CCRTS study plan

Map the CCRTS resilience strategy lifecycle (anticipate, withstand, recover, adapt) to your own organization's current governance structure and identify three explicit gaps

Draft a one-page risk appetite statement covering RTO/RPO tolerance, data protection, and third-party exposure, with named accountable owners

Compare at least four recognized control frameworks (NIST CSF 2.0, ISO 22301, NIST SP 800-53, CIS Controls v8) and select the primary framework you will use for the rest of the plan

Define the governance cadence: who approves resilience policy, how exceptions are tracked, and how risk register entries are reviewed and closed

Build an incident severity matrix (SEV1-SEV4) with objective escalation triggers tied to business impact, not technical symptoms alone

Define the crisis management team structure, decision authority, and communication cadence for each severity level

Draft internal and external notification templates covering regulators, customers, and executives, with pre-approved legal and PR review paths

Walk through a tabletop scenario (credential compromise leading to data exfiltration) and record where the escalation path breaks down

Inventory all business processes and rank them into Tier 1-3 criticality using revenue impact, regulatory obligation, and safety criteria

Conduct a business impact analysis for the top five Tier 1 processes, capturing maximum tolerable downtime, financial loss per hour, and dependencies

Derive and document RTO and RPO for each Tier 1 process, and reconcile them against current technical recovery capability

Quantify the gap between required and achievable recovery objectives and present the delta as a prioritized remediation list

Design a 3-2-1-1-0 backup architecture (three copies, two media, one offsite, one immutable, zero unverified restores) mapped to each Tier 1 system's RPO

Select and justify immutability mechanisms (object lock, WORM, air-gapped vault) and define retention periods aligned to legal and regulatory requirements

Model a destructive ransomware attack against the backup estate and identify single points of failure in credential, network, and management-plane paths

Define backup integrity verification cadence and the pass/fail criteria that gate a backup as 'recoverable'

Write recovery runbooks for the top three Tier 1 systems, sequencing dependencies and naming decision points and rollback criteria

Define alternate operating procedures for a 30-day loss of primary site, including manual workarounds and minimum viable service levels

Establish the DR invocation criteria and the authority chain for declaring a disaster

Reconcile DR plan assumptions against the BIA outputs from week 3 and correct any mismatched RTO or RPO commitments

Build a ransomware-specific response playbook covering containment, forensic preservation, negotiation policy, and backup isolation decisions

Define the destructive-attack recovery sequence: what is restored first, how restoration integrity is proven, and how re-infection is prevented

Integrate the ransomware playbook into the general incident response plan from week 2 and resolve conflicts in escalation and communication

Run a 90-minute tabletop simulating ransomware with backup compromise and document decision latency and authority confusion

Inventory third-party and cloud dependencies for Tier 1 processes and classify each by criticality, data sensitivity, and exit difficulty

Draft resilience clauses for critical contracts covering RTO/RPO commitments, breach notification timelines, audit rights, and data return or destruction on exit

Design an annual exercise calendar covering tabletop, component failover, full DR, and backup restore tests, with scope, participants, and success criteria

Execute one backup restore test for a Tier 1 system and record actual restore time against the stated RTO

Define recovery validation criteria: how you prove data integrity, application function, and business process resumption before declaring recovery complete

Build a post-incident review process with a blameless format, evidence retention rules, and a tracking mechanism for corrective actions to closure

Consolidate all prior deliverables into a single resilience program document set and cross-check for contradictions in RTO, RPO, and escalation paths

Complete a 60-question timed practice assessment across all nine domains and analyze wrong answers by domain to build a final review list