Ransomware recovery: what to restore first

Everything is down and everyone wants their system back first. The order you restore in decides how long the outage lasts and whether you get reinfected halfway through.

The order that works

1. Identity. Nothing else can be trusted until the directory is clean and the admin accounts are yours again. Restore it to a known-good point, rotate everything, and verify before moving on.
2. The things that let you see. Logging, monitoring, the tools you'll use to confirm the next system is clean. Restoring blind is how reinfection happens.
3. The one service the business can't be without. Not the loudest stakeholder's system. The one whose absence costs the most per hour. Decide this before the incident, in writing.
4. Everything that service depends on, which is usually more than anyone wrote down.
5. The rest, in order of cost of absence.

The questions nobody answers until it's too late

• Are the backups clean, or did they back up the encryption? You find out by restoring one and checking, not by reading the backup console.
• Where do you restore to? If the production environment is compromised, you need somewhere else, and it needs to exist already.
• Who decides to restore a system when it can't be confirmed clean? That's a risk decision, and it needs a named person.

Why this is a business plan, not an IT plan

The restore order is a statement of what the business values most. If IT decides it alone, they'll guess, and they'll be wrong about something that matters. Get the decision made by the people who own the services, while nothing's on fire.

If you've got backups but no sequence, that's a short piece of work that will save days when it counts.

Explore: More on operational resilience · Work with me