Recovery Rate

Overview

The metric can be based on count, monetary value, data volume, service capability, or eligible cases. A custody incident may report recovered asset value, while an account program may measure users who regain verified access within a set period.

Results are not comparable without the denominator, recovery window, valuation date, and definition of success. Excluding permanently lost cases or counting partial access as full recovery can inflate performance. High recovery can also require excessive time, cost, risk, or manual intervention.

Teams should define eligible scope before measurement and segment outcomes by cause, wallet type, asset, network, provider, and recovery path. Complementary metrics include time to recovery, unrecovered value, data loss, cost, repeat failure, and customer impact. Final results should reconcile to verified records rather than self-reported completion.

The scope of Recovery Rate should identify the protected wallet, key, account, service, or business process; the triggering failure; who may declare the incident; which identity and entitlement evidence is required; and the recovery point and recovery time objectives that govern restoration.

For Recovery Rate, important risks include fraudulent recovery requests, guardian collusion, unavailable shares, outdated backups, compromised cloud accounts, missing derivation metadata, untested procedures, and simultaneous loss of primary and backup systems. For Recovery Rate, independent storage and periodic exercises reduce correlated failure but introduce their own custody obligations.

A controlled Recovery Rate process moves through detection, containment, claimant verification, approval, restoration, validation, credential or guardian replacement, reconciliation, and closure. For Recovery Rate, emergency access should be time-limited and should not silently weaken the authorization policy used during normal operation.