How to build cyber resilience

Start with an honest assessment of where your current controls succeed and where they leave you exposed. Map your existing security stack against a recognized framework like the NIST Cybersecurity Framework (CSF) 2.0 or the CIS Controls, then evaluate your recovery capabilities using CISA's Cyber Resilience Review (CRR). The output tells you which risks your program addresses today, which it addresses partially, and which fall outside your current scope.

Two questions guide the assessment:

1. If attackers reached your production data tonight, what would you lose access to and for how long? 
2. How much of that answer comes from tested capabilities versus assumptions about how your tools would perform under pressure? 

The difference between the two shows you where to focus.

Cyber resilience investments pay off most when they protect the data and systems that keep your business running. Work with business owners to inventory the applications, datasets, and services that generate revenue, hold regulated information, or support operations customers depend on. Categorize each by recovery time objective and recovery point objective, then verify those numbers reflect current business requirements rather than targets set years ago.

The exercise also surfaces dependencies. A customer-facing application often relies on identity services, DNS, and shared databases that need to recover in a specific order. Document those relationships now, before an incident forces your team to reconstruct them under pressure.

Harden your backup infrastructure with immutability, strong access controls, and isolation from your production network. Attackers frequently target backups because compromising them can eliminate a reliable recovery option. Immutability guarantees that once a backup lands in storage, no user or process can modify or delete it during its retention period.

Strong access controls add:

• Multi-factor authentication for administrative operations
• Role separation between backup admins and security teams
• Quorum approval for destructive actions like retention changes or deletions

Physical and logical isolation contribute another layer. Keep an air-gapped or logically isolated copy of your most critical data in a location that requires separate credentials to access. 

Cohesity DataProtect includes native immutability and access controls and integrates with Cohesity cyber vaulting capabilities for additional isolation.

Threat detection needs coverage across your production environment and your backup infrastructure. Attackers frequently compromise systems weeks before triggering ransomware, and they often touch backup data during that dwell time. 

Extend behavioral monitoring and anomaly detection into your backup platform. Watch for unusual patterns like sudden encryption of large datasets, spikes in change rates, or credential use outside normal working hours. Feed those signals into your SOC alongside production telemetry so analysts see the full picture of an attacker's movement.

Recovery capabilities only count when you can prove they work at the scale and speed your business requires. Design your recovery architecture to restore applications and data in the order your dependency map calls for, at rates that meet your RTOs. Include options for clean-room recovery where you validate data integrity in an isolated environment before returning workloads to production.

Test these capabilities regularly. Run full application recovery drills, simulate destructive events across multiple systems, and measure your team's performance against the RTOs you committed to. Each exercise surfaces workflow problems and tooling limitations you can address before an incident forces the issue.

Establish incident response readiness by documenting decision ownership and rehearsing the plan with the people who will execute it. Write down who owns each decision during a cyber event, from isolating infected systems to notifying regulators. Include contact information and escalation paths for weekends, holidays, and situations where primary responders are unreachable.

Run tabletop exercises quarterly with the executives, technical leads, and legal and communications partners who will operate the plan in a real event. Use realistic scenarios drawn from current threat intelligence, and capture the questions and decisions your team struggled with. Update the plan based on what you learn, and refresh it whenever your environment, staff, or business priorities change.

Cyber resilience improves when you measure it against consistent metrics and act on the results. Track:

• Recovery time performance across your tests
• Mean time to detect and respond during real events
• Coverage of your critical systems by backup and detection controls
• Results of your last full recovery drill

Report these numbers to leadership on a regular cadence. Consistent visibility keeps resilience on the executive agenda.

Feed what you learn back into the earlier steps. When the business changes, your critical system inventory should change with it. New attack paths surface in threat intelligence regularly, and hardening against them before an incident forces the issue is what keeps your posture ahead of attackers. Testing should also expand into scenarios your team has not yet rehearsed. Resilience matures over time, and consistent measurement keeps your trajectory on track.