Cyber Resilience Starts with Planning for Recovery

Prevention will never be perfect. Resilient organizations assume an incident will happen and prepare to withstand it, respond quickly and recover with confidence.

For years, security strategy focused almost entirely on keeping attackers out. That work remains essential, but it is no longer sufficient. Ransomware, supply-chain compromise and insider threats mean every organization should plan for the day a control fails. Cyber resilience is the ability to anticipate, withstand, respond to and recover from that day.

The resilience lifecycle

• Anticipate: understand your critical services, their dependencies and the threats most likely to affect them.
• Prevent: apply layered controls aligned to those risks.
• Detect: ensure you can see an incident early, across identity, endpoint, network, cloud and data.
• Respond: have a tested plan, clear roles and pre-agreed decision rights.
• Recover: restore services from trusted, isolated backups within agreed timeframes.
• Improve: feed every incident and exercise back into the programme.

Recovery is where plans are proven

Many organizations discover during an incident that their backups were reachable by the attacker, that restoration takes far longer than expected, or that nobody is sure which systems to bring back first. These are planning problems, and they can be solved before a crisis.

A backup you have never restored is a hope, not a recovery plan.

Five questions to ask this quarter

• Which business services matter most, and how long can each be unavailable?
• Are critical backups immutable or isolated from the production environment?
• When did we last perform a full restoration test, and how long did it take?
• Does our incident response plan include legal, communications and executive roles?
• Have we run a tabletop exercise against a realistic ransomware scenario?

Resilience is not a single project. It is an operating model that connects risk management, security controls, response planning and recovery — and keeps improving as the business and the threat landscape change.