Mission Recovery Function

Ransomware produces a denial the recovery plan must handle, and recovery from a known-good state is what makes the extortion fail. The practice governs the response without addressing the intrusion.

Wiper malware is a destructive disruption whose remedy is planned recovery. Same governance relationship as ransomware.

Deception is an integrity effect rather than a disruption, so the practice's anomaly-detection arm governs it while its recovery arm, written for disruptions, does not reach it.

The practice requires that intentional disruptions be carried into anomaly detection, response, and recovery plans across both segments. Disruption is the named case, and planned recovery is active recovery against it, which meets the mitigates bar.

Denial of mission service is an intentional disruption in the practice's own terms, and recovery planning is the response the practice mandates.

Degradation is the partial case of the same effect and is covered by the same planning obligation.

Destruction is deliberately typed below its sibling impact techniques: recovery planning cannot restore a destroyed vehicle, so the practice governs the mission's preparation for the loss rather than recovering from the technique.