Summary
- The NCSC divides recovery into immediate response, a recovery programme, and longer-term organisational rebuilding.
- Minimum viable operations provide a controlled state in which essential services can run while parts of the environment remain untrusted.
- Recovery plans need to cover identity, data integrity, suppliers, workforce capacity, regulation, communications, and technical restoration.
New guidance from the UK’s cyber agency places minimum viable operations at the centre of recovery from a highly disruptive attack, requiring organisations to restore safe and supportable services before attempting a full return to normal.
The National Cyber Security Centre published the guidance on 28 July as a three-part framework covering immediate activity, recovery and continuing investigation, and longer-term rebuilding. Its recovery collection combines technical restoration with governance, communications, legal obligations, evidence, and workforce support.
During the first hours, organisations are expected to contain the incident, assess damage, establish decision-making structures, and create reliable lines of communication. The information gathered during that period feeds into a recovery programme that may continue for weeks while investigators establish the attacker’s access and the organisation restores essential capability.
The NCSC describes minimum viable operations as the point at which the organisation can deliver the services needed to operate safely and meet its obligations. Individual applications may be available before that threshold is reached, particularly where identity services, business data, integrations, or supplier connections remain unreliable.
A manufacturer may restore production software while lacking confidence in engineering workstations or remote support. A hospital may recover clinical applications while communications and administrative systems remain unavailable. A bank may bring customer services back online before every control, reporting process, and reconciliation function is ready.
Recovery decisions consequently require operational, legal, regulatory, financial, and technical authority. Security teams may need to keep systems isolated, while service owners decide which functions can resume and what temporary constraints are acceptable.
Restoring services without restoring attacker access
Pressure to resume normal operations can lead to systems being reconnected before the organisation understands how the attacker entered, which credentials were used, or where persistence remains. Backups may contain clean business data while the identity environment, management tools, or deployment processes used to restore them are still compromised.
Minimum viable operations create an intermediate state in which essential services run through restricted functionality, temporary processes, or segregated infrastructure. Investigation and rebuilding can continue without forcing the organisation back into an environment whose trust has not been established.
That state cannot be designed during the crisis alone. Organisations need a prior understanding of their critical services, technical dependencies, staffing requirements, suppliers, facilities, and acceptable periods of degradation. They also need to know which controls can be suspended temporarily and which are required for safety, legality, or data integrity.
Application inventories often omit the identity provider, certificate authority, network service, cloud-management account, communications platform, or external data feed on which the application relies. Recovery exercises should expose these dependencies and test whether alternative arrangements can support essential operations.
Regulatory duties continue during disruption. Reporting deadlines, evidence preservation, customer communications, safety records, and sector continuity requirements may remain in force even when the organisation is operating manually or through replacement systems.
Workforce capacity also limits recovery. Technical specialists may be working continuously while other employees adapt to unfamiliar manual processes. Fatigue, unclear authority, and repeated changes to priorities can introduce new errors into systems that are already unstable.
The rebuilding phase brings substantial procurement and governance activity. Emergency suppliers may be appointed, architecture may change quickly, and temporary controls can remain in place long after the immediate crisis. Recovery records should preserve the reasoning behind major decisions and identify which arrangements require later review.
A service marked online is not necessarily recovered. Confidence in identity, data integrity, administrative access, supplier readiness, staff capacity, and continued attacker exclusion must accompany technical availability.
The NCSC framework provides a structure for maintaining that distinction throughout a prolonged incident. Recovery begins while investigation is incomplete and ends only when essential operations can be sustained without depending on compromised systems, uncontrolled workarounds, or exhausted staff.
