CCRTS study guide
CCRTS · Work through your exam, one topic at a time.
The Certified Cyber Resilience and Recovery Specialist (CCRTS) is a vendor-neutral credential aimed at practitioners who are responsible not just for keeping attackers out, but for keeping the business running and getting data back when prevention fails. Typical candidates are incident responders, disaster recovery and business continuity coordinators, backup and storage administrators, SOC leads moving into resilience roles, and risk or governance staff who own recovery objectives. The CCRTS study guide has 9 sections and about 3,532 words.
01Cyber Resilience Strategy, Governance, and Risk
The exam tests whether you can connect business risk appetite to resilience objectives and show who owns each decision. Cyber resilience is the ability to anticipate, withstand, recover from, and adapt to adverse conditions.
411 words, about 2 min02Business Impact Analysis and Recovery Objectives (RTO/RPO)
The exam tests whether you can derive RTO and RPO from business impact rather than from infrastructure convenience. A BIA identifies critical business functions, the impact of disruption over time, dependencies, and the maximum tolerable downtime (MTD or MTPD).
436 words, about 2 min03Backup, Replication, and Immutable Data Protection
The exam tests whether you can design backup and replication that survive the same attack that destroys production. The baseline rule is 3-2-1-1-0: at least three copies, on two media types, one offsite, one immutable or offline, and zero unverified restores.
410 words, about 2 min04Incident Response and Crisis Management
The exam tests whether you can run incident response as a disciplined lifecycle while a crisis team manages business, legal, and communication decisions. NIST SP 800-61 describes preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity.
378 words, about 2 min05Disaster Recovery Planning and Alternate Operations
The exam tests whether you can turn BIA outputs into a DR plan and alternate operating model. A DR plan covers the recovery of technology and data; business continuity covers the continued delivery of products and services, often through manual workarounds.
365 words, about 2 min06Ransomware and Destructive Attack Resilience
The exam tests whether you can design resilience against ransomware and destructive attacks that deliberately disable recovery. Ransomware commonly gains initial access through phishing, exposed services, or stolen credentials, then escalates privileges, moves laterally, steals data, and encrypts.
393 words, about 2 min07Supply Chain, Third-Party, and Cloud Resilience
The exam tests whether you can manage dependence on suppliers, cloud providers, and fourth parties. Outsourcing does not outsource accountability.
386 words, about 2 min08Testing, Exercising, and Continuous Improvement
The exam tests whether you can design a risk-based testing and exercise program that produces evidence and improvement. Testing ranges from plan review and tabletop exercises to walkthroughs, simulations, parallel processing, and full failover or cutover.
382 words, about 2 min09Recovery Validation, Forensics, and Post-Incident Review
The exam tests whether you can validate that restored services are trustworthy and capture lessons without destroying evidence. Recovery validation goes beyond systems being up.
371 words, about 2 min