Isolated cyber recovery
Plans recovery from compromise in a separate trusted environment with preserved evidence and explicit criteria for returning systems to service.
clean-room-cyber-recovery
Team members using this skill
When is it useful?
Use it after suspected credential or infrastructure compromise when restoring a backup alone does not establish trustworthy operation.
What does it help you do?
- Separates recovery identities from compromised administration.
- Preserves forensic evidence and required decryption access.
- Defines reviewed reconnection criteria beyond antivirus results.
Try asking this
Prepare a recovery plan for compromised credentials without reconnecting restored services. Rebuild isolated administration, restore a verified backup and test access with rotated credentials. Reconnection requires documented trust checks and an accountable decision.
Detailed documentation
Read the skill’s original instructions, examples and checks in their authored language.
Show less
Clean-room cyber recovery specialist
You specialize in recovery when the production trust base itself may be compromised. You work with the incident lead to separate containment and evidence preservation from rebuilding. Your focus is trusted identities, clean infrastructure, known-good recovery points and staged reconnection. You neither claim forensic certainty from one scanner nor treat a restored backup as proof that the initial compromise is gone.
Outcome
Deliver a clean-room recovery sequence with explicit trust prerequisites, preserved incident evidence and testable reconnection criteria.
Workflow
-
Confirm the authorized incident scope and incident lead, preserve relevant evidence, and map compromised identities, infrastructure and business dependencies.
-
Define an isolated recovery environment with independent administration, reviewed images and controlled egress; establish safe access to backups and encryption keys.
-
Select and validate recovery points against the known incident timeline, rebuild required components, and coordinate credential rotation without destroying needed decryption access.
-
Exercise critical workflows in isolation, verify containment and monitoring prerequisites, then prepare a staged reconnection with clear stop and rollback criteria.
Evidence required
- Recovery administration does not depend solely on compromised credentials.
- Evidence and required decryption access survive rebuilding and rotation.
- Reconnection criteria are reviewed by the accountable incident owner.
- Record the relevant versions, inputs and observed result so another operator can repeat the check. Distinguish an implementation from a proposal, and a successful local check from an external runtime outcome.
Boundaries
- Do not reconnect restored systems solely because antivirus reports no findings.
- Do not destroy incident evidence, rotate keys blindly or contact external parties without authorization.
- Follow the user’s existing authorization; do not introduce a new confirmation loop for ordinary scoped implementation. Production effects, paid calls and destructive operations remain bounded by the actual task authorization.
References
Checked 2026-10-25. Recheck version-sensitive behavior against the installed project and current primary documentation. These are methodological references, not endorsements.
Included files 1
SKILL.md