Annex 3.5.1

Incident-response procedures govern containment and recovery from ransomware events; they are the operational layer that turns the existence of backups into actual restoration of service.

Incident-response procedures govern containment and recovery from wiper events under documented containment, eradication and recovery stages.

Incident-response procedures govern containment and recovery once deception is identified; documented procedures bound the time the entity operates on falsified evidence.

Incident-response procedures (containment, eradication, recovery) are the procedural mechanism that converts the observation of disruption into the restoration of mission service.

Incident-response procedures cover containment, eradication and recovery from denial events; the procedures determine the time-to-restore for ground-controller access to the spacecraft.

Incident-response procedures govern containment of cascading destruction (preventing wiper variants from reaching backup systems) and recovery actions once the destructive scope is bounded.

Incident-response procedures determine whether a compromise used as adversary infrastructure is detected and evicted before it is operationalized for mission impact.