Framework mapping
MITRE ATT&CK® Enterprise mapping
Tactics: Impact
Platforms: Windows, Linux, macOS, IaaS, Network Devices, ESXi
Relationship: response and recovery context
Open the official ATT&CK object ↗Editorial mapping of an inherited BMC article to related Enterprise ATT&CK behavior, control, evidence, architecture, or risk context. Mapping roles state the relationship and do not assert equivalence unless labeled direct.
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.
Related defensive techniques
Inferred and experimental: These relationships are generated from D3FEND graph paths. They are hypotheses for analysis, not proof of prevention, detection, or control effectiveness.
MITRE D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.
What it means
Incident recovery validation confirms that services are restored, attacker access is removed, controls are effective, data is trustworthy, and monitoring can detect recurrence.
Why it matters
Availability alone does not prove a system is safe to return to normal operations.
Practical focus
- Define technical and business recovery criteria
- Validate identity, persistence, configuration, and data integrity
- Monitor for recurrence after restoration
- Obtain accountable business acceptance
Common mistakes
- Restoring from backup without checking the compromise window
- Reconnecting systems before credentials are secured
- Declaring recovery when only the service is online
- Removing heightened monitoring too quickly
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: