Framework mapping
MITRE ATT&CK® Enterprise mapping
Tactics: Impact
Platforms: Windows, Linux, macOS, IaaS, Network Devices, ESXi
Relationship: resilience and mitigation context
Open the official ATT&CK object ↗Editorial mapping of an inherited BMC article to related Enterprise ATT&CK behavior, control, evidence, architecture, or risk context. Mapping roles state the relationship and do not assert equivalence unless labeled direct.
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.
Related defensive techniques
Inferred and experimental: These relationships are generated from D3FEND graph paths. They are hypotheses for analysis, not proof of prevention, detection, or control effectiveness.
MITRE D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.
What it means
A strategy defines what is protected, how often copies are created, where they are stored, how long they are retained, who can modify them, and how restoration is tested.
Why it matters
Backups provide value only when they are protected from the same incident and can be restored within business requirements.
Practical focus
- Use multiple copies and separate failure domains
- Protect backup identities and administration
- Include configuration, keys, and dependencies
- Test restoration against recovery objectives
Common mistakes
- Counting successful backup jobs as proof of recoverability
- Leaving backups online and writable from production
- Testing only file recovery when entire services may need restoration
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: