Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Resilience and recovery

Proving you can restore, agreeing recovery targets with the business, and limiting the damage when something fails.

The packs behind these answers

How do we…

Methods: how a thing is done well.

  1. How do we know our backups will actually restore?
  2. How do we agree recovery time and data-loss targets with the business?
  3. How do we plan recovery from a destructive cyberattack, and how is it different from disaster recovery?
  4. How do we find the dependencies that decide whether a service can meet its recovery time?
  5. How do we choose which backup to restore from after a cyberattack?
  6. How do we recover when the attacker may control our sign-in directory?
  7. How do we decide what to back up, how often and for how long?
  8. How do we choose which restore tests to run, and how often, for each system?
  9. How do we protect data in a cloud or software-as-a-service system when the provider does not back it up?
  10. How do we show an auditor or an insurer that our backups restore?

When do we…

Triggers and timing: when something has to happen.

  1. When do we test recovery, and how much testing is enough?

Who decides…

Authority: who may approve, accept or act.

  1. Who decides what during a crisis, and who stands in when they cannot?

If…, then how…

Situations: something has happened, what now.

  1. If backups can be reached with production administrator credentials, then what?
  2. If a critical supplier's recovery time is longer than our service can wait, then what do we do?
  3. If a service cannot be back within its recovery time, how do we keep the business running?
  4. If a backup job fails, then what do we do, and by when?
  5. If a restore test misses the recovery time or loses too much data, then what do we do?
  6. If we lose the key or the console password for our backups, then how do we get in?

Other categories