Finance rejects the restore point that predates the intrusion — who owns that call and how do you frame it?

## Why this argument happens After a long intrusion the clean restore point is old, and "old" has a price tag that someone in the business can compute exactly: weeks of transactions, orders, case records, ledger entries. The security side's objection to the newer copy has no comparable number. Certain loss argues far more loudly than uncertain risk, which is why the conversation goes badly if the responder tries to win it on volume. ## Whose decision is it? The person accountable for the business consequence owns the decision. The responder owns the honesty of the inputs. That division matters for three reasons: the responder cannot price weeks of lost revenue or a missed regulatory filing; the business owner cannot price the chance of reintroducing an implant; and if the organisation later has to explain the choice, an accepted risk with a named owner is a defensible record while a technical veto is not. What the responder must not do is soften the input to make the decision easier. "The later copy is probably fine" is not a finding. The honest statement is narrower and more useful: this copy was written while the intruder had privilege on this system; here is what we know they did on systems like it; here is what we would be unable to detect if they had done it here. ## The poles are rarely the real choice Most of the value a senior responder adds is in refusing the binary: - **Restore clean, reconcile forward.** Restore the pre-intrusion point and rebuild the gap from sources outside the compromised system — an upstream system, a payment processor, a partner's records, a data warehouse or reporting copy, exports and statements. Slower, but it produces records you can stand behind. - **Split data from platform.** Rebuild the application and operating system from known-good media and configuration, then import only *data* from the later copy after validation. The intruder's work lives in executables, scheduled jobs, configuration, accounts and permissions — not usually in the business rows. This resolves a surprising number of these arguments outright. - **Stage it.** Bring the service back on the clean point so the business is operating, and reconcile or import the gap over the following days rather than blocking return to service on the argument. - **Accept with conditions.** If the later copy is genuinely the only path, attach the conditions that make it survivable: credentials for that system replaced, the entry path closed, application-layer review of what changed during the window, heightened monitoring for a defined period, and a scheduled review at which the acceptance is revisited. ## Sequencing, and the owners who all want to be first The same conversation repeats over order of return, and again the responder's criterion is not revenue. Things come back in trust-dependency order: identity and the administrative tier first, then the management and security plane that will build and watch everything else, then business systems by dependency — each rebuilt from known-good sources onto a network segment that has been rebuilt too, with nothing reconnecting to the old one. Service owners will argue for their system's position; the argument is winnable only if the criterion was written down and agreed before the queue formed, ideally in the recovery plan rather than in the incident. And some systems never come back. There is always a set of servers whose owner cannot justify the rebuild, whose function was superseded, or whose data is recoverable from elsewhere. Explicitly deciding to decommission them is a good outcome, not an admission of defeat — what is bad is leaving them undecided, because an unrestored, unremediated system that quietly gets reconnected months later is a path back. ## Constraints from outside the room Three parties can narrow the choice, and a principal-level answer knows to check them early. Counsel may need the untrusted copy preserved as evidence rather than overwritten. The insurer may condition cover on following defined steps. A regulator or a customer contract may require an assertion about integrity of restored records that the later copy makes impossible to sign. Any of these can turn a business preference into a non-option, so they belong in the framing rather than as a late surprise. ## What the record should say When the decision is taken, write it down while it is fresh: the options presented, what each was assessed to cost, what evidence supported the risk statement, which option was chosen, by whom, what compensating controls were attached, and when the acceptance is reviewed. That record is what makes the decision defensible to a board, an insurer or a regulator months later — and it is what stops the compensating controls from quietly lapsing once the crisis energy fades.