# In what order should systems be restored after an attack?

Restore the foundations first, then what the business needs most, then the rest. A typical order: the network and security basics, such as firewall, switches, DNS, DHCP and the monitoring you will rely on; identity, meaning the domain controllers or cloud identity, rebuilt or verified clean, since every other system depends on it; the backup infrastructure itself; then the business-critical applications in the priority you decided in advance, for example order processing, production control or payroll; and finally ordinary file shares, workstations and less important services. Each step should include verification before the next begins. The order belongs in your recovery plan, agreed with management before any incident, together with the recovery time each system may take. Without that agreement, the first days after an attack turn into arguments about whose system matters most, while the clock is running.

FAQ: [Backups and recovery](https://netsenx.com/en/faq/backups) · https://netsenx.com/en/faq/in-what-order-should-systems-be-restored

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [What are RPO and RTO?](https://netsenx.com/en/faq/what-are-rpo-and-rto)
- [Is cloud file sync, such as OneDrive or Dropbox, a backup?](https://netsenx.com/en/faq/is-cloud-file-sync-a-backup)
- [Do we need to back up Microsoft 365 and other SaaS data?](https://netsenx.com/en/faq/do-we-need-to-back-up-microsoft-365-and-other-saas-data)
- [Should the backup system have separate admin accounts?](https://netsenx.com/en/faq/should-backup-admin-accounts-be-separate)
- [How long should we keep backups?](https://netsenx.com/en/faq/how-long-should-backups-be-kept)