Rollback Plan
Definition
A documented procedure for reverting a recovery attempt if it fails or introduces new problems. A rollback plan specifies trigger conditions, the authority to invoke it, and the steps required to return to the previous state without additional data loss.
- Purpose
- Revert a failed or problematic recovery attempt
- Specifies
- Trigger conditions, invoking authority, revert steps
- Goal
- Return to previous state without additional data loss
- Phase
- Prepared before system recovery is executed
Common questions
Why does a rollback plan need pre-defined trigger conditions rather than an ad hoc judgement call?+
Deciding mid-recovery whether to abort wastes time and invites disagreement under pressure, so specifying trigger conditions in advance, such as a failed integrity check or a recurring error, lets the team act quickly and consistently when the threshold is met.
Who typically holds the authority to invoke a rollback during an active recovery?+
Usually a designated incident commander or recovery lead named in the plan, rather than the technician performing the recovery, so the decision to abort carries organisational authority and is not made unilaterally under time pressure.
What distinguishes a rollback plan from a general disaster recovery plan?+
A disaster recovery plan covers restoring service after an outage or attack broadly, while a rollback plan specifically addresses reversing a recovery step that has already been attempted and is making the situation worse.
Related terms
- Clean Baseline
- A confirmed, verified system state that predates the compromise and is free from attacker artefacts. Establishing a clean baseline is the starting...
- Dependency Mapping
- The process of identifying all services, systems, and data flows that a given system depends on, and all systems that depend on...
- Observation Window
- A defined period after a system is restored during which enhanced monitoring is applied before the system is declared fully recovered. The...
- Recovery Point Objective (RPO)
- The maximum acceptable amount of data loss measured in time. It defines how far back in time the organisation is willing to...
- Recovery Time Objective (RTO)
- The maximum acceptable duration of downtime before a system must be restored to service. RTO drives decisions about recovery method: a short...