Clean Baseline
Definition
A confirmed, verified system state that predates the compromise and is free from attacker artefacts. Establishing a clean baseline is the starting point of any recovery. It may come from a validated backup, a golden image, or a rebuilt system configured from source.
- Role
- Trusted starting point for system recovery
- Sources
- Validated backup, golden image, rebuild from source
- Requirement
- Confirmed free of attacker artefacts
- Used in
- Post-incident system restoration
Common questions
How is a backup confirmed clean before it is used as a baseline?+
Responders check the backup timestamp against the earliest known indicator of compromise, scan its contents for known malware or persistence artefacts, and where possible restore it in an isolated environment for verification before it touches production.
What happens if no clean backup exists?+
Responders fall back to a golden image or rebuild the system from vendor-supplied source, then reapply only verified configuration and data, since restoring from an unverified or compromised backup can reintroduce the same foothold the attacker used.
Related terms
- Dependency Mapping
- The process of identifying all services, systems, and data flows that a given system depends on, and all systems that depend on...
- Observation Window
- A defined period after a system is restored during which enhanced monitoring is applied before the system is declared fully recovered. The...
- Recovery Point Objective (RPO)
- The maximum acceptable amount of data loss measured in time. It defines how far back in time the organisation is willing to...
- Recovery Time Objective (RTO)
- The maximum acceptable duration of downtime before a system must be restored to service. RTO drives decisions about recovery method: a short...
- Rollback Plan
- A documented procedure for reverting a recovery attempt if it fails or introduces new problems. A rollback plan specifies trigger conditions, the...