Zero Security Theatre
Evidence library
These sources support or challenge the work. Each note says what the source can establish, and contrary evidence stays in the library.
Standard
NIST SP 800-61, computer security incident handling guide
The reference model behind the detection, containment, and recovery intervals this area measures.
Used by Attack-and-recovery engineering
Standard
NIST SP 800-34, contingency planning guide
Establishes recovery objectives as planning targets. This area asks for the demonstrated result beside the target.
Advisory
CISA Stop Ransomware guidance
Practical recovery material, including isolated backup guidance used in the restore experiments.