Recovery — restoring systems you can trust

Recovery is not just restoring a system to working order — it is restoring it to a state you can trust. A system that has been compromised and then simply rebooted is not recovered; it may be running the same malware with a fresh process ID. Genuine recovery means restoring from a verified backup to a known-good configuration, confirming the system’s integrity before reconnecting it to the network, and documenting every step so there is an auditable record of what was done and by whom.

The playbooks in this phase cover the full recovery cycle — maintaining Golden Images of CBS configurations, verifying backup integrity before you need to use them, executing a controlled restoration, scrubbing for residual malware, and conducting the Post-Incident Review that turns the experience into an improvement to the vessel’s security posture. This cycle applies to every vessel that has networked systems onboard, not just those subject to IACS UR E26.

The Post-Incident Review is often treated as an administrative obligation — a box to tick after the crisis has passed. It is actually the most operationally valuable part of the recovery phase. Understanding what happened, why the detection or response fell short, and what change would prevent recurrence is how a vessel’s cyber resilience genuinely improves over time rather than remaining static between surveys.