Ransomware doesn’t encrypt your data first — it destroys your backups. This handbook starts there and works forward.
Across 12 chapters and three frameworks, it covers why good backups fail the adversary test, the six controls that together make a vault (and why each one alone is defeatable), the reachability test for mapping every path by which a copy could be destroyed, and why identity isolation — not network isolation — is the real air gap.
The cyber recovery maturity model runs from Backed Up to Rehearsed, with each level defined by what it still cannot prove. The closing question is also the diagnostic: when attackers delete the backups, encrypt production, and demand payment — what is your last clean copy, and do you know it will restore?
