Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Resilience and recovery

Business continuity and disaster recovery: agreeing recovery targets with the business, keeping sites and teams running, failing over and back, proving you can restore, and limiting the damage when something fails.

The packs behind these answers

How do we…

Methods: how a thing is done well.

  1. How do we know our backups will actually restore?
  2. How do we agree recovery time and data-loss targets with the business?
  3. How do we limit the damage a faulty security-agent update can do?
  4. How do we plan recovery from a destructive cyberattack, and how is it different from disaster recovery?
  5. How do we find the dependencies that decide whether a service can meet its recovery time?
  6. How do we choose which backup to restore from after a cyberattack?
  7. How do we recover when the attacker may control our sign-in directory?
  8. How do we decide what to back up, how often and for how long?
  9. How do we choose which restore tests to run, and how often, for each system?
  10. How do we protect data in a cloud or software-as-a-service system when the provider does not back it up?
  11. How do we show an auditor or an insurer that our backups restore?
  12. How do we run a business impact analysis that the business owns, process by process?
  13. How do we write a continuity plan a site or department can use when the systems are down?
  14. How do we test disaster recovery without causing the outage we are testing for?
  15. How do we put a HIPAA contingency plan in place?

When do we…

Triggers and timing: when something has to happen.

  1. When do we test recovery, and how much testing is enough?
  2. When do we declare a disaster and invoke the continuity plans?
  3. When do we fail over to a second site or region, and when do we fail back?
  4. When do we tell staff and customers about an outage, and what do we say?

Who decides…

Authority: who may approve, accept or act.

  1. Who decides what during a crisis, and who stands in when they cannot?

If…, then how…

Situations: something has happened, what now.

  1. If backups can be reached with production administrator credentials, then what?
  2. If a critical supplier's recovery time is longer than our service can wait, then what do we do?
  3. If a service cannot be back within its recovery time, how do we keep the business running?
  4. If a backup job fails, then what do we do, and by when?
  5. If a restore test misses the recovery time or loses too much data, then what do we do?
  6. If we lose the key or the console password for our backups, then how do we get in?
  7. If we lose a building or a large part of a team at once, how do we keep critical services running?
  8. If a customer wants availability in our SOC 2 report, what must we show about recovery?

Other categories