Cyber Risk Mitigation, Controls, and Organizational Resilience
Frameworks and the control stack
Anchor programs in recognized frameworks: NIST Cybersecurity Framework (Govern, Identify, Protect, Detect, Respond, Recover), ISO/IEC 27001 for the management system, and the CIS Critical Security Controls for prioritized safeguards. Preventive controls include phishing-resistant MFA, vulnerability and patch management, asset inventory, least privilege and privileged access management, network segmentation, endpoint detection and response, email filtering, and hardened configuration-increasingly organized around zero trust. Detection and response depend on logging, monitoring, and a rehearsed incident response plan. Resilience depends on 3-2-1-1-0 backups (copies, media, offsite, one immutable or offline, zero restore errors), tested disaster recovery, defined recovery time and recovery point objectives, tabletop exercises, crisis communications, and alternate operations. Governance, board reporting, awareness training, third-party risk management, and control testing turn intent into evidence.
Traps
- Backups joined to the domain or reachable from production get encrypted alongside servers.
- Compliance is not security: a passed audit does not prove a control works under attack.
- Push-notification MFA can be fatigued; SMS codes can be SIM-swapped.
- Confusing RTO (time to restore service) with RPO (tolerable data loss), and assuming backups equal recovery.
Worked example and rule of thumb
Ransomware hits at 09:00 Monday. The last immutable backup is 02:00 Monday, so RPO is 7 hours. A tested restore of tier-one systems takes 30 hours against an RTO of 12 hours-an 18-hour gap. Remediation: more frequent replication plus a warm standby for critical systems. Rule of thumb: never accept an RTO you have not demonstrated in a timed test, and treat every untested backup as a hypothesis.