When can you restart production after a cyberattack?

You can restart production once four conditions are met: the attack is contained, the attacker’s entry point has been identified and closed, the systems going back into service are rebuilt or verified clean, and stepped-up monitoring is in place. It is not a date fixed in advance. It is a management decision, based on criteria the technical teams have checked.

This article is part of our series on how incident response unfolds. For the full picture, see How does incident response work?.

Why restarting too early is expensive

After a cyberattack, the pressure to get back to business is intense: orders stuck, customers waiting, staff idle. But a rushed restart carries a very real risk: bringing back systems the attacker still controls.

Advisory AA20-245A, published by the US agency CISA with its partner agencies, warns about exactly this. Remediation steps taken before the scope of the compromise is understood can tip off the attacker, who then changes tactics and keeps access. Restoring servers without closing the way in amounts to the same thing: the attacker comes back the same way, sometimes doing more damage the second time.

ANSSI, the French national cybersecurity agency, describes remediation in its guide on cyberattacks and remediation as a sequence: contain the attack, regain control of the information system, then return to a sufficient level of operation. Restarting production therefore comes after regaining control, not before.

The criteria to check before restarting

Criterion	Question to ask	Who checks it
Containment	Has the attack been stopped across the whole known scope?	Incident response team
Entry point	Do we know how the attacker got in, and is that route closed?	Investigation
Persistence	Have backdoors, created accounts and scheduled tasks been removed?	Investigation and IT team
Identities	Have exposed passwords and secrets been changed, privileged accounts first?	IT team or MSP
Clean systems	Are restarted servers rebuilt or verified, and restored backups clean?	IT team
Monitoring	Are restarted systems covered by an EDR and 24/7 monitoring?	SOC
Evidence	Has what investigators, insurers or the police may need been preserved?	Investigation
Decision	Has management approved the restart and the residual risk?	Management, crisis team

An unmet criterion does not rule out every restart, but it must be known, accepted and offset. For instance, if the entry point is not yet confirmed, a critical activity can be brought back on an isolated segment under enhanced monitoring while the investigation finishes.

For how to establish that the attacker is no longer there, see How do you know the attacker is gone?.

Restart in stages, not all at once

Most successful recoveries follow a step-by-step approach:

1. List critical activities: invoicing, production, logistics, email, depending on the business. Management sets the order of priority.
2. Rebuild the foundations: directory services, identities and admin accounts are rebuilt or cleaned first, because everything else depends on them.
3. Bring critical applications back on rebuilt or verified systems, in degraded mode if needed.
4. Widen gradually to the rest of the estate, stage by stage, checking at each step that no suspicious activity returns.
5. Lift temporary measures (blocked traffic, disabled accounts) only once lasting fixes are in place.

NIST, in Revision 3 of SP 800-61 published in April 2025, ties this phase to the Recover function of CSF 2.0: restoring assets and operations while checking their integrity, and communicating on progress. Backups are covered in Does incident response include data recovery?.

Who decides to restart?

Management makes the call, often through a crisis team. It relies on three inputs:

• The incident response team, which explains what is known about the attack and what is not yet known.
• The IT team or MSP, which says what is ready to restart and in what state.
• The business units, which say what each day of downtime costs and what can run in degraded mode.

The incident response provider informs the decision with facts, including what remains uncertain; it does not take it.

The role of the MSP and the SOC at restart

For an SME supported by an MSP, the return to service is often carried out by the MSP’s engineers: rebuilding servers, restoring data, resetting passwords. The SOC and CERT provide the investigation and monitoring that let the business restart with a known level of risk.

At Cyna, the 24/7 managed SOC is run from France by in-house teams, and the CERT, a member of InterCERT France, works with the SOC teams and can be mobilised quickly. The incident response on-call team is available 24/7 from the Report an incident page. Restarted systems can be monitored through SentinelOne or Microsoft Defender EDR and the Microsoft 365, Google Workspace, Stormshield and Fortinet connectors. The split of responsibilities is set out in Managed SOC and MSP: who does what?. To reduce the risk of a relapse, see also How to prevent a second attack.

Talk to an expert

Planning a recovery, or want to define restart criteria before an incident happens? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

Frequently asked questions

Can we restart in degraded mode before the investigation is complete?

Yes, and it is common for critical activities. Isolate that scope from the rest of the network, run it on verified or rebuilt systems and keep it under enhanced monitoring. Document the decision and have management sign it off.

Does the insurer need to approve the restart?

It depends on the policy. Some policies require evidence to be preserved or the insurer to be informed before certain actions. Check your policy terms at the start of the incident and keep your broker updated on decisions.

Do the authorities need to approve the restart?

In most cases the decision is taken within the organisation. Situations vary, though (regulated sector, ongoing investigation): if in doubt, the organisation's legal counsel is the right person to ask. Also, if you report the attack to the police, investigators may ask you to preserve certain evidence. That is why evidence should be collected before rebuilding. See How to contain without destroying evidence.