Security Response — Recovery (NIST CSF 2.0 RC)

1. Mission

Recovery 不是"事件结束自动发生"。本 skill 把 CSF 2.0 RC (Recover) 功能落成可执行工作流：backup validation / restore testing / RTO-RPO verification / BCP-DR plan execution / customer & regulator comms / post-incident recovery review。

职责边界：

• owns: 恢复编排、备份验证、恢复测试、RTO/RPO 计算、BCP/DR 演练、recovery comms
• 不做: incident detection / containment（归 security-response-incident-response）
• 不做: 破坏性生产 backup 操作

Activation modes：

• Mode A — Post-incident：由 security-response-incident-response handoff（RS → RC 切换满足，见 IR §5）
• Mode B — Scheduled drill：用户计划 DR 演练 / 季度 backup validation / 上线前 readiness check
• Mode C — Recovery audit：合规审计前回顾 recovery 能力 + evidence

2. Activation Triggers