Does incident response include data recovery?

Partly. Recovery is a stage of the incident response lifecycle: the response team decides when to restore, from which backup, and checks that systems coming back online are clean. Restoring the data itself relies on your backups and is usually carried out by your MSP or IT team, with the response team guiding the work.

This article is part of our incident response series. For the big picture, see What is incident response?.

Where recovery fits in incident response

Reference frameworks place recovery at the end of the sequence. NIST’s incident response guidance (SP 800-61, Revision 3, April 2025) maps it to the “Recover” function of the NIST Cybersecurity Framework 2.0, after detection and response. Restoring too early, before the attacker has been understood and removed, means putting back online a system they still control.

Stage	Usually led by	Link with recovery
Containment	Response team, with the MSP	Protect backups that are still clean
Investigation	Response team (CERT)	Date the compromise, identify affected systems
Eradication	Response team and MSP	Remove the attacker’s access and tools
Recovery	MSP or internal IT, guided by the response team	Rebuild, restore, reset accounts
Heightened monitoring	SOC	Check that no malicious activity resumes

What the response team does

• Assesses backups. Attackers often try to destroy backups, as French government guidance points out. The team checks which ones are intact and which may have been touched.
• Chooses the restore point. The investigation dates the attacker’s entry. A later backup may contain a backdoor.
• Sets the order of recovery with management: business-critical services first, the rest after.
• Defines restart conditions: patches applied, passwords changed, remote access closed. See When can production restart after a cyberattack?.
• Monitors after restart, to catch any return. See How do you know the attacker is gone?.

Why restoring too fast is risky

Pressure to restart is strong: every day of downtime costs money and goodwill. Yet restoring before the root cause is closed often ends with a second compromise. If the stolen password still works, or the exploited VPN is still unpatched, the attacker can simply walk back in and encrypt the freshly restored systems. The response team’s role is to say, with evidence, when it is safe to go ahead. See How to prevent a second attack.

What the IT team does

The MSP or internal IT knows the architecture, the backup tools and the business applications. It usually rebuilds servers and endpoints from clean images, restores data, reconfigures applications and checks with users that everything works. Depending on contracts, the response provider may take on part of this work: clarify it in advance. See What does incident response cover?.

What if there is no clean backup?

This is the hardest scenario. A few options exist, with no guarantee:

• free decryption tools published by the No More Ransom project for certain ransomware families;
• partial copies: data synced to the cloud, hosted mailboxes, exports from business applications;
• rebuilding data by hand from paper records or from partners.

Paying the ransom is not a reliable fix. French government guidance advises against paying: nothing guarantees you will get your data back or that it will not be leaked, and payment encourages further attacks.

Preparing recovery before an incident

The best incident response does not replace a backup strategy. Cybermalveillance.gouv.fr recommends regular backups, offline copies and periodic restore tests. NIS2 also lists backup management and disaster recovery among the Article 21(2)(c) measures for entities in scope.

For an MSP, that means documenting each client’s backups, testing restores and agreeing who does what on the day they are needed. See Managed SOC and MSP: who does what?.

Talk to an expert

Under attack? Report an incident: Cyna’s on-call team is available 24/7. To organise recovery with your response team, your Cyna partner MSP is your first point of contact. Otherwise, get in touch.

Frequently asked questions

Can data be decrypted without paying the ransom?

Sometimes. The No More Ransom project, backed by Europol among others, publishes free decryption tools for certain ransomware families. It states clearly that there is no solution for every type of ransomware.

Should we restore the most recent backup?

Not necessarily. If the attacker was present for several days, the latest backup may contain their tools or access. The investigation helps pick a restore point from before the compromise, or clean systems before bringing them back.

Who pays for recovery?

It depends on your contracts: managed services agreement, incident response retainer, cyber insurance. Check in advance what each one covers. See What is an incident response retainer?.

How long does a full recovery take?

There is no standard duration: it depends on the scale of the attack, the volume of data and the state of your backups. See How long does incident response take?.