Topics in this domain
- Event vs Incident vs Breach
- Developing the Incident Response Plan
- Incident Response Team Roles and Authority
- Incident Classification and Severity Levels
- Incident Response Playbooks and Decision Trees
- Escalation and Communication Plans
- Business Impact Analysis
- RTO, RPO, MTD and Recovery Prioritisation
- Business Continuity Planning and Strategies
- Crisis Management and Continuity Governance
- Disaster Recovery Planning
- Recovery Sites: Hot, Warm and Cold
- Backup Strategies and Cloud DR
- Incident Response Training
- Testing Plans: Tabletop, Functional and Full Interruption
- Evaluating Exercises and Improving Readiness
- Security Event Detection and Monitoring Methods
- SIEM, the SOC and Event Correlation
- Threat Intelligence and Indicators of Compromise
- Incident Triage and Initial Investigation
- Evidence Preservation, Forensics and Chain of Custody
- Containment Strategies: Short-Term and Long-Term
- Making Containment Decisions
- Breach Notification and Regulatory Reporting
- External Communications: Customers, Media and Law Enforcement
- Eradication, Recovery and Return to Normal Operations
- Post-Incident Review and Root Cause Analysis
- Lessons Learned and Incident Trend Analysis
Eradication, Recovery and Return to Normal Operations
Clean before you restore
After containment, two jobs remain: getting the attacker completely out (eradication) and getting the business back (recovery). Doing them in the wrong order, or skipping parts of either, is how organisations end up suffering the same incident twice. “Incident eradication and recovery” is a named CISM topic.
From eradication to normal
- Eradicate: remove malware, backdoors, attacker-created accounts and persistence mechanisms.
- Close the entry point: patch, fix the misconfiguration, enforce MFA.
- Rotate credentials: passwords, keys, tokens, sessions and MFA registrations the attacker may hold.
- Restore and validate: from clean backups, or rebuild from known-good images; test before go-live.
- Monitor and close: heightened monitoring; the business owner confirms normal operation.
Validating before go-live
- Clean: scans and checks find no attacker tools or indicators of compromise.
- Patched and hardened: the entry point is closed and the baseline applied.
- Data intact: restored data is reconciled to the RPO and its integrity checked.
- Business tested: owners confirm the service works for real users.
Returning to normal
- Restore in BIA priority order, dependencies first.
- Stand down manual workarounds in a controlled way.
- Reconcile transactions processed during the outage.
- Keep heightened monitoring for weeks; attackers often try to return.
- Get owner sign-off before closing the incident.
Example. After a business email compromise, the team removes the attacker’s forwarding rules and resets the CFO’s password, but forgets the attacker’s registered MFA device. Two weeks later the account is taken again. The recovery checklist now includes revoking sessions, tokens and MFA registrations.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| What must happen before restoring systems | Eradicate the threat and close the entry point |
| A common recovery failure | Not rotating compromised credentials |
| How to restore compromised systems | Clean backups, or a rebuild from known-good images |
| After recovery | Heightened monitoring for the attacker’s return |
| Who confirms the return to normal? | The business owner |
In short
- Incident eradication and recovery is a named CISM topic: remove the cause, restore services, confirm they're clean, return to normal.
- Eradication removes malware, backdoors, attacker accounts and persistence, and closes the original entry point.
- Credentials, keys and tokens the attacker may hold are rotated; otherwise they simply log back in.
- Recovery uses clean backups or rebuilds from known-good images, validated before returning to production.
- Heightened monitoring continues after recovery, because attackers often try to return.
- The business owner confirms normal operations before the incident is closed; recovery follows BIA priorities.
Exam traps
- Restoring before eradicating invites reinfection.
- Fixing the symptom (the malware) without closing the entry point lets the attacker back in.
- Forgetting to rotate credentials is one of the most common recovery failures.
- IT declaring 'fixed' isn't enough; validation and owner sign-off are needed.
Slides
Click the slide and use the arrow keys. F toggles full screen.
From eradication to normal
1 / 8