Security controls reduce the likelihood of a successful cyber attack, and a well-defended organisation can still suffer one. Recovery capability shapes how long an incident disrupts customers, revenue and regulatory standing. Regulators in the UK and EU now ask organisations to plan for serious disruption and to show they can continue or restore their most important services within limits they have set in advance. Boards can apply the same discipline to cyber risk across the whole organisation.
Planning on the basis that disruption can occur
Several regimes already frame resilience this way. The Financial Conduct Authority and the Prudential Regulation Authority require in-scope financial firms to identify their important business services, set a maximum tolerable level of disruption for each, and be able to remain within those limits in a severe but plausible scenario. Firms had to be able to do so by 31 March 2025.
NIS2 includes business continuity, backup management, disaster recovery and crisis management among the cybersecurity risk-management measures that essential and important entities must take, and requires their management bodies to approve and oversee those measures. DORA requires financial entities in the EU to maintain ICT business continuity and recovery plans and to test their digital operational resilience. The NCSC's Cyber Assessment Framework, used by UK regulators of essential services, includes minimising the impact of incidents as one of its four objectives.
For an organisation outside these regimes, the same approach gives the board a practical way to judge whether its cyber investment matches the disruption it could face.
Starting from the services the business must keep running
Resilience planning starts with the services whose disruption would cause the greatest harm to customers, the organisation's finances or its obligations to regulators. For each one, the board can agree how long the organisation could tolerate it being unavailable, and how much data it could afford to lose. Financial regulators call the first of these an impact tolerance.
These limits turn a general aim into something management can design and test against. They also show where investment is most needed, because the services with the shortest tolerance and the weakest recovery capability carry the greatest exposure.
Designing systems so they can be restored
The ability to recover depends on decisions made before an incident. Backups that are separated from the main network, so that an attacker with access to live systems cannot alter or delete them, give the organisation a clean point to restore from. Dividing the network so that critical systems are isolated from each other can limit how far an attack spreads. Documented procedures for rebuilding core systems, including identity and access services that other systems depend on, can shorten recovery once the attacker has been removed.
Where an organisation runs services across cloud providers and its own data centres, each environment needs its own recovery arrangements and a clear understanding of which services depend on which. A service that appears to run in the cloud may rely on an on-premises system for login or data, and that dependency can determine how quickly it comes back.
Including suppliers, cloud services and remote working
The services the board cares about can depend on organisations and systems outside the organisation's direct control. These include cloud providers, software suppliers, managed service providers, outsourced operations and the devices staff use to work remotely. A disruption at any of these can stop an important service as effectively as an attack on the organisation's own network.
Mapping these dependencies for each important service shows where a supplier's outage would breach a tolerance and where the organisation has no alternative. Contracts with critical suppliers can set expectations for incident notification, recovery times and cooperation during an incident. NIS2 lists supply chain security among the required risk-management measures, and DORA sets specific requirements for managing ICT third-party risk.
Testing and improving the plan
Exercises show whether a plan works. Testing recovery from backup shows how long restoration takes in practice and whether it meets the agreed tolerance. Scenario exercises involving senior leadership show whether decisions on shutting down systems, communicating with customers and notifying regulators can be made quickly enough. The NCSC's Exercise in a Box provides free scenarios that organisations can use for this purpose.
Each exercise and each real incident produces findings. Where management tracks those findings to completion and reports on them, the board can see whether the organisation's ability to recover is improving over time.
Questions for the board
- Which services would cause the greatest harm if disrupted, and how long could we tolerate each being unavailable?
- For each of those services, how long would recovery take today, and what evidence supports that estimate?
- Are our backups of critical data separated from the main network, and when were they last restored in a test?
- Which suppliers, cloud services and remote working arrangements do our most important services depend on?
- Where would a supplier's outage take us beyond our tolerance, and what would we do?
- When did the board last take part in a cyber incident exercise, and what changed as a result?
- How are findings from exercises and incidents tracked, and who reports progress to us?
A Cyber Resilience Executive Exercise tests how executives decide, escalate and communicate in a scenario built around the organisation's critical services, and ends in an improvement plan the management body can act on.
References
- Financial Conduct Authority, "PS21/3: Building operational resilience", March 2021.
- Prudential Regulation Authority, "SS1/21: Operational resilience: impact tolerances for important business services", March 2021.
- DWF, "Operational resilience", September 2024.
- European Parliament and Council, Directive (EU) 2022/2555 (NIS2), 14 December 2022.
- European Parliament and Council, Regulation (EU) 2022/2554 (Digital Operational Resilience Act), 14 December 2022.
- National Cyber Security Centre, "Cyber Assessment Framework".
- National Cyber Security Centre, "Exercise in a Box".
- National Cyber Security Centre, "Offline backups in an online world".