Recovery Execution & Verification
This guide covers the operational execution of CBS recovery within defined RTO and RPO targets — from incident declaration through manual fallback activation, controlled restoration using Golden Images, system verification before re-activation, and survey-ready logging. Prerequisites: RTO and RPO values must already be established in your CBS Recovery Register (see Identify → RTO & RPO Determination).
When a cyber incident compromises a CBS, the clock starts immediately. This guide gives the ETO and Chief Engineer the step-by-step execution sequence to restore systems within their defined RTOs, verify integrity before returning to service, and produce the documented evidence a Class surveyor will require. The methodology behind your RTO/RPO values is covered in the Identify Playbook → RTO & RPO Determination.
Safety First — Navigation and Propulsion Take Priority
E26 §4.5.1.3 is explicit: the operation and navigation of the ship shall be prioritized. Category III systems — ECDIS, Main Engine Control, PMS, Steering — must be recovered or their manual fallbacks activated before any Category II restoration work begins. Never delay manual fallback activation to attempt a digital recovery.
Recovery Decision Flow
The first two minutes of a cyber incident determine whether recovery stays within RTO. The Master, ETO and Chief Engineer must know this decision flow by drill — not by reading it for the first time during an actual event.
The seven-step sequence is designed to be read once and then executed from memory — not consulted mid-incident. The colour coding follows the emotional arc of an incident response: red for the high-stress declaration phase, moving through amber assessment, purple isolation, navy fallback, and finally teal and green for the controlled restore and verification phases.
Step 4 — fallback activation — is full-width in the diagram deliberately. It is the step most crews skip in the rush to attempt digital recovery, and it is the step that causes the most harm when skipped. Activating manual fallback for Category III systems before attempting any CBS restoration buys time, maintains vessel safety, and prevents a recovery attempt from making the situation worse.
Step 7 — the log entry — is the step that determines whether the incident response was recoverable from a Class survey perspective. An incident that was perfectly executed but not documented is indistinguishable from an incident that was not handled at all.
<< Click the diagram to expand at full resolution
Incident → Recovery Decision Tree
DECLARE — Confirm cyber incident, notify Master and DPA
Master activates the Cyber Incident Response Plan. DPA notified ashore. Class notification initiated per SCSRP Section 6.1.4. Clock starts — RTO countdown begins.
ASSESS — Identify affected CBS and operational state of vessel
What systems are compromised? What is the vessel’s current operational state — open ocean, coastal, port approach, alongside? Operational state determines which RTOs are active. Refer to your CBS Recovery Register.
ISOLATE — Contain the incident before it spreads
Activate network isolation procedures per SCSRP Section 6.3. Disconnect affected CBS from ship network. Prevent lateral movement to unaffected systems. Do not attempt recovery on a live network.
FALLBACK — Activate manual operation for Category III systems immediately
Do not wait for digital recovery before activating manual fallback. Transfer ECDIS navigation to paper charts. Transfer propulsion to local control stand. Transfer power management to manual breaker operations. Fallback endurance clock starts — refer to SCSRP Section 6.2.
RESTORE — Execute controlled recovery using Golden Image
Retrieve offline Gold Copy media from secure storage. Execute nuke-and-pave procedure per Recover → Golden Image Management. Verify Gold Copy hash before applying. Document Gold Copy ID and restoration start time in Cyber Security Journal.
VERIFY — Integrity check before returning to service
Complete full verification checklist before reconnecting to ship network. Refer to Recover → Integrity Verification (Pillar B). No CBS returns to active service until verification is signed off by ETO and Chief Engineer.
LOG — Record all actions for survey evidence
Complete the Cyber Security Journal entry with full timeline, CBS affected, Gold Copy ID used, verification outcome, and restoration time. This record is the primary survey evidence for Class at the next annual or special survey.
RTO Execution — At Sea vs. In Port
Your CBS Recovery Register defines two RTO values per system — one for sea state, one for port. The execution sequence differs because the constraints differ. The table below gives the operational guidance for each context.
Pre-Reconnection Verification Checklist
No CBS returns to the ship network until this checklist is complete and signed off. This is the bridge between Pillar A (Backup & Restore) and Pillar B (Forensic Clean-Up). Connecting a restored but unverified system to the ship network risks reintroducing the incident.
Cyber Security Journal — Required Log Entry
Every CBS recovery event must be recorded in the Cyber Security Journal. This record is the primary evidence a Class surveyor will request at the next annual or special survey. Incomplete or absent records are treated as non-compliance with E26 §4.5.1.4.4.
Cyber Security Journal — Recovery Event Record
What a Surveyor Will Ask at Annual Survey
These are the evidence questions a Class surveyor will ask specifically about recovery execution — distinct from the methodology questions covered in the Identify article. Having the Cyber Security Journal entries and test records available closes every one of these.
Annual Restoration Test — Drill Requirement
E26 §4.5.2.4.4 requires that backup media integrity is verified periodically. In practice this means an annual restoration test on spare hardware or a virtual machine — a non-destructive exercise that proves the Gold Copy actually works before you need it during an incident.
Frequency
Minimum annually. Recommend after each Gold Copy refresh to confirm the new image is restorable before retiring the old one.
Method
Restore to spare hardware or VM. Verify OS boots, applications load, and configuration matches the documented baseline. Do not restore to a live CBS during testing.
Record
Log in Cyber Security Journal: date, Gold Copy ID and hash used, system tested, elapsed time, result (pass/fail), and ETO sign-off. Retain onboard for Class inspection.
Critical ETO Warning — Do Not Skip Integrity Verification
Restoring a Golden Image removes the malware payload but does not guarantee the incident vector is closed. If the CBS is reconnected to the ship network before verification steps V1–V7 are complete and the network isolation root cause is identified, you risk reinfection within minutes. A fast recovery that skips verification is not a recovery — it is a reinfection waiting to happen.
The specific regulatory requirements this playbook satisfies. Use these references when preparing for Class survey or responding to a surveyor's checklist.
