Test Cyber Recovery by Processing a Customer Order

The server is back online, the database is available, and the application responds. The next question is whether employees can get back to work. Can they enter an order, process it, and pass it to the next stage without losing information or performing the same action twice?

Before the exercise, agree on the business action you will test and what a successful result looks like. Alongside that operational check, verify the integrity of recovered data and systems. NIST's Cybersecurity Framework 2.0 includes checking the integrity of restored assets and confirming that systems and services have returned to normal operating status. (NIST Cybersecurity Framework 2.0).

Choose a business action you can verify

Choose a process the organization needs to carry out, such as accepting a new order and passing it to the warehouse. Ask the process owner which steps must work when operations resume and which can wait.

Check explicitly that users can enter new orders, rather than only view existing ones. A limited service may be acceptable if its restrictions are defined, the people affected understand them, and the arrangement has been approved.

Write a clear success criterion: "An employee with the appropriate permissions can create an order, and the warehouse receives it with all the required details." This tests the connections between systems and the handoffs between people.

Set the time and data-loss objectives

The recovery time objective, or RTO, sets the target time for restoring a service. The recovery point objective, or RPO, defines the point in time to which data must be recovered, expressing acceptable data loss in terms of time. Set both objectives according to business needs, then use the exercise to test whether you can meet them. (NIST definition of RTO; NIST definition of RPO).

For illustration, suppose the organization wants to accept orders within four hours and can tolerate losing the data created in the fifteen minutes before the outage. If the server starts after one hour but the first order is not confirmed until five hours have passed, the time objective has not been met. If the most recent point to which data can be recovered is one hour before the outage, the RPO has also been missed.

Compare the results with the objectives and decide what to fix before the next exercise. NIST SP 800-184 recommends prioritizing resources, practicing recovery, and improving the recovery plan through metrics and lessons learned. (NIST SP 800-184, Guide for Cybersecurity Event Recovery).

Follow the order through every step

Use a test order in a coordinated, authorized exercise. Choose an environment and scope that will not put live operations at risk. Check each step:

• An employee signs in with the permissions they will have when operations resume.
• They create a test order and check the customer details, items, and prices.
• The order passes to the next system, and the team confirms that it was received exactly once.
• An operations representative confirms that the order can proceed through the agreed process.
• The team records timings, errors, and any manual work needed.

Do not send real orders or customer messages during the exercise without planning and approval in advance. Use test data. If real information is needed, decide beforehand who may access it and how it will be protected. Mark any untested connection explicitly; do not include it among the components that passed.

Reconcile the records created during the outage

Suppose sales staff manually collect five order requests while the system is unavailable. When it returns, they find that one request had already been recorded before the disruption and the customer had submitted it again. The other four are still missing.

Assign responsibility for comparing the records, approving the missing entries, and preventing duplicate charges or shipments. Ask the team to carry out that reconciliation during the exercise and show how the missing records will be added.

The NCSC's October 2026 technical-recovery guidance recommends planning how to check information created through manual work during an incident and reconcile it with restored data. It also recommends practicing restoration and documenting the sequence for restoring infrastructure, including dependencies between components. (NCSC guidance on preparing technical recovery).

Agree when systems can be reconnected

Before reconnecting a restored component, check whether it is fit and safe to use. Agree on the conditions with the incident-response team: the checks and evidence required, the protections that must be operating, and any restrictions that will remain.

NIST SP 800-61 Revision 3 treats recovery as part of cybersecurity risk management and incident response. Coordinate the return to operations with the investigation and protective measures. (NIST SP 800-61 Revision 3, April 2025).

At the end of the exercise, give management a summary of what was tested and when the business action could be completed. Identify data gaps, anything outside the scope of the test, and the person responsible for each unresolved issue. A partial test can still be useful if its limitations are clear and someone is assigned to follow up on the gaps.

Cybecs can help plan a readiness review for one business service, document what worked and what needs attention, and agree on priorities with the responsible teams. For an initial discussion, bring the recovery objectives and the findings from the most recent exercise, if available.

Discuss a focused review with Cybecs