modeling, Springer
- Levee effect Di Baldassarre and others (2013), Socio-hydrology, HESS 17
- Uncertainty fan (parameter Monte Carlo) Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
- One-at-a-time sensitivity (tornado) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
Data
The model runs on the teaching values set by the controls. To calibrate it for a place, read it against these admitted layers and series, which this page's map can draw:
- Rivers Natural Earth
- Urban extents Natural Earth
- Cities Natural Earth
- Earthquakes M4.5+, past week (USGS) U.S. Geological Survey · register usgs.earthquake.summary-feeds
- Rain rate, last half hour (IMERG) NASA GPM IMERG Early · register nasa.gibs.context-live-layers
- River discharge forecast, 30 days with range (GloFAS via Open-Meteo) Open-Meteo.com (CC BY 4.0), Copernicus GloFAS · register open-meteo.public-pages
- Built-up and settlement extent, 2010 (HBASE, Landsat) CIESIN/Columbia, NASA SEDAC HBASE · register sedac.context-urban-layers
Across the six pillars, led by Nexus Consortium
- Experiments Labs
- Built in Cybersecurity and Digital Resilience in Foundry
- Tested at Cybersecurity and Digital Resilience in Universe
- Codified in Digital, Cyber and AI in Standards
- Published in Cybersecurity and Digital Resilience in Reports
- Taught in Faculty of Technology and Digital Systems in Academy
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Median dwell time | days from intrusion to detection | annual | Incident response industry reports | ESTIMATED |
| Mean time to restore critical services | hours | per incident | Incident records | OBSERVED |
| Backups tested for restoration | percent of critical systems | quarterly | Backup test records | OBSERVED |
| Immutable or offline backups | percent of critical data | per assessment | Backup architecture records | DECLARED |
| Incidents reported to national authorities | count by type | annual | National CSIRT statistics | Published statistics |
| Incident response exercises held | count | annual | Exercise records | REPORTED |
Model incident response recovery as a system. Run the cascade.
Assembled from the Nexus Standards area profile Cyber and digital resilience law alignment: the hazards it names, the systems and sectors that carry the loss, the controls that dampen it and the data that observe it. Choose the components, pick an initiating hazard and step through the cascade. The Map view places the run on an example geography with open data. Every coupling weight is a stated assumption you can change. A teaching model, not a forecast, an assessment or a certification. To model a place of your own choosing, open the full System Builder.
Hazards
- Dam failure
- Sea-ice loss
- Coastal erosion (set off downstream)
- River flood (set off downstream)
- Flash flood (set off downstream)
- Mass displacement (set off downstream)
- Biodiversity loss (set off downstream)
- Widespread power outage (set off downstream)
- Water supply shortfall (set off downstream)
- Arctic winter sea-ice collapse (set off downstream)
- Polar vortex disruption (set off downstream)
Systems and couplings
Controls
NS-10Policies and clauses (machine-readable obligations: definition, binding, evaluation and enforcement)NS-11Verification and monitoring (evidence, attestations, zero-trust conformance observation)NS-9Contextual UNIs (deployments, instances, programme instances)NRS-X6Cyber and digital security riskNRS-H93Hazard family: Identity, trust and cryptographic failure (NHS-1 cyber.identity)NRS-K31Domain pack profile: Cyber national resilience (DOMAIN-031)NRS-H54Hazard family: Signal and platform disruption (NHS-1 cyber.platform)NRS-H86Hazard family: Telecom and data-centre failure (NHS-1 infra.digital)NRS-H94Hazard family: Systemic cyber events (NHS-1 cyber.systemic-cyber)
Observation
- NIST National Vulnerability Database APIs (listed for reference)
- CISA Known Exploited Vulnerabilities catalogue (listed for reference)
- EUR-Lex Cellar (EU legal acts and delegated acts) (listed for reference)
- Cybersecurity Supply Chain Risk Management
- Legal measures pillar of the Global Cybersecurity Index
Example geography
- North America: 243 hexagonal cells
- Night lights tonight, outages (VIIRS Day/Night Band), NASA GIBS
- Surface water through cloud, 30 m (OPERA DSWx-S1 radar), NASA GIBS
- Rain rate, last half hour (IMERG), NASA GIBS
- Vegetation disturbance alerts, 30 m (OPERA DIST-ALERT), NASA GIBS
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| NIST SP 800-61 incident handling guidance | Incident response life cycle and practices | Public domain, US government |
| National CSIRT and agency annual reports | Incident statistics and trends | Public, terms per agency |
| No More Ransom project | Decryption tools and ransomware guidance from law enforcement and industry | Public, project terms |
| Incident response industry reports such as Mandiant M-Trends | Dwell time and intrusion patterns | Public reports, terms per publisher |
| Published post-incident reviews | Lessons from major incidents | Public records, terms per publisher |
How incident response recovery is modelled, measured and tested.
The model, its assumptions, its data and its uncertainty, in the form a scientist or engineer would check. Structures follow published methods. The values drawn are illustrative, not findings.
System model
The couplings between the systems in incident response recovery: signs of influence, a reinforcing and a balancing loop, and cross-links where stress jumps.
Who decides, and what the evidence serves.
Cybersecurity and Digital Resilience prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Organisations and their executives | How to prepare to respond and recover, and how much to invest in backups | Plan reviews; backup assessments |
| National CSIRTs and cyber agencies | How to support victims and coordinate response | Incident statistics |
| Regulators | What incident reporting and resilience testing to require | Incident and exercise evidence |
Outputs this topic produces
- Incident response plan reviews
- Recovery exercise designs for ransomware scenarios
- Backup resilience assessments
- Post-incident review templates
What experts ask.
No defence is perfect, so every organisation that depends on digital systems will eventually face an incident. Those that recover well have prepared: they know their critical systems, have tested backups, have clear roles and decision rights, and have rehearsed under realistic conditions. Those that recover poorly often discover during the incident that backups were reachable by the attacker, that no one knew who could authorise shutdown or that critical suppliers had no plan.
- How quickly can an organisation detect an intrusion or failure, and what signals does it depend on?
- Who decides on containment measures that disrupt services, such as disconnecting systems, and on what information?
- Can critical services be restored from clean, isolated backups, and how long would that take?
- How is evidence preserved for investigation and legal processes without delaying recovery?
Drivers and processes.
Response depends on preparation, decision-making and technical capability.
Seeing the incident
Monitoring, logging and alerting determine how long attackers remain undetected. Many incidents are first noticed by outside parties.
Containment and communication
Isolating systems limits spread but stops services. Clear authority and pre-agreed criteria speed these decisions.
Restoring trust
Rebuilding from known-good states, verifying integrity and restoring in priority order. Recovery takes longer than most plans assume.
Recovery is often the longest and least planned phase. After a destructive attack, organisations may need to rebuild identity systems, reinstall servers, verify that attackers have been removed and restore data in an order that brings the most critical services back first. Planning for this in advance, including manual workarounds for essential functions, shortens disruption more than almost any other measure.
How the evidence is built, and its limits.
- 01
Playbooks
Documented procedures for common incident types. They help only if kept current and rehearsed.
- 02
Exercises
Tabletop and technical exercises test plans and decision-making. Realism and honest after-action review determine their value.
- 03
Digital forensics
Methods for collecting and analysing evidence. Forensic integrity can conflict with speed of recovery, and the trade-off should be agreed in advance.
- 04
Post-incident review
Structured review of what happened and why. Public reviews are rare; most learning stays within organisations.
How it is studied, and what the methods cannot say.
- 01Cybersecurity and cryptographyControl baselines and gap analysis · Exploited vulnerability prioritisationApplied here
- 02Reliability and resilience engineeringRecovery architecture · Degraded operation modes · Recovery time testingApplied here
- 03Software and safety-critical systems engineeringSecure development life cycle · Safety and security co-assuranceApplied here
- 04Communications and network technologyNetwork segmentation design · Protocol security review · Post-quantum protocol readinessApplied here
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Questions and answers.
What is dwell time?
What is an immutable backup?
Should organisations pay ransoms?
Can the platform help during an incident?
Why do backups sometimes fail in ransomware attacks?
What makes an exercise useful?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.