Identity resilience glossary
Known-good state
A known-good state is a previously recorded configuration that a team has checked against its security and operational requirements and considers suitable for recovery. In identity systems, this can include account settings, group memberships, access policies, and application relationships. A backup timestamp alone does not establish that the state is correct or free of unauthorized changes.
Why it matters during recovery
Recovering the most recent version can repeat the change that caused an incident. Choosing a much older version can remove legitimate changes made since then. A known-good state gives the team an evidence-based target. A reviewed configuration baseline can help establish that target, but it still needs to be checked against the current incident and business requirements.
An identity recovery example
Suppose an unexpected change to an Okta application's assignments prevents a support team from using it. The administrator compares versions, checks the change history and the approved access request, and identifies the intended assignments. That state is a recovery candidate. The team also checks whether later, authorized changes need to be preserved before validating access with an affected user.
Known-good does not mean proven clean
The term describes a judgment supported by evidence, not a guarantee. An attacker may have changed an environment before the incident was detected. A backup that predates the visible outage could still contain those changes. Backup integrity, correct configuration, and the absence of attacker persistence are different questions; a successful restore does not answer all three.
What to validate
Record why the selected state is trusted, which objects and relationships are in scope, and what checks are required before returning them to use. After a suspected compromise, recovery-point selection should follow the investigation and incident-response process. Validate the restored configuration and the affected business workflow before treating recovery as complete.