CIS Controls Data Recovery Capability Group

Adversaries collect data directly from improperly secured or compromised cloud storage. When backup or recovery data is stored in cloud object storage, this safeguard requires that recovery data be protected with controls such as encryption and separation, directly reducing unauthorized access to those backup objects

Adversaries may obtain NTDS.dit from Domain Controller backups rather than directly from a live Domain Controller and extract credential material from the database. This safeguard requires recovery data to receive equivalent protections, including encryption or separation, which directly restricts unauthorized access to Domain Controller backup copies containing NTDS data

Adversaries inhibit recovery by deleting or disabling backups, snapshots, recovery catalogs, and related recovery mechanisms. This safeguard requires automated, recurring backups of in-scope enterprise assets, ensuring that recoverable copies are created on a regular basis and thereby reducing the effectiveness of attempts to eliminate available recovery data.

Disk structure wiping damages partitions, filesystems, or boot structures required to access a system. Recovery data stored on an isolated repository remains unaffected by those disk-level changes and can be used to rebuild the system.

Disk content wiping destroys data on the affected storage device. An isolated recovery repository is not dependent on that disk and preserves the data needed to restore the wiped system.

Adversaries erase disk data or structures to make systems unusable. Offline, cloud-separated, or off-site recovery copies remain outside the disk-wipe operation, directly preserving data required for restoration.

External defacement modifies public-facing web or application content. Where an isolated recovery instance contains the affected content and configuration, known-good copies can be restored and the attacker-controlled state removed.

Internal defacement changes internal application or web content visible to users. Where an isolated recovery instance preserves known-good versions of that content, the altered files or configuration can be replaced with trusted copies.

Adversaries alter operational or visible data to damage integrity. An isolated recovery copy preserves the trusted pre-defacement state, directly enabling restoration.

Recovery inhibition relies on eliminating backups, snapshots, or other recovery resources available to the victim. An isolated recovery instance remains outside the compromised recovery path, preventing the attacker from removing every usable recovery copy through the same access.

Encryption for impact depends on the attacker being able to reach and modify usable data. An isolated recovery copy that is inaccessible through the compromised production path remains unencrypted and available for restoration.

Lifecycle-triggered deletion relies on cloud policies automatically removing stored objects. Where the isolated recovery copy resides in a separate account, vault, or lifecycle boundary, those deletion rules do not affect the recovery copy.

Data destruction removes or overwrites production data to make it unrecoverable. An isolated recovery copy sits outside the same destructive access path, preserving data that can be restored after production copies are destroyed.

Stored data manipulation relies on altered data remaining authoritative or being used by downstream systems. Where the isolated recovery environment retains versioned or known-good data from before the manipulation, the modified production copy can be replaced with a trusted version.

Adversaries manipulate data to affect operations or hide activity. An isolated recovery copy remains outside the compromised production write path, preserving a trusted version that can replace manipulated data.

Adversaries destroy file-system or partition structures to make data inaccessible. Recovery copies protected independently from the affected storage remain usable, directly enabling restoration despite destruction of the disk structure.

Adversaries overwrite disk contents to eliminate stored information. Protected recovery copies remain unavailable to the local wiping operation, directly preserving recoverable versions of the destroyed data.

Adversaries wipe disks to destroy data or render systems unusable. Recovery data protected on separate storage remains outside the affected disk's destructive operation, directly preserving the data required to rebuild the system.

Adversaries modify externally visible content. Protected recovery copies preserve the legitimate content and enable replacement of the defaced version, directly reducing the duration and effectiveness of the attack

Adversaries alter internally used content or systems. Protected backup copies maintain a trusted version outside the attacker's ordinary modification path, directly enabling restoration of internally defaced data

Adversaries alter content to disrupt operations or damage integrity. Protected recovery copies preserve trusted versions that remain available for restoration, directly limiting the persistence of the defacement.

Encryption for impact depends on write access to the data the attacker wants to render unusable. Where recovery repositories are immutable, write-protected, or administered through separate credentials, ransomware cannot encrypt or overwrite the protected recovery copy.

Adversaries manipulate cloud lifecycle policies or similar automation to cause stored data to be deleted. Immutable/versioned recovery storage and restricted lifecycle-policy modification preserve prior backup objects, directly preventing automated deletion from eliminating the recovery copy.

Data destruction depends on the attacker being able to delete or overwrite stored data. Where recovery data is held on immutable storage, deletion-protected repositories, or tightly restricted backup systems, those controls can prevent destruction of the protected copy.

Stored data manipulation changes data at rest so the altered state is trusted or used operationally. Where recovery repositories enforce immutability, integrity validation, or write restrictions, unauthorized changes to the recovery copy can be blocked or detected.

Adversaries alter enterprise data to affect operations or hide activity. Integrity controls, access restrictions, and protected recovery copies preserve trusted versions that cannot be modified through ordinary production access, directly reducing the lasting effect of manipulation.

Recovery inhibition commonly relies on deleting, modifying, or disabling backup and recovery resources. Where recovery data is protected with immutability, write restrictions, separate credentials, or access isolation, those controls can prevent the compromised access path from removing or altering the recovery copy.

Adversaries alter data stored in files, databases, or other repositories. Automated backups preserve historical versions of the stored data, directly enabling recovery of the unmodified state.

Adversaries alter data to affect decisions, processes, or system outcomes. Automated backups preserve earlier trusted versions of that data, directly enabling defenders to replace manipulated information with a known-good state.

External defacement changes public-facing website or application content. Where the affected content and configuration are included in automated backups, known-good versions can be restored and the defaced state can be removed.

Internal defacement modifies organizational web, application, or other internal content. Where that content is included in automated backups, known-good versions can replace the altered resources and shorten the duration of the defacement.

Automated backups preserve trusted versions of the modified data or content, directly enabling restoration of the pre-defacement state.

Lifecycle-triggered deletion relies on cloud retention or lifecycle rules deleting stored objects. Where automated backups retain the same data outside the affected lifecycle policy or account, those copies survive the deletion and can be restored.

Disk structure wiping corrupts partitions, filesystems, or other structures needed to access stored data. Automated backups preserve recoverable copies independent of the damaged disk structure, directly supporting restoration.

Disk content wiping destroys the data stored on an affected device. Automated backups preserve prior copies of the overwritten data, directly enabling restoration.

Adversaries erase disk data or structures to render systems unusable. Automated backups preserve data outside the destroyed disk state, directly enabling restoration after the wipe.

Ransomware and similar impact activity encrypt accessible production data to deny legitimate use. Automated backups preserve recoverable copies from before encryption, directly reducing the attacker's ability to make the encrypted data permanently unavailable.

Adversaries destroy data to impair operations or deny access to information. Automated backups preserve earlier copies of the affected data, directly enabling restoration and reducing the operational effectiveness of the destruction.