A computer device, comprising: memory configured to store data and instructions; at least one processor configured to communicate with the memory; an operating system configured to communicate with the memory and the processor, wherein the operating system is operable to: receive an identification of at least one file, on the computer device impacted by a cyber threat; receive, from a data remedy manager, a last known good time stamp for the at least one file; transmit, to a remote backup provider associated with the at least one file, a restore request to restore the at least one file with restored content based at least on the last known good time stamp; and receive, from the remote backup provider, a restored file with the restored content; characterized in that: the cyber threat is identified in a process executing on the computer device, being identified by the data remedy manager monitoring the process; and the last known good time stamp identifies a point in time at which the process started prior to a determination of a first known malicious activity on the identified file, the first known malicious activity comprising any modification of content and/or restriction of access to the identified file. memory configured to store data and instructions; at least one processor configured to communicate with the memory; an operating system configured to communicate with the memory and the processor, wherein the operating system is operable to: receive an identification of at least one file, on the computer device impacted by a cyber threat; receive, from a data remedy manager, a last known good time stamp for the at least one file; transmit, to a remote backup provider associated with the at least one file, a restore request to restore the at least one file with restored content based at least on the last known good time stamp; and receive, from the remote backup provider, a restored file with the restored content; receive an identification of at least one file, on the computer device impacted by a cyber threat; receive, from a data remedy manager, a last known good time stamp for the at least one file; transmit, to a remote backup provider associated with the at least one file, a restore request to restore the at least one file with restored content based at least on the last known good time stamp; and receive, from the remote backup provider, a restored file with the restored content; characterized in that: the cyber threat is identified in a process executing on the computer device, being identified by the data remedy manager monitoring the process; and the last known good time stamp identifies a point in time at which the process started prior to a determination of a first known malicious activity on the identified file, the first known malicious activity comprising any modification of content and/or restriction of access to the identified file. the cyber threat is identified in a process executing on the computer device, being identified by the data remedy manager monitoring the process; and the last known good time stamp identifies a point in time at which the process started prior to a determination of a first known malicious activity on the identified file, the first known malicious activity comprising any modification of content and/or restriction of access to the identified file.