RCE key terms

The maximum acceptable amount of data loss measured in time, defining how far back a recovery must be able to restore. It sets the required backup or replication frequency for each workload.

The target maximum duration allowed to restore a workload after disruption. It drives architecture choices such as replication type, automation level, and runbook design.

A backup copy that cannot be altered or deleted during a defined retention window, enforced by storage-level controls such as object lock. It resists ransomware encryption and insider deletion.

A logical or physical separation preventing direct network access between production systems and protected copies. It blocks lateral movement and remote deletion of recovery data.

A point-in-time image of a volume or filesystem that captures changed blocks efficiently. Snapshots support fast rollback but are not a substitute for independent, isolated backups.

The linked sequence of a full backup plus incremental or differential backups required to reconstruct data at a given point. A broken or corrupted link can invalidate later restore points.

Rules that define how long copies are kept, how often they are created, and when they expire. Policy must satisfy legal, regulatory, and operational recovery requirements.

The practice of regularly proving backups can actually be recovered, not merely that jobs succeeded. It includes test restores, integrity checks, and application-level validation.

Monitoring that flags unusual backup behavior such as sudden data volume changes, mass deletions, or unexpected encryption patterns. Early alerts indicate possible ransomware or destructive activity.

Authentication requiring two or more independent verification factors, such as a password plus a hardware token. It reduces the risk of credential theft leading to administrative compromise.

Granting only the permissions needed to perform a specific job, for the shortest practical duration. It limits blast radius when an account or service is compromised.

Controls that secure, broker, and audit high-privilege accounts, often through vaulting, session recording, and just-in-time elevation. It protects the accounts attackers most want.

The trusted system that authenticates users and issues assertions or tokens to applications. Compromise of the IdP can grant broad access across connected services.

A mechanism letting one authenticated session access multiple applications. It improves usability but concentrates risk, so the primary identity must be strongly protected.

Trust relationships that let identities from one domain or organization access resources in another using standards such as SAML or OIDC. It extends access without duplicating credentials.

Policy that evaluates signals such as device state, location, and risk before granting access. It enforces adaptive controls instead of relying only on static credentials.

Assigning permissions to roles rather than individuals so access follows job function. It simplifies administration and auditing of who can do what.

A non-human identity used by applications or automation to access resources. These accounts often hold high privileges and need rotation, monitoring, and ownership tracking.

A documented, tested sequence of steps to restore operations after a cyber incident, including decision points, roles, and validation criteria. It converts recovery plans into repeatable action.

Restoring systems in an isolated, hardened environment free of attacker presence, then validating them before reconnecting to production. It prevents reinfection during recovery.

A segregated infrastructure dedicated to recovering and validating data away from the production network. Access is tightly controlled and separately authenticated.

Scheduled exercises that simulate disruption and execute recovery procedures end to end. Results reveal gaps in documentation, dependencies, and timing against objectives.

A preserved copy of system state captured before remediation for investigation and evidence. It supports root-cause analysis and may satisfy legal or regulatory obligations.

Proactively searching environments for signs of compromise that automated tools missed. In recovery contexts it confirms whether attacker persistence remains before restoring service.

The division of security duties between a cloud provider and its customer. The provider secures the platform while the customer secures data, identities, and configuration.

Independent backup and recovery of data held in software-as-a-service applications, since providers typically guarantee availability rather than customer-level restoration. It covers accidental deletion and malicious actions.

A container for objects in cloud object storage, governed by access policies, versioning, and lifecycle rules. Misconfiguration is a common cause of exposure or data loss.

Safeguards applied to virtual machines, containers, and serverless functions in cloud environments, covering configuration, runtime behavior, and recovery readiness.

A requirement to preserve data beyond normal retention because of litigation or investigation. It overrides deletion schedules and must be tracked carefully.

A quantified rating of how well a workload or environment can withstand and recover from disruption, derived from coverage, isolation, and testing evidence. It guides remediation priorities.

Inventorying and visualizing exposed assets, identities, and paths an adversary could use. It helps prioritize protections around the systems most critical to recovery.

The component in a platform where configured rules are actually applied to traffic, access, or backup operations. Enforcement must match policy intent to be effective.

A tamper-evident record of actions taken in a system, including who did what and when. Logs support investigation, compliance evidence, and detection of suspicious behavior.

A predefined sequence of automated actions triggered by an event, such as isolating a host or starting recovery. It reduces response time and human error.

Capturing every change to data so recovery can target any prior moment, rather than only scheduled points. It minimizes loss for high-value systems.