Dependency Mapping
Definition
The process of identifying all services, systems, and data flows that a given system depends on, and all systems that depend on it. Dependency mapping determines the order in which systems must be restored to avoid cascading failures or propagating residual compromise.
- Domain
- Incident response / recovery planning
- Covers
- Upstream and downstream system relationships
- Purpose
- Determine safe restoration order
- Prevents
- Cascading failure or re-spreading compromise
Common questions
Why is dependency mapping done before restoring systems after an incident?+
Restoring a system that depends on another still-compromised or unverified system risks reinfection or propagating the attacker's foothold. Mapping dependencies first lets responders restore in an order where each system's prerequisites are already clean and trusted.
Is dependency mapping a one-time exercise or ongoing?+
Effective response teams maintain an up-to-date map before an incident occurs, since building it from scratch during active response is slow and error-prone; incident response plans typically call for it to be refreshed periodically.
Related terms
- Clean Baseline
- A confirmed, verified system state that predates the compromise and is free from attacker artefacts. Establishing a clean baseline is the starting...
- Observation Window
- A defined period after a system is restored during which enhanced monitoring is applied before the system is declared fully recovered. The...
- Recovery Point Objective (RPO)
- The maximum acceptable amount of data loss measured in time. It defines how far back in time the organisation is willing to...
- Recovery Time Objective (RTO)
- The maximum acceptable duration of downtime before a system must be restored to service. RTO drives decisions about recovery method: a short...
- Rollback Plan
- A documented procedure for reverting a recovery attempt if it fails or introduces new problems. A rollback plan specifies trigger conditions, the...