\cleardoublepage \part{Recover} \setbookpart{Recover}

Part VII: Recover

The Recover Function restores assets and operations affected by an incident, and in many organisations it receives the least attention of all six Functions. Restore tests are expensive and disruptive, so they are run rarely, and the first realistic test of recoverability is often the incident itself. Attackers know this: destructive and extortion attacks work because the victim cannot recover quickly enough on its own.

AI changes the economics of recovery. It can map undocumented dependencies, sequence restoration by business impact, verify runbooks under human supervision and rehearse continuously in isolated ranges. Recovery then stops being a capability assumed to work and becomes one that is measured and improved like any other control, and its findings, such as missing backups and unrealistic objectives, flow back into Govern, Identify and Protect. A fast, verified recovery also takes the leverage out of extortion.

Chapter 22 makes recovery plan execution fast, verified and repeatable, from objectives as code to integrity checks before return to service (RC.RP). Chapter 23 restores AI systems and security AI to a trustworthy state, including rollback after poisoning or tampering (RC.RP). Chapter 24 makes recoverability continuously verified, with AI-assisted rehearsal and recovery communication prepared in advance (RC.RP, RC.CO).

What you will learn in this part:

• How to restore systems and AI systems to a trustworthy state and verify them
• How to make recoverability continuously verified and prepare recovery communication

Nordvik Region uses AI-assisted drills to compensate for a small team; Hansa Mutual must show supervisors in several jurisdictions that it can recover critical functions within its objectives.