# Recovery Authorization

- Incident / case:
- Recovery stage:
- Requested start time (UTC):
- Service owner:
- Security approver:
- Business / safety approver where required:

## Readiness evidence

- Root cause or demonstrated attack path:
- Eradication evidence:
- Credential rotation status:
- Trusted build / restore source:
- Security validation completed:
- Business validation completed:
- Required dependencies available:

## Staged restoration

1. Read-only or lowest-impact capability:
2. Limited write capability:
3. Privileged or high-impact capability:

## Monitoring and rollback

- Enhanced monitoring signals:
- Observation window:
- Stop / rollback triggers:
- Last known-good state:
- Rollback procedure:
- Rollback owner and authority:

## Residual risk and decision

- Known residual risk:
- Accepted by:
- Decision: approved / conditionally approved / rejected
- Decision time (UTC):
- Conditions and next review: