Objectives: To understand of data provenance applications towards cyber security for disaster recovery. To design an attack scenario with appropriate use cases using unified modeling language. To construct and analyze the data collected in the selected private computer network using appropriate graphical representation and comparing variables with null hypothesis. Methods: In the existing methods, presence of provenance data is not available with respect to network attack scenarios of risk management. Information security deals about disaster recovery in the form of business continuity planning, however nowhere it specifies about genesis data and its lineage. We propose a methodology for trouble shooting issues concerning over cyber physical systems in private networks. Findings: The process of resolving problems is linked with risk management for fairer and guaranteed continued communication as usual. Identity of the systems and users are considered random variables to understand the association between them. These random variables are picked from the provenance data maintained at the administrator login of a specific private network. This association analysis is unique and provides appropriate outcomes for good decision-making at the time of attack scenarios in risk management. Novelty: Simulations and their results are represented to show the correlation between risk management and data provenance in the cyber world. The uniqueness and novelty lies in design part of the problem statement with regards to provenance and disaster recovery for computer networks.