How AI Can Support Cyber Recovery and Digital Resilience
AI can help recovery teams organize incident reports, identify records that need verification, and draft restoration options. Digital resilience also requires dependable backups, an operational fallback and people who can approve and verify a return to service. The objective is to restore a trusted service at a measured level.
Prevention, recovery and resilience
Prevention reduces the chance that a harmful event interrupts the service. Recovery restores verified functions after an interruption. Resilience includes preparing for disruption, continuing essential work in a degraded state and adapting the service after recovery. NIST’s Cybersecurity Framework separates protection, response and recovery so teams can assign the work and assess each outcome.
Set recovery objectives and record actual results
A recovery time objective (RTO) is a target for restoring a defined function within a stated time. A recovery point objective (RPO) describes the tolerable amount of data loss expressed as time before the disruption. Specify the start of the clock, the minimum restored function and the integrity checks needed for sign-off.
After an exercise, record elapsed time to verified restoration and the age of the latest consistent restored record. A successful backup job is evidence that a copy was made. Restoration evidence comes from recovering the data in an authorized test and verifying that the service can actually use it.
Check both targets from the incident timestamps in the recovery time and data-loss objective check.
Build a recovery plan around dependencies
- Map service dependencies, including identity, data, storage, communications, power and staff.
- Identify backups and validate recoverability, access and integrity in an isolated exercise environment.
- Order restoration by dependencies and service priority. Verify restored records before reopening a service.
- Retain a manual intake or service path and a procedure to reconcile work performed during the outage.
An AI tool may help group status reports or highlight conflicting timestamps. Require operators to trace a proposed next step to an authoritative source and the approved runbook. Record missing evidence as an open issue.
Set limits on delegated AI-agent actions
Define which records an agent may read, what it may recommend, and who may approve a change. Start with read-only assistance in a test environment. A human recovery lead approves changes to service state, access or restored data. Record the action, approval and version, and have a documented way to reverse a change when feasible.
Escalate to the recovery lead if the agent encounters conflicting evidence or an action outside its authority. Keep the recovery checklist available to staff through the loss of the AI service itself.
Illustrative recovery of a municipal service desk
Illustrative exercise. A municipal service desk loses its online request portal. Set a four-hour target for verified digital intake and a one-hour recovery-point objective. During the outage, staffed phone intake uses a paper log and urgent requests go to the duty supervisor.
| Check | Exercise objective | Stipulated observation | Follow-up |
|---|---|---|---|
| Service restoration | Verified digital intake within 4 hours | Verified at 3 hours 40 minutes | Record what was verified and who signed off. |
| Recovery point | Consistent restored records within 1 hour of interruption | Latest consistent record is 80 minutes before interruption | Reconcile missing records and review backup frequency. |
| Fallback reconciliation | Each paper request is accounted for | Reconciliation remains open | Keep the paper log and assign a review owner. |
The stipulated restoration meets the time target and misses the recovery-point target by 20 minutes. Staff still need to reconcile the paper queue. The example demonstrates evaluation against two different targets and supplies no measured AI effect.
Explore the civilian logistics service outage scenario or map declared availability using the tested fallback exercise.
Failure modes and fallback
Conflicting alerts can lead to a premature restoration decision. A shared identity outage can also block a backup console and an AI assistant. Preserve an independent escalation route, a tested manual runbook, and an operator who can verify recovery evidence.
Use the service coverage and shortfall hours calculator to assess recorded service during degraded operation.
Sources and what they support
- NIST — Cybersecurity Framework 2.0. Published February 2024. Separates protection, detection, response and recovery outcomes within cybersecurity risk management. Retrieved .
- NIST — Guide for Cybersecurity Event Recovery (SP 800-184). Published December 2016. Supports recovery planning, playbooks, exercises, metrics and restoration coordination. Retrieved .
- NIST — Contingency Planning Guide for Federal Information Systems (SP 800-34 Rev. 1). Published 2010. Defines recovery time and recovery point objectives in contingency planning. Retrieved .