CCRTS key terms

The ability of an organization to anticipate, withstand, absorb, recover from, and adapt to cyber incidents and disruptive events while maintaining its critical business functions at acceptable levels of service.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed as a statement that guides decisions about resilience investments, controls, and residual risk acceptance.

The risk that remains after controls, mitigations, and recovery capabilities have been applied, and which leadership must formally accept, transfer, or further reduce.

A structured log of identified risks, each with an owner, likelihood and impact rating, treatment plan, and status, used to track resilience exposures and confirm remediation progress over time.

A structured analysis that identifies critical business processes, their dependencies, and the financial, operational, regulatory, and reputational consequences of disruption over time, producing the recovery objectives that drive recovery planning.

The target maximum time allowed to restore a process or system after disruption before the impact becomes unacceptable, expressed as a duration measured from the declared outage.

The maximum acceptable amount of data, measured as time, that may be lost in a disruption, which sets how frequently backups or replication must occur.

The longest period a business process can be unavailable before the organization suffers unacceptable harm; RTOs for supporting systems must fit inside this outer limit.

A process, service, or dependency whose failure within the maximum tolerable downtime would cause severe harm to safety, revenue, legal obligations, or reputation, and which therefore receives prioritized recovery.

The practice of documenting how applications, data, infrastructure, suppliers, and people rely on one another, so recovery sequencing reflects real upstream and downstream relationships rather than assumptions.

The scheduled period during which backup jobs must complete without degrading production performance, a constraint that shapes backup type, frequency, and achievable recovery point objectives.

A backup that captures only data changed since the last backup of any type, reducing storage and time but requiring a chain of restore points to recover.

A backup capturing all changes since the last full backup, which grows larger over time but needs only the latest full plus the latest differential to restore.

A full backup image assembled from an existing full backup plus subsequent incremental backups without re-reading source data, reducing production load while simplifying restore.

A backup copy that cannot be altered or deleted by any user, including administrators, for a defined retention period, typically enforced through object lock or write-once storage.

A copy of data stored on media physically or logically isolated from production and management networks, so destructive malware or compromised credentials cannot reach it.

A backup design guideline calling for three copies of data, on two media types, with one copy offsite, one copy offline or immutable, and zero errors verified through restore testing.

Continuous or scheduled copying of data or workloads to a secondary location or system, supporting low recovery point objectives but offering no protection if the replica is reachable and corrupted.

A documented set of roles, phases, communication paths, and decision authorities that guides an organization from detection through containment, eradication, recovery, and closure of a security incident.

A predefined scale that maps observable incident characteristics to escalation levels, response timelines, notification duties, and the authority required to declare a crisis.

Actions taken to limit the spread and impact of an incident, such as isolating hosts, disabling accounts, or segmenting networks, balanced against preserving evidence and keeping business running.

The phase in which the root cause and all malicious artifacts, persistence mechanisms, and compromised credentials are removed before restoration of trusted systems begins.

A cross-functional group with defined authority that coordinates strategic decisions, executive communications, and resource allocation during incidents that exceed routine operational response.

Prepared messaging, approval paths, and channels for informing employees, customers, regulators, and media during a disruption, including holding statements and single-spokesperson discipline.

A legal or contractual duty to inform regulators, affected individuals, or partners within a specified period after discovering a breach or reportable disruption, often with content requirements.

Documented procedures, roles, and technical steps for restoring IT infrastructure, data, and applications at an alternate site or platform within the recovery objectives set by the business impact analysis.

A standby facility or cloud environment used to run critical systems when the primary site is unavailable, categorized by readiness as hot, warm, or cold depending on pre-provisioned capability.

The process of shifting workloads to a standby system, site, or region, which may be automatic or manual, and which must be validated to confirm the standby can carry production load.

The controlled return of workloads from a standby environment to the primary environment after it is repaired and validated, often the most error-prone phase of recovery.

Malicious software that encrypts or exfiltrates data and demands payment, increasingly combining encryption with data theft and public leak threats to pressure victims.

A ransomware tactic in which attackers steal sensitive data before encrypting systems, then threaten public release to pressure payment even when reliable backups exist.

Unauthorized transfer of data out of an environment, which may occur before encryption and which drives privacy breach obligations independent of whether systems are restored.

A rehearsed decision guide covering detection, isolation, backup integrity checks, negotiation and payment policy, legal and insurer engagement, and staged restoration priorities.

The process of assessing, contracting with, monitoring, and offboarding suppliers and service providers based on the resilience risk they introduce to critical business functions.

Exposure created when many critical services depend on the same provider, region, or technology, so a single failure produces correlated, organization-wide disruption.

A contractual clause granting the customer the ability to examine a provider's controls, reports, or evidence, or to accept recognized independent attestations in lieu of direct audits.

The division of security and resilience duties between a cloud provider and its customer, where the provider secures the platform and the customer secures data, identities, and configuration.

A discussion-based exercise in which participants walk through a simulated scenario against the plan, revealing decision gaps, role confusion, and unrealistic assumptions without disrupting production.

An exercise that actually activates systems, communications, or recovery procedures, such as failing over a workload or invoking the call tree, to test capability rather than discussion.

Periodic verification that backup data can actually be restored within the recovery time objective, including integrity checks, application consistency, and confirmation of usable output.

A structured review after an exercise or incident that records what worked, what failed, and the corrective actions assigned with owners and due dates, feeding continuous improvement.

Evidence-based confirmation that restored systems, data, and integrations meet integrity, security, and performance expectations before returning to production and declaring the incident closed.

A bit-for-bit copy of storage media or memory captured with documented integrity hashes, preserving evidence for investigation and legal proceedings without altering the original.

A documented, unbroken record of who collected, handled, and stored evidence and when, required for the evidence to be admissible and defensible in legal or regulatory proceedings.

A structured method for determining the underlying conditions that allowed an incident, used to prevent recurrence rather than merely to describe the immediate trigger.

A formal document summarizing an incident or exercise timeline, impact, response effectiveness, and prioritized corrective actions with owners and deadlines.

Any component, supplier, person, or dependency whose failure alone can interrupt a critical function, which resilience design seeks to identify and eliminate or mitigate.