## Chapter 19 — One restored client folder is not a resilience score ### Learning outcomes After this chapter, you should be able to: 1. Say which CSF part existed before the incident. 2. Keep the folder restore as a plan. 3. Refuse a fifth signal or a D3FEND score. ### 19.1 The restore is the next subject. This book does not grade it. Before the incident, Protect, Detect, and Respond were empty. Backups, for Recover, were the only CSF part already in place. Leo's next topic is incident response and resilience. He would test the backups by restoring one client folder and asking whether the accounts software and client files could come back quickly. "Quickly" is not given a minute count in this book. The restore is not recorded as passed or failed. One folder is not every client folder, and it is not a resilience score. The four signals stay four. A restore test does not watch a mailbox. Adding it as a fifth signal would mix Recover with Detect. D3FEND (Kaloroumakis and Smith, 2021) is a knowledge graph of countermeasures. This book names it and does not score a countermeasure identifier against the folder. No second script prints a restore result. Incident response would also turn the mailbox playbook into short playbooks for other events, such as a lost laptop or a ransomware note. Those playbooks are not written here. The next course is where that work continues. This chapter does not invent their steps. | Item | Status in this book | |---|---| | Backups before the incident | Already in place | | One client folder | A planned test | | Pass, fail, or duration | Not printed | | Fifth signal | Not added | | D3FEND identifier | Not scored | ### 19.2 Worked example | Offered conclusion | What the book actually has | Decision | |---|---|---| | "Recover was the part already in place." | Backups existed | Keep | | "The test Leo plans is one folder." | A plan, not a result | Keep | | "The restore passed in four minutes." | No duration is printed | Refuse | | "Folder restore is signal number five." | The signals stay four | Refuse | > **Synthetic case.** No restore log is embedded. ### Errors and limits Do not print a pass mark for a test this book does not run. ### Apply - **EX065 — One folder.** Which CSF part was already in place, what does Leo plan to restore, and why is that plan not a score or a fifth signal? *Rubric:* 3 = backups, for Recover, were already in place; he plans to restore one client folder; no pass, fail, or duration is printed; the four signals stay four;; 2 = the plan stays a plan and the signals stay four;; 1 = one fact;; 0 = none. ### Continue studying — lesson 19 (chapter 19 of 20) [← Chapter 18](#ch-18) · [Course chapter index](../SUBJECTS.md) · [Chapter 20 →](#ch-20) Continue to the next authored lesson. ## Worked answers **EX065.** Backups, for Recover, were already in place. Leo plans to restore one client folder. No pass, fail, or duration is printed, and the four signals stay four.