Establishing Business Resilience and Digital and Cyber Resilience Management Practices
What this domain tests
This domain tests the practical integration of business continuity, technology resilience, and cyber resilience so that IBS remain within tolerance during outages, ransomware, data corruption, and infrastructure failure.
Core rules
- Start from the BIA: identify time-critical activities, dependencies, minimum service levels, and recovery sequences. RTO and RPO are recovery targets that must be consistent with impact tolerances.
- Design recovery for the worst credible loss of a resource, not just a single server. Test failover, data restoration, manual workarounds, and communication.
- Cyber resilience adds prevention, detection, response, and recovery: segmentation, identity controls, logging, incident response playbooks, forensic readiness, and immutable backups tested for restoration.
- Technology resilience covers change control, capacity, observability, resilience patterns, and exit from obsolete platforms.
- Crisis management must connect technical recovery to business decisions, customer harm, regulatory notification, and communications.
Worked example
A ransomware attack encrypts a core banking platform. The impact tolerance for account access is four hours. The team isolates the network, invokes the playbook, and restores from an immutable backup. Restoration takes six hours because the backup was never timed end-to-end. The tolerance is breached. The lesson is to measure restoration time in a realistic exercise, not to assume backup success equals service recovery.
Traps
- Treating BCP as a document rather than tested capability.
- Assuming backups are recoverable without restoration tests.
- Making cyber an IT-only matter with no business service owner.
- Testing failover without testing failback and data integrity.
- Ignoring manual workarounds and customer communication.
- Forgetting that recovery sequencing can create new single points of failure.