A recovery point is a saved state of data, a system, or a service that can be used to restore operations after disruption. In practice, it is the point in time to which an organization can roll back after ransomware, accidental deletion, corruption, or infrastructure failure. The age and integrity of that state matter: a recovery point that is too old, incomplete, or already contaminated may not provide a usable restore.
Recovery points are important because backups alone do not guarantee resilience. Defenders must verify that recovery points are preserved, isolated from attackers, and actually restorable within the needed timeframe. In ransomware incidents, attackers often try to delete or encrypt backups and restore data points, forcing victims to rebuild from older copies or unusable snapshots. Good defense means testing restore procedures, measuring recovery time, and confirming that the recovered systems are clean and consistent before bringing services back online.