Cyber Resilience

← ISO 27001 Annex A

A.8.13 Technological

Information backup

AttributesCorrective I·A Recover Continuity Protection

Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?

The implementation guidance for this control is published in ISO/IEC 27002:2022 and is not reproduced here. The structured attributes and the cross-walk rationales below are derived facts and our own AI-authored analysis.

Mapped NIST 800-53 r5 controls (18)

Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

CP-10←M →M CP-2←M →P CP-4←M CP-6←M CP-9←F →M SI-12←P

Why these map — AI rationale (under review)

CP-10mostlyaligns with — Both controls emphasize testing restoration procedures and verifying that backups can actually be used to reconstitute systems within required recovery timeframes.
CP-10mostlycovers — A.8.13's backup requirement and practices account for the bulk of the recovery/reconstitution capability demanded by CP-10, but a real residual remains (reconstitution procedures, known-good state definitions, and non-backup recovery mechanisms sit outside the backup control).
CP-9mostlyaligns with — Both controls require organizations to establish and execute systematic backup processes that ensure essential data and software can be recovered after incidents or failures.
CP-9mostlycovers — A.8.13's backup objective and measures account for the core conduct-and-protect requirements of CP-9, but leave a residual on explicit frequency parameters, testing, and storage-location controls that sit outside its text.
AU-11partialaligns with — Both controls address determining and enforcing retention periods for critical information, including the secure disposal of backup media once retention requirements expire.
CP-2partialaligns with — The ISO control's requirement to align backup scope, frequency, and retention with business continuity objectives directly supports the contingency planning process.
CP-4partialaligns with — Both controls require periodic testing of backup and recovery capabilities to confirm they satisfy incident response and business continuity objectives.
SC-28partialaligns with — The ISO control's guidance to encrypt backups when confidentiality risks are identified complements the NIST requirement to protect information at rest.
AU-11covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
CP-4covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
SC-28covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Aligned NIST CSF 2.0 outcomes (20)

NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

PR.DS-11←F →F GV.PO-01gov ID.IM-04gov ID.RA-04gov PR.DS-01gov PR.IR-03gov PR.PS-04gov

Why these map — AI rationale (under review)

PR.DS-11fullcovers — The ISO control's comprehensive requirements for creating, protecting, testing, and maintaining backups directly implement the CSF outcome of ensuring data backups exist and remain reliable for recovery.
ID.RA-04mostlyaligns with — Backup planning that incorporates recovery point objectives, criticality, and business continuity needs aligns with the CSF outcome of identifying potential impacts and likelihoods to inform risk response.
PR.IR-03mostlyaligns with — The control's emphasis on tested restoration procedures and meeting business continuity recovery time objectives aligns with the CSF outcome of implementing mechanisms to achieve resilience in adverse situations.
GV.PO-01partialaligns with — Establishing a topic-specific backup policy based on organizational data retention and security requirements aligns with the CSF outcome of creating policy grounded in organizational context and strategy.
ID.IM-04partialaligns with — Regular testing of backup and restoration procedures against incident response and business continuity plans aligns with the CSF outcome of maintaining and updating such plans based on operational execution.
PR.PS-04partialaligns with — Operational monitoring of backup execution and addressing failures aligns with the CSF outcome of generating log records to support continuous monitoring of security-relevant activities.
GV.PO-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
ID.IM-04implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
ID.RA-04implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PR.IR-03implements — A.8.13's backup mechanisms directly operationalize the resilience mechanisms required by PR.IR-03 within its domain (recovery from loss of data/systems is a core resilience technique), though the CSF outcome does not name backup explicitly.
PR.PS-04implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Related OWASP ASVS 5.0 requirements (6)

Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

V13.1.4→P V13.3.4→P V14.2.4←P V14.2.7←P →P V16.2.3→P

Why these map — AI rationale (under review)

V13.1.4partialaligns with — The ISO requirement to establish a documented backup policy and schedule for rotating critical secrets aligns with the ASVS mandate to document and rotate secrets essential to application security.
V13.3.4partialaligns with — Requiring that backup secrets expire and are rotated according to documented policy mirrors the ASVS expectation that secrets are configured to expire and rotate on a defined schedule.
V14.2.7partialaligns with — Defining retention periods and automated deletion of backup data once it expires directly supports the ASVS requirement that sensitive information be subject to data-retention classification and automatic removal of outdated data.
V16.2.3partialaligns with — Ensuring backups are stored only in approved, documented locations and services corresponds to the ASVS rule that logs and related artifacts are stored or transmitted only to documented destinations.

Related weaknesses / CWE (5)

Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

CWE-200→P CWE-530←M →M CWE-770→P

Why these map — AI rationale (under review)

CWE-312nonemitigates — Mandating encryption of backups according to confidentiality risks directly counters the storage of sensitive information in cleartext on backup media.
CWE-200mitigates — Encrypting backups and storing them off-site with physical and environmental controls reduces the chance that an attacker who compromises the primary site can read or exfiltrate the sensitive data.
CWE-530prevents — The backup control explicitly requires protecting backup confidentiality and integrity, directly addressing exposure risks.
CWE-770mitigates — Defining retention periods and deletion schedules for backup copies prevents indefinite accumulation of data on storage media without corresponding resource-management controls.

Mitigated MITRE ATT&CK techniques (345)

Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1001←M T1001.002←M T1001.003←M T1003→M T1003.002→M T1003.003←M →M T1003.004→M T1003.005→M T1003.006→M T1003.007→M T1003.008→M T1005→M T1006←M →M T1014←M T1025→M T1027.001←M T1027.002←M T1027.006←M →M T1027.007←M T1027.008←M T1027.009←M T1027.011←M T1027.012→M T1027.014←M T1027.016←P T1027.017→M T1036←M T1036.003←M T1036.005←M T1036.007→M T1036.008←M →M T1036.009←M T1039→M T1040→M T1047←M T1055←M T1055.001←M T1055.002←M T1055.003←M T1055.004←M T1055.005←M T1055.008←M T1055.009←M T1055.011←M T1055.012←M T1055.013←M →M T1055.014←M T1055.015←M T1056→M T1070←M →P T1070.003←M T1070.004→M T1070.005→M T1070.006←M T1070.007→P T1070.008→P T1070.010←M T1071.004←M T1074→M T1074.001→M T1074.002←M →M T1078←P T1078.004←M →P T1090.002←M T1090.003←M T1098.005←M T1113→M T1114→M T1114.001→M T1114.002→M T1114.003→M T1119→M T1123→M T1127←M T1127.002→M T1133←M T1134.004←M T1137.001→P T1197→M T1205.002→M T1207←M →M T1211←P T1213→M T1213.001→M T1213.002→M T1213.003→M T1213.004→M T1213.005→M T1213.006→P T1218←M T1218.001→M T1218.005←M →M T1218.007←M →M T1218.011←M T1218.012→M T1218.013←M T1218.014←P →M T1218.015→M T1221←M T1222←P T1222.001←P T1222.002←M T1480.001←M T1484←M T1484.002←M T1485←M →M T1485.001←M →M T1486←M →M T1489←P →M T1490→M T1491→M T1491.001→M T1491.002→M T1495←M →M T1496→M T1496.001→M T1496.002→P T1496.003→M T1496.004→P T1497.002←P T1498←P →M T1498.001←P →M T1498.002→M T1499←M →M T1499.001→M T1499.002→M T1499.003→M T1499.004←P →M T1518.002←M T1528→M T1529←M →M T1530←M →M T1531←M →M T1535←M T1537←M →P T1539←F →M T1542←M →M T1542.001→M T1542.002←M →M T1542.003←M →M T1542.004→M T1542.005→M T1546.012←P T1548.006←M T1550←M T1550.001←F T1550.002←F T1550.003←F T1550.004←F T1552→M T1552.001←P T1552.004→P T1552.005→M T1552.006→M T1552.008→M T1553.002←P T1553.003←M T1553.004←P T1553.005←M T1553.006←M T1555→M T1555.001→M T1555.003→P T1555.004→P T1555.005→M T1555.006→M T1556.001→M T1556.004→M T1556.005→M T1556.006←F T1556.007←M T1556.009←M T1557→M T1557.001→M T1557.003→M T1557.004→M T1558.001→M T1558.002→M T1558.005→M T1560→M T1560.001→M T1560.002→M T1560.003→M T1561→M T1561.001→M T1561.002←M →M T1564→M T1564.005→M T1564.009→M T1564.014→M T1565→M T1565.001→M T1565.002←P →M T1565.003→P T1571←M T1572←M T1574←M →M T1574.001←M T1574.004←M →M T1574.006→M T1574.008→M T1574.009→M T1574.013←M →M T1574.014→M T1578←M →M T1578.001←M T1578.002←M →M T1578.003←M →M T1578.004←M →M T1578.005←M T1599←M T1599.001←P T1600←P T1600.001←P T1601→M T1601.001←P →P T1601.002←M T1602.002→M T1606←M →M T1606.002→M T1610←P T1612←M T1620←M T1621←P T1622←M T1647←P →M T1649→P T1653←P T1657←M →M T1665←P T1666←M T1667→M T1677←P T1679→M T1684→M T1684.001→M T1685←M T1685.001←M →M T1685.002→M T1685.003←M T1685.004←M T1685.005←M →M T1685.006←M →M T1686←M T1687←P T1688←M →M T1690←M

Why these map — AI rationale (under review)

T1003recovers — A.8.13's core purpose and mechanisms (backups, retention, tested restoration) directly enable recovery of systems and data after credential-dumping has occurred and been contained, restoring the pre-incident state; the named remainder is that it does not restore already-compromised credentials themselves.
T1003.002recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data/systems via backups that can be restored after an incident; T1003.002's credential extraction (and any follow-on loss or damage) is bounded by that recovery capability, with the named remainder being the window of data since the last backup.
T1003.003detects — A.8.13 requires monitoring the execution of backups and addressing failures, which can surface anomalous backup-related activity (e.g. unexpected access or copy attempts on NTDS-related backups), but this is a narrow slice of the technique's full surface including live DC access methods like Volume Shadow Copy or ntdsutil.exe.
T1003.003recovers — A.8.13's defined purpose and mechanisms (backups, retention, tested restoration procedures) directly enable recovery of the stolen NTDS-derived credential and directory data after the T1003.003 event, with the named remainder being the window of data created after the last backup.
T1003.004recovers — A.8.13's defined purpose and mechanism are to enable recovery from loss of data/systems via backups that can be restored after an incident; once T1003.004 has run and extracted LSA secrets (the realized impact), restored backups can recover the prior system/credential state that the theft altered or exposed.
T1003.005recovers — A.8.13's defined purpose and mechanism is to enable recovery from loss of data or systems via backups that can be restored after an incident; T1003.005's credential extraction (and any follow-on loss of availability or integrity) is bounded by those same incident-response and business-continuity restoration objectives that the control explicitly tests against.
T1003.006recovers — A.8.13 enables recovery from loss of data/systems via backups and restoration, but T1003.006 is a credential-theft technique that extracts in-memory/AD data without causing loss, deletion, or corruption that backups would restore.
T1003.007recovers — A.8.13's core purpose and mechanism is to restore information and systems after loss/failure/incident, which directly recovers from the realized impact of credential theft via procfs (lost confidentiality of credentials) even though the technique itself is not undone.
T1003.008recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment, and full-system recovery after disaster or loss) directly restore the state destroyed by credential dumping, with the named remainder being the window of newly-compromised credentials issued since the last backup.
T1005recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO alignment, disaster-recovery coverage) directly restore data after an adversary has collected it from local sources, exactly matching the recovers verb; the named remainder is data written after the last backup.
T1006recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data/systems via backups and tested restoration procedures, which directly recovers state after T1006's volume-access exfiltration or modification has occurred.
T1025recovers — A.8.13's core purpose and mechanism is to enable recovery from loss of data or systems via backups and tested restoration procedures; once T1025 has collected data from removable media, the backup regime restores the affected information (or the system state) afterward.
T1027.006recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data/systems via backups that can be restored after an incident; once HTML smuggling has delivered and executed its payload (realising loss, corruption or ransomware-like impact), the tested backup+restore regime recovers the affected state, with the named remainder being data written after the last backup.
T1027.012recovers — A.8.13's purpose and guidance center on restoring essential information, software and systems after loss/failure/incident; the technique's post-compromise payload download and any resulting data loss or corruption are directly addressed by tested backup+restore that recovers state afterward.
T1027.017recovers — A.8.13's purpose and guidance are to enable recovery from loss of data or systems via backups and tested restoration procedures; once SVG smuggling has executed (e.g. payload assembled/downloaded/injected), backup+restore can recover the resulting corrupted/lost state, with the named remainder being the window since the last backup.
T1036.007recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems after an incident; once the double-extension technique has led to malware execution and consequent data loss or system damage, the mandated backups, restoration procedures, and testing allow the organization to recover the affected state.
T1036.008recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems (including after incidents that could involve masqueraded malware), with tested restoration procedures that meet business continuity objectives; the technique's impact on data integrity/availability is bounded by the backup regime, though not every masquerading artifact is guaranteed to be fully reversed without residual effects.
T1039recovers — A.8.13's defined purpose and mechanism (backups + tested restoration) directly restore data after it has been collected by T1039, satisfying the recovers verb; mostly because the remainder (data already exfiltrated off-site before recovery) is explicitly bounded in the clause's own guidance on RPO and retention
T1040recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data/systems via backups that can be restored after an incident; T1040's sniffing realizes loss-of-confidentiality on captured data in transit, and the control restores that information from a prior safe backup (the same verb used for T1486 in the anchors).
T1055.013recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems via tested backups and restoration procedures, which directly recovers the pre-technique state after process doppelgänging (or any other impact) has occurred.
T1056recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data/systems via backups and tested restoration, which directly recovers after input-capture has already succeeded and stolen credentials or collected data (the realized impact).
T1070recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO alignment, and full-system recovery for critical assets) directly restore state after T1070 has removed or altered artifacts/logs, enabling forensic reconstruction and continuity despite the technique's selective modifications.
T1070.004recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data/systems via backups and tested restoration procedures; this directly recovers from the post-intrusion loss of evidence files that T1070.004 produces, with the named remainder being any files deleted before a backup could capture them.
T1070.005recovers — A.8.13's core purpose and mechanism is to restore state (information, software, systems) after loss or incident; T1070.005's cleanup of share-connection traces can be recovered from via tested, retained backups that meet RPO/RTO in the BCP, with the named remainder being any non-backed-up transient artifacts or untested restoration procedures.
T1070.007recovers — A.8.13's backup+restore regime recovers the pre-incident state of logs, registry keys and configuration files that T1070.007 deletes or modifies, but only for the subset of artifacts captured by the backup policy and only after the fact; many transient connection artifacts, non-backed-up locations, and real-time defensive indicators fall outside its scope.
T1070.008recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data/systems via backups and tested restoration procedures; this can recover mailbox data deleted by the technique, but only the subset that was captured in a prior backup before the adversary acted (most mailbox-clearing occurs on live data with no guaranteed prior backup of the specific artifacts).
T1074detects — A.8.13 requires monitoring the execution of backups and testing of backup measures, which can surface anomalous staging activity that affects backup completeness or triggers restoration testing, but this is indirect, scope-limited to backup operations, and does not broadly detect the technique itself.
T1074recovers — A.8.13's purpose and mechanisms (backups, retention, tested restoration procedures) directly enable recovery of data after it has been staged and then exfiltrated or lost, with the named remainder being data written after the last backup.
T1074.001detects — A.8.13's monitoring of backup execution, failure detection, and regular testing of backup measures can surface anomalous staging activity that affects backup completeness or triggers restoration tests, but this is limited to backup-specific observables rather than general detection of local data staging across all platforms and methods.
T1074.001recovers — A.8.13's purpose and mechanisms (backups, retention, tested restoration) directly enable recovery of data after an adversary has staged it locally prior to exfiltration, with the named remainder being data written after the last backup.
T1074.002recovers — A.8.13's defined purpose and mechanisms (backups, retention, tested restoration) directly enable recovery of data after the adversary has staged it on a central system or cloud instance and then exfiltrated it, restoring the pre-event state.
T1078.004recovers — A.8.13's purpose and guidance focus on backing up and restoring essential information, software and systems after loss/failure/incident, which recovers state after T1078.004's realized impact (e.g. data harvested, persistence established, or commands run via compromised cloud accounts) but only for the data slice, not the account itself, credentials, or lateral movement already achieved.
T1113recovers — A.8.13's core purpose and mechanisms (backing up essential information/systems then restoring after loss/failure/incident) directly enable recovery of any data an adversary may have exfiltrated via screen capture, with the named remainder being the window of unsaved changes since the last backup.
T1114recovers — A.8.13's defined purpose and mechanism are to enable recovery from loss of data/systems via backups that can be restored after an incident; once T1114 has collected (exfiltrated) email content the backup regime restores the pre-collection state of the mailbox or server, exactly as it does for any other realized data-loss event.
T1114.001recovers — A.8.13's core purpose and mechanisms (backups, retention, tested restoration) directly enable recovery of the email data files after the T1114.001 collection has occurred; mostly because the control's scope is limited to essential/critical information per business requirements rather than all local email files universally.
T1114.002recovers — A.8.13's defined purpose and mechanism are to enable recovery from loss of data/systems via backups that can be restored after an incident; once T1114.002 has collected (and possibly exfiltrated) email, the backup regime restores the pre-collection state of that data.
T1114.003recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data/systems via backups that can be restored after an incident; once the forwarding rule has exfiltrated mail, restored backups of mailboxes/servers can recover the original state and data that was lost to the adversary.
T1119recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems via backups and tested restoration, which directly recovers the state after automated collection (and exfiltration) has realised its impact.
T1123recovers — A.8.13's defined purpose and mechanism (backups + tested restoration of essential information/systems after loss or incident) directly enable recovery of any audio files written to disk by T1123, restoring the pre-event state; the named remainder is live microphone capture that has not yet produced recoverable artifacts.
T1127.002recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment, and full-system recovery for critical assets) directly restore state after any execution that produces loss or corruption, including ClickOnce-based proxy execution or persistence.
T1137.001prevents — A.8.13's backup policy, plans, testing and retention requirements can constrain macro-enabled template abuse when the technique relies on writable user-profile locations or shared/remote templates that are backed up and restored from clean versions, but this is only a slice of the attack surface (search-order hijacks, registry changes, trusted locations, macro policy bypasses remain untouched).
T1197recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems after an incident or failure; BITS abuse realises persistence, execution, download, upload/exfil or cleanup that can destroy, alter or replace data, and the control's tested backups plus restoration procedures recover the pre-event state.
T1205.002recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems after an incident or failure; once the socket-filter technique has run and activated its backdoor/persistence, backup+restore restores the pre-technique state of the affected host or data.
T1207recovers — A.8.13's purpose and guidance are to enable recovery from loss of data or systems via backups and tested restoration procedures; a rogue DC's AD manipulation (including credential/key changes, schema alterations, metadata deletion) constitutes data/system corruption or loss that backups of AD, domain objects, and critical systems can restore from, with the named remainder being unrecoverable changes since the last backup.
T1213recovers — A.8.13's core purpose and mechanisms (backups, retention, tested restoration procedures) directly enable recovery of data stolen or exfiltrated from repositories after the T1213 event occurs
T1213.001recovers — A.8.13's core purpose and mechanisms (backing up essential information, testing restores, and recovering post-incident) directly enable restoration of data stolen or deleted from a Confluence repository, with the named remainder being any non-backed-up transient or cloud-specific content outside the retention policy.
T1213.002recovers — A.8.13's core purpose and mechanisms (backing up essential information, testing restores, meeting business continuity objectives) directly enable recovery of data an adversary may have exfiltrated or deleted from a SharePoint repository, with the named remainder being non-backed-up or post-backup changes.
T1213.003recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data/systems via backups that can be restored after an incident; once the adversary has collected (exfiltrated) source code or credentials from the repository the backup regime restores the pre-theft state of the affected systems/repositories.
T1213.004recovers — A.8.13's core purpose and mechanisms (backups, retention, tested restoration of essential information/systems) directly enable recovery of CRM-stored customer data after an adversary has mined it, with the named remainder being the window of data written since the last backup.
T1213.005recovers — A.8.13's core purpose and mechanism is to restore information and systems after loss/failure/incident, which directly recovers data exfiltrated or leveraged from messaging apps once the technique has run.
T1213.006recovers — A.8.13 enables recovery of data lost to an incident (including post-exfiltration database mining), but only for the backup copies that exist; it does not restore data deleted, altered, or never captured from the live database, nor does it address the technique's collection step itself.
T1218.001recovers — A.8.13's defined purpose and mechanisms are to enable recovery from loss of data or systems after an incident; a CHM-based execution that leads to data loss, encryption, or system compromise can have its state restored via tested backups and restoration procedures, with the named remainder being the window of data created since the last backup.
T1218.005recovers — A.8.13 enables recovery from loss of data or systems after an incident, but T1218.005 is an execution technique that runs without causing data loss or system failure
T1218.007recovers — A.8.13's core purpose and mechanism is to enable recovery from loss of data or systems after an incident; once T1218.007 has executed its payload the resulting damage or loss can be recovered via tested backups and restoration procedures.
T1218.012detects — A.8.13's operational monitoring of backup execution and regular testing of backup measures can surface anomalies or failures that would be consistent with a verclsid.exe abuse incident, but this is incidental and far from the control's defined purpose of enabling recovery from data loss.
T1218.012recovers — A.8.13's purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment with business continuity) directly enable state restoration after any execution-impact event, including post-T1218.012 payload effects such as data loss or system damage.
T1218.014recovers — A.8.13's defined purpose and mechanisms (backups, retention, tested restoration procedures) directly enable recovery of systems and data after T1218.014 has been used to delete the backup catalog and inhibit recovery (T1490).
T1218.015recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems after an incident; the technique's impact (malicious code execution and any resulting data/system damage) is restored by the backups and tested restoration procedures it mandates.
T1485recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO alignment, cloud backup provisions) directly restore data and systems after T1485's destruction has rendered them unavailable, matching the recovers verb; mostly because the remainder (data written after the last backup) is explicitly named in the clause's own guidance.
T1485responds — A.8.13 requires tested backup+restore capabilities that, once destruction has occurred, enable recovery of essential information and systems as part of incident response and business continuity, directly bounding the realized availability impact.
T1485.001recovers — A.8.13's core purpose and mechanisms (backups, retention policies, tested restoration to meet BCP RTO/RPO) directly enable recovery of data destroyed by lifecycle-triggered deletion, including in cloud environments; mostly because the control explicitly notes that backups written after the deletion or reachable from the compromised environment may not be recoverable.
T1486prevents — A.8.13's backup facilities and tested restoration procedures (including offsite secure storage, encryption of backups, and RPO-aware frequency) directly enable recovery of data after ransomware encryption, preventing the final availability impact asserted by T1486; the named remainder is data written after the last backup.
T1486recovers — A.8.13's defined purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment) directly restore data and systems after ransomware encryption has rendered them unavailable, matching the recovers verb; mostly because the remainder (data written after the last backup) is explicitly named in the clause and in the event-lane anchor.
T1486responds — A.8.13's backup regime (with tested restoration procedures) is explicitly invoked by the control to meet incident-response and business-continuity objectives once ransomware encryption has occurred; the technique has already run and produced its impact, which responding then contains/addresses via recovery.
T1489recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment, and full-system recovery for critical services after disaster or loss) directly enable recovery of the availability and data stores disrupted by stopping services, matching the event-lane recovers verb; mostly because the clause's own text notes limits such as data written since the last backup and backups reachable from the compromised environment.
T1490recovers — A.8.13's core purpose and guidance are to provide, test and retain backup facilities so that essential information, software and systems can be restored after loss/failure/disaster, directly addressing the post-impact recovery that T1490 seeks to block.
T1491recovers — A.8.13's purpose and guidance are to enable recovery from loss of data or systems via backups and tested restoration procedures; while T1491 is a pure integrity attack (modifying visual content in place), the control's tested ability to restore from a pre-modification backup directly recovers the original state, with the named remainder being any post-backup changes or untested restoration gaps.
T1491.001recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment with business continuity) directly enable recovery of defaced internal systems, websites, login messages or desktop images to a prior clean state after the technique has run.
T1491.002recovers — A.8.13's purpose and mechanisms (backups, tested restoration procedures, RTO/RPO alignment) directly enable recovery of defaced external systems/websites after the technique has run, with the named remainder being non-essential or unbacked content.
T1495recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems via backups, restoration procedures, and testing; firmware corruption (T1495) is a form of system/device loss that can be recovered from by restoring from safe, offsite, tested backups of firmware images where available, with the named remainder being cases where no prior firmware backup was taken or the corruption also destroys the backup media itself.
T1496recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO alignment, and full-system recovery for critical assets) directly restore availability and resources after hijacking-induced consumption or outage, with the named remainder being partial consumption that does not reach data/system loss.
T1496.001recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment, and full-system recovery for critical assets) directly restore availability and compute capacity after hijacking-induced resource exhaustion or unresponsiveness, with the named remainder being any unbacked-up window since the last backup.
T1496.002recovers — A.8.13's backup and tested restoration facilities enable recovery of system state, data and availability after bandwidth-hijacking impact has occurred (e.g. restoring clean images or data lost to disruption or financial/reputational side-effects), but only for the subset of consequences that involve recoverable information or full-system rebuild rather than transient bandwidth consumption or ongoing botnet/proxy use.
T1496.003recovers — A.8.13's core purpose and mechanisms (backups, retention, tested restoration procedures) directly enable recovery of availability and data after the SMS-pumping-induced costs, overload or loss have occurred, with the named remainder being non-data impacts such as financial liability for the generated SMS charges.
T1496.004recovers — A.8.13 enables recovery of essential information, software and systems after loss/failure/disaster (including via tested restoration and cloud-service backups), which can restore availability after the resource-exhaustion impact of SaaS hijacking, but does not address financial costs, quota exhaustion or non-restorable service-state effects.
T1498recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems (including after incidents that degrade availability), with tested restoration procedures that meet business continuity objectives; this directly recovers state post-DoS impact, though the named remainder is the window of unrecoverable data or services since the last backup.
T1498.001recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment, full-system recovery for critical assets) directly enable post-incident restoration of availability after a network-flood DoS has ended, matching the recovers verb; mostly because the control restores data/system state but does not address transient saturation or non-persistent flood effects during the attack itself.
T1498.002recovers — A.8.13's purpose and guidance center on restoring availability of data/systems after loss, failure or incident; reflection amplification is a network DoS incident that reduces availability, so tested backups plus restoration procedures recover the affected state (with the named remainder being any unrecoverable window since the last backup).
T1499recovers — A.8.13's explicit purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment, full-system disaster recovery) restore availability of services and data after an Endpoint DoS has exhausted resources or caused crashes, matching the recovers verb; mostly because the control's own text notes limits such as data written since the last backup and the need for tested, timely restoration.
T1499.001recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment, and full-system recovery from disaster or loss) directly restore availability and service state after an OS-exhaustion DoS has been contained, matching the recovers verb; mostly because the control's scope is data/system restore rather than in-place OS resource recovery during active flooding.
T1499.002recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment with business continuity) directly enable recovery of service availability and data after a DoS-induced exhaustion or loss, with the named remainder being the window of unrecoverable impact between the last backup and the attack.
T1499.003recovers — A.8.13's defined purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment, full-system recovery for critical assets) directly restore availability and data after a resource-exhaustion DoS has ended, matching the recovers verb on the event lane.
T1499.004recovers — A.8.13's purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment, full-system recovery for critical assets) directly restore availability and data after a crash-induced DoS or its side-effects like data destruction.
T1499.004responds — A.8.13's backup+restore testing and incident-response integration directly enables containment/eradication of the realized DoS by restoring availability after the crash/exploitation has occurred.
T1528recovers — A.8.13's purpose and mechanisms (backups, retention, tested restoration) directly enable recovery of data/systems after token theft has caused loss or compromise, matching the control's explicit recovery-from-incident intent; mostly because some token-theft impacts (e.g., long-lived unauthorized actions already taken) may not be fully restorable.
T1529recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO alignment, and full-system recovery for critical assets) directly restore availability after a shutdown/reboot has disrupted or destroyed access, matching the technique's impact on resources and recovery; mostly because the control's retention/deletion rules and cloud caveats leave a bounded remainder for non-backed-up transient data or untested edge cases.
T1530recovers — A.8.13's core purpose and mechanisms (backups, retention, tested restoration procedures) directly enable recovery of data after it has been accessed/exfiltrated via T1530, with the named remainder being data written after the last backup.
T1531recovers — A.8.13's core purpose and mechanisms (backups, retention, tested restoration procedures) directly enable recovery of accounts, data and systems after T1531 has removed access, exactly as the control is scoped for post-incident recovery; mostly because the clause explicitly notes that some ransomware-style account manipulations can impede recovery and that not all account states (e.g. deleted cloud identities with no retained backup) are guaranteed to be restorable.
T1537detects — A.8.13 requires monitoring the execution of backups (and addressing failures) plus regular testing of backup measures, which can surface anomalous or unauthorized backup/transfer activity to another account; however the clause's scope is limited to ensuring backup completeness and restorability per policy, not broad detection of adversary exfiltration via cloud-native sharing or internal transfers, leaving most of the technique's described vectors (API blending, SAS links, anonymous shares) outside its view.
T1539recovers — A.8.13's core purpose and mechanisms (backing up essential information/systems, testing restoration, and recovering after loss/failure/incident) directly enable state restoration after session-cookie theft has caused account compromise or data loss, with the named remainder being non-backed-up transient in-memory cookies or real-time session hijacking that cannot be rolled back.
T1542recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems (including after disaster or incident), which directly restores state after a T1542 persistence implant has altered boot firmware or drivers.
T1542.001recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems (including after an incident that could involve firmware modification), with tested restoration procedures that meet business continuity objectives; the named remainder is that firmware recovery is not always part of standard data/system backups and may require specialized procedures outside the clause's primary scope.
T1542.002recovers — A.8.13's core purpose and mechanism is to enable recovery from loss of data or systems via tested backups and restoration procedures; while it does not directly restore firmware on immutable hardware components, it recovers the broader system state (OS, applications, data) post-reimage or incident, leaving only the firmware slice as named remainder consistent with the clause's own guidance on critical systems and disaster recovery.
T1542.003recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems (including after incidents that corrupt or replace boot sectors), with tested restoration procedures that can reinstall clean boot components and OS images; the named remainder is that a live bootkit may first require detection and remediation before restoration can safely succeed.
T1542.004recovers — A.8.13's defined purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment, and full-system recovery after disaster or loss) directly restore state after ROMMON firmware overwrite has occurred, independent of whether the technique itself is stopped.
T1542.005recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment, and full-system recovery for critical devices after disaster or loss) directly restore the pre-incident state after a TFTP-booted malicious image has been loaded and run, with the named remainder being the window since the last backup.
T1552recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO alignment, and full-system recovery for critical assets) directly restore the state after credentials are exfiltrated or lost due to the technique, with the named remainder being the window since the last backup.
T1552.004recovers — A.8.13's core purpose and mechanisms (backing up essential information/software, testing restores, and recovering post-incident) directly enable restoration of any lost or deleted private keys discovered via T1552.004, with the named remainder being keys generated post-backup or unbacked cloud/device-specific keys.
T1552.005recovers — A.8.13's defined purpose and mechanism are to enable recovery from loss of data or systems via backups that can be restored after an incident; once T1552.005 has succeeded and credentials/data are exfiltrated, restored backups (with rotation or revocation of exposed secrets) recover the pre-incident state for affected systems and data.
T1552.006recovers — A.8.13's purpose and guidance center on enabling recovery from loss of data/systems via backups and tested restoration procedures; while it does not directly address credential exposure in GPP, a backup taken before the technique runs (or of a clean state) allows restoration of the affected domain controller/SYSVOL to undo realized impact, with the named remainder being post-compromise backups that may contain the exposed credentials themselves.
T1552.008recovers — A.8.13's core purpose and mechanisms (backups, retention, tested restoration to meet BCP/IRP objectives) directly enable recovery of systems and data after loss or incident, including SaaS/cloud chat services where credentials may have been exposed; the named remainder is that it restores state but does not itself remove already-compromised credentials from active attacker possession.
T1555recovers — A.8.13's defined purpose and mechanisms (backups, retention, tested restoration) restore the pre-incident state after T1555 has already obtained credentials from stores, exactly as the recovers verb names; mostly because the control's own text limits it to essential business information and leaves non-backed-up credential stores (e.g. certain in-memory or transient vaults) as named residue.
T1555.001recovers — A.8.13's core purpose and mechanisms (backing up essential information, testing restoration, and recovering after loss/failure) directly enable state restoration after T1555.001 has already succeeded in acquiring credentials from a Keychain file or memory; the named remainder is non-backed-up transient memory-resident credentials or untested restores.
T1555.003recovers — A.8.13's backup+restore regime can recover the browser credential stores or the whole system after the T1555.003 theft has occurred, restoring the pre-theft state for the credential files themselves; it does not undo the adversary's already-exfiltrated copy of the plaintext credentials.
T1555.004recovers — A.8.13's defined purpose and mechanisms (backing up essential information, testing restores, and recovering after loss/failure) directly restore credentials that were acquired or lost via T1555.004, with the named remainder being the window of unbacked-up changes since the last backup.
T1555.005recovers — A.8.13's core purpose and mechanisms (backups, retention, tested restoration to meet BCP/IRP objectives) directly enable recovery of the credential stores or systems after T1555.005 has extracted data from them, with the named remainder being the window of exposure between last backup and the theft.
T1555.006recovers — A.8.13's core purpose and mechanisms (backups, retention, tested restoration to meet BCP/IRP RTO/RPO) directly enable recovery of systems and data after an adversary has extracted secrets via T1555.006, with the named remainder being non-backed-up transient secrets or untested restoration processes.
T1556.001recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems after an incident; once T1556.001 has run and created a backdoor, restoring from clean backups (of systems, authentication binaries, or domain state) removes the patch and returns to a pre-incident state.
T1556.004recovers — A.8.13's purpose and guidance are to enable recovery from loss of data or systems via backups and tested restoration procedures, which directly supports recovering a network device after the modified system image (with its backdoored password) is detected and needs to be replaced from a clean backup.
T1556.005recovers — A.8.13's purpose and mechanisms are explicitly to enable recovery from loss of data/systems via backups and tested restoration, which directly recovers the state (e.g. credentials) after an adversary has abused reversible encryption to obtain plaintext passwords.
T1557recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems after an incident or failure; AiTM enables follow-on data loss, manipulation, or DoS whose realized impact (e.g. lost or corrupted information) is restored by backups.
T1557.001recovers — A.8.13's purpose and guidance are to enable recovery from loss of data or systems via backups and tested restoration procedures; while the primary impact of T1557.001 is credential theft/relay leading to code execution or further compromise, the control recovers from any consequent data loss or system failure that may result from the technique's success.
T1557.003recovers — A.8.13's defined purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment, and full-system recovery for critical assets) directly restore the network state and data flows disrupted by DHCP-spoofing-induced redirection, sniffing or exhaustion once the incident has occurred.
T1557.004recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems after an incident; evil-twin enables follow-on data theft, manipulation or sniffing whose realized impact on information can be restored from backup, matching the recovers verb used for the identical control against T1486.
T1558.001recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems via backups, restoration procedures, and testing; a golden ticket compromises authentication material across the AD domain, and backups of essential information, applications, and systems (including domain controllers) allow restoration of a clean state after the incident.
T1558.002recovers — A.8.13's core purpose and mechanism is to restore essential information, software and systems after loss/failure/disaster; silver-ticket use realises credential compromise that can lead to data or system loss on the targeted resource, which backups directly recover.
T1558.005recovers — A.8.13's core purpose and mechanisms (backups, retention, tested restoration to meet BCP/IRP RTO/RPO) directly enable recovery of the ccache files or the systems/sessions they support after theft or loss, with the named remainder being in-memory ccache on macOS that is never written to backup media.
T1560recovers — A.8.13's core purpose and mechanisms (backups, retention, tested restoration) directly enable recovery of data after an adversary has collected/archived it for exfiltration, with the named remainder being data collected since the last backup.
T1560.001recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data/systems via tested backups and restoration procedures, which directly recovers the state destroyed by the exfiltration-prep step of T1560.001 (the data remains available post-exfiltration).
T1560.002recovers — A.8.13's defined purpose and mechanisms (backups, retention, tested restoration) directly restore data after any loss or encryption event, including post-T1560.002 exfiltration prep; mostly because the remainder is data written after the last backup.
T1560.003recovers — A.8.13's defined purpose and mechanisms (backing up essential information/software then testing restoration) directly restore state after the adversary's custom-archived collection has already occurred and been exfiltrated, exactly as the recovers verb names on the event lane.
T1561recovers — A.8.13's defined purpose and mechanisms (backups, tested restoration procedures, RPO-aware frequency, and full-system recovery for critical assets) directly restore state after a disk-wipe event realises its impact, matching the recovers verb; mostly because the remainder (data written since last backup) is explicitly named in the clause and in the event-lane anchor for the identical technique.
T1561responds — A.8.13's backup+restore regime (tested against incident-response and BCP objectives) directly enables containment/eradication by restoring wiped systems after the T1561 event has run, which is the core of `responds`; mostly because the clause's own text limits it to essential information/software and leaves non-backed-up transient state or untested restores as named residue.
T1561.001detects — A.8.13 requires monitoring the execution of backups and testing of backup measures (including restoration), which can surface anomalies or failures indicative of prior disk-wipe activity, but this is indirect, post-incident, and limited to backup-related observables rather than directly detecting the wipe technique itself.
T1561.001recovers — A.8.13's core purpose and mechanism is to enable recovery from loss of data or systems via tested backups and restoration procedures, directly addressing the availability interruption and irrecoverable data from disk content wipe (as in the T1561.001 event-lane anchor for the identical T1486 pair).
T1561.001responds — A.8.13's backup+restore regime (with testing against incident-response and BCP objectives) directly enables containment/eradication of realized disk-wipe impact by restoring from safe remote copies, exactly as the event-lane anchor grades the identical control vs T1486.
T1561.002recovers — A.8.13's defined purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment, and full-system recovery for critical assets) directly restore the wiped boot structures and OS after T1561.002 has rendered systems unbootable; the named remainder is data written since the last backup.
T1561.002responds — A.8.13's backup+restore testing and incident-response linkage directly enable containment/eradication actions once disk-structure wipe has occurred (recovering availability after the technique runs), with the named remainder being non-restorable systems where the backup regime itself was destroyed.
T1564recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment, full-system disaster recovery) directly restore state after an adversary hides artifacts (e.g. deleted/hidden files, isolated regions) that caused loss or impaired visibility/operation, matching the control's explicit recovery-from-loss intent; mostly because some hiding techniques leave no recoverable artifact or occur after the last backup.
T1564.005recovers — A.8.13's defined purpose and mechanisms (backups, retention, tested restoration procedures) directly enable recovery of data/systems after an adversary has used a hidden file system to conceal or damage information, with the named remainder being data written after the last backup.
T1564.009recovers — A.8.13's defined purpose and mechanism are to enable recovery from loss of data or systems via backups that are tested and restored; once a resource-fork technique has hidden or executed its payload the resulting loss or corruption of integrity/availability on the affected macOS objects is restored by the backup regime, exactly as the control does for T1486.
T1564.014recovers — A.8.13's core purpose and mechanisms (backing up essential information/software, testing restoration, and recovering post-incident or loss) directly enable state restoration after an adversary hides a payload via xattrs, allowing the clean original file to be restored from backup.
T1565recovers — A.8.13's core purpose and mechanisms (backups, retention, tested restoration) directly restore data or systems after integrity loss from manipulation, matching the recovers verb; mostly because the remainder is data manipulated before the last backup or outside tested restoration scope.
T1565.001recovers — A.8.13's core purpose and mechanisms (backups, retention, tested restoration procedures) directly enable recovery of the original data state after manipulation at rest has occurred.
T1565.002recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment, full-system recovery from loss/failure) directly restore the pre-manipulation state of transmitted data once integrity is violated, with the named remainder being any unbacked window or untested edge cases.
T1565.003recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment with business continuity) directly enable recovery of original data state after runtime manipulation has altered it, but only for data covered by the backup regime — not for all possible runtime-affected processes, in-memory manipulations, or post-incident effects on decisions already made.
T1574recovers — A.8.13's defined purpose and mechanism is to restore state (information, software, systems) after loss or incident; T1574's hijack can produce such loss (e.g. via persistence leading to ransomware or corruption), so the backup regime recovers from its realized effects.
T1574.004recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems via backups and tested restoration procedures, which directly recovers the state (e.g., clean dylibs, system integrity) after a T1574.004 execution that may corrupt or replace files.
T1574.006recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems after an incident or failure, which directly matches the recovers verb for the effects of a realized T1574.006 technique (e.g. restored state post-hijacking impact).
T1574.008recovers — A.8.13's purpose and guidance center on restoring essential information, software and systems after loss/failure/incident, which recovers state after a realized T1574.008 payload executes; mostly because the control's remainder (unbacked data written since last backup, or backups themselves compromised) is explicitly named in its text.
T1574.009recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems after an incident; the technique's realized impact (malicious executable running, persistence/escalation achieved) can be rolled back by restoring a clean backup of the affected system or files.
T1574.013recovers — A.8.13's purpose and mechanisms are explicitly to recover systems, software and data after loss/failure/incident; the hijack technique realises execution-flow loss that backup+restore can return to a known-good prior state (with the usual named remainder of post-backup changes).
T1574.014recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems after an incident; once AppDomainManager injection has executed arbitrary code, backup+restore of the affected system or its state (tested per the clause) recovers that state, with the named remainder being in-memory-only effects or data written after the last backup.
T1578recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment, full-system disaster recovery for critical assets) directly restore state after an adversary modifies/deletes cloud compute components such as instances, VMs or snapshots.
T1578.002recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment, full-system disaster recovery for critical assets including cloud) directly restore state after an adversary creates a new instance to evade defenses or stage data, with the named remainder being any data written after the last backup.
T1578.003detects — A.8.13 requires monitoring the execution of backups and testing restoration procedures, which can surface evidence that a cloud instance (and its artifacts) has been deleted when the expected backup or recovery test fails.
T1578.003recovers — A.8.13's core purpose and mechanisms (backups, retention, tested restoration to meet BCP/IRP objectives) directly enable recovery of data/systems after deletion of a cloud instance, with the named remainder being unbacked or post-backup changes plus the explicit exception for cloud-provider backup fulfillment.
T1578.003responds — A.8.13's backup+restore regime (including testing against incident response and BCP objectives) enables containment/eradication by allowing recovery of a deleted instance from safe off-instance copies, directly addressing the post-deletion impact once the technique has run.
T1578.004recovers — A.8.13's core purpose and mechanisms (backups, restoration procedures, testing against BCP recovery objectives, and cloud backup provisions) directly enable state restoration after an adversary reverts a cloud instance to erase evidence, with the named remainder being the window of data written since the last backup.
T1601recovers — A.8.13's core purpose and mechanisms (backing up essential information/software/systems, testing restoration, and recovering after loss/failure/incident) directly enable restoration of a prior unmodified system image on embedded/network devices once the T1601 modification has occurred.
T1601.001recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, RPO/RTO alignment, and full-system recovery for critical devices) directly enable post-incident restoration of the original unmodified system image after an adversary patches it in storage or memory, but this is bounded by the technique's in-memory-only variants that do not survive reboots and by the control's explicit focus on essential business data rather than every network device firmware image.
T1602.002recovers — A.8.13's core purpose and mechanisms (backups, retention, tested restoration to meet BCP/IRP objectives) directly enable recovery of the dumped configuration (and any derived loss) after the T1602.002 collection event, with the named remainder being configurations altered post-dump or in unbacked cloud/device contexts.
T1606recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems (including after an incident), which directly matches the recovers verb even though the technique itself is credential forgery rather than destructive data loss.
T1606.002recovers — A.8.13's purpose and guidance are to enable recovery from loss of data or systems via backups that can be restored after an incident; forging a SAML token realises an authentication bypass that can lead to data loss or system compromise, after which the backup regime restores the affected state.
T1647recovers — A.8.13's core purpose and mechanism is to enable recovery from loss of data or systems via backups and tested restoration, which directly recovers the pre-modification state of plist files after T1647 has run.
T1649recovers — A.8.13's purpose and guidance center on restoring essential information/systems after loss or incident, which can recover from certificate theft (e.g., by restoring from secure backups), but does not address forged/golden certificates or the post-abuse persistence/lateral movement enabled by them.
T1657recovers — A.8.13's purpose and mechanisms (backups, retention, tested restoration to meet BCP/RTO) directly enable recovery of monetary resources or data after financial theft incidents such as ransomware extortion or BEC-induced loss, with the named remainder being unrecoverable windows since the last backup or cases where funds are irreversibly transferred to adversary-controlled accounts.
T1657responds — A.8.13's backup+restore testing and incident-response integration directly enables containment/eradication steps once financial theft (esp. ransomware extortion) is underway, restoring availability of the stolen resources; the named remainder is non-ransomware vectors (BEC, pig butchering, direct account compromise) where backup does not act on the monetary-transfer event itself.
T1667recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems (including after an incident), and email bombing's core impact is loss of access to the inbox via buried legitimate messages; backups and tested restoration procedures recover the mailbox state and surface the buried messages.
T1679recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems via backups and tested restoration procedures, which directly recovers from the realized impact of selective encryption/tampering performed by T1679 (the excluded files remain usable while the remainder can be restored from backup).
T1684recovers — A.8.13's core purpose and mechanisms (backups, tested restoration procedures, retention, and recovery from loss/failure/incident) directly enable post-event state restoration after social engineering has caused disclosure, unauthorized changes, or payload execution.
T1684.001recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems after an incident; impersonation (T1684.001) routinely produces data loss via fraud, exfiltration or financial theft, so the backup+restore regime recovers that realized impact.
T1685.001recovers — A.8.13's purpose and guidance are to enable recovery from loss of data or systems via backups that can be restored after an incident; disabling the Event Log is an incident that destroys audit data, and the control restores that data from backup (with the named remainder being logs generated after the last backup).
T1685.002recovers — A.8.13's backup and tested restoration facilities directly enable recovery of logs (or systems containing them) after the adversary's disable/modify action has taken effect, restoring the pre-incident state; the named remainder is that the most recent post-tamper events are unrecoverable until the next backup cycle.
T1685.005recovers — A.8.13's purpose and mechanisms (backups, tested restoration procedures, retention, and recovery from loss of data/systems) directly enable restoration of cleared Windows event logs after the T1685.005 technique has run, with the named remainder being the window of events generated between the last backup and the clearing.
T1685.006recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems (including after an incident), and clearing logs constitutes loss of forensic/audit data that backups of /var/log/* (or the systems containing them) can restore.
T1688recovers — A.8.13's purpose and guidance are explicitly to enable recovery from loss of data or systems after an incident; safe-mode boot realises an incident that can leave systems in a degraded or compromised state, and the control's tested backup+restore regime (including full-system recovery for critical assets) restores the pre-incident state.

Prevented OWASP Web Top 10 (2025) risks (2)

OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

A09←M A10←P

Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.