Strategy, Governance and Training
Business Continuity and Disaster Recovery Security
We assess whether your recovery plan works if backups and identity systems are also compromised in a cyberattack. We define the recovery order of critical processes and their dependencies.
What it is
Traditional disaster recovery plans typically assume data center loss or hardware failure. In attacks like ransomware, domain controllers and backup servers may also be targeted. This work examines where the plan should start in such conditions and which dependencies must be restored first. Recovery time objective (RTO) and recovery point objective (RPO) are reassessed for this scenario.
Scope
- Dependency map of critical processes and supporting systems
- Placement of domain, DNS and identity systems in the recovery order
- Administrative access to backup infrastructure and its separation from production network
- Plan for rebuilding in a clean environment
- Review of RTO and RPO targets for a cyberattack scenario
The need
When organizations need it
- When your recovery plan has never been tested against a cyberattack scenario.
- In financial services, when the annual test of business continuity plans is approaching. DORA, for example, requires ICT business continuity plans to be tested at least yearly.
- When the board asks how long business would take to resume after a ransomware attack.
Method
How we work
-
Dependencies
We map application, data, infrastructure and identity dependencies starting from critical processes.
-
Scenario
We develop an attack scenario that also affects backups and identity systems.
-
Walkthrough
We walk through the plan step by step with relevant teams and identify broken links.
-
Improvement
We update the recovery order, backup architecture and RTO/RPO targets with you.
Outcome
What you have at the end
You receive a recovery order and dependency map that are valid in a cyberattack scenario. Broken links in the plan become actionable fixes with assigned owners.
Frequently asked questions
Isn't having backups enough?
Recovery stops if backups are accessible to an attacker or if restore depends on identity systems that are down. This work checks whether backups are usable under attack conditions.
Do we need ISO 22301 certification?
No. ISO 22301 provides a framework for business continuity management. The work can be done without aiming for certification, but supports preparation if certification is your goal.
Does this work include an actual restore?
This work reviews the plan and architecture. To measure actual restore times, it can be combined with Backup Restore Testing.
Strategy, Governance and Training
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting