Setting Up An Operational Resilience Framework

You are in charge of disaster response and recovery at your organization and you have just been hit with a wiperware attack. Your team has executed its playbook to retrieve data from your back-up files.  However, all of your organization’s systems, applications, networks, and devices are inaccessible.

You quickly realize that by following traditional disaster recovery practices you have focused almost exclusively on data recovery, with little regard for providing critical services to customers as you work to recover fully from this crisis.

This is the nightmare that many enterprises have faced when they have become victims of a destructive attack.  

Today’s cyberthreat landscape illustrates the need for enterprises to not just have back-ups of user and business data, but to also have immutable and distributed backups of applications, systems, networks, processes and other critical services to enable swift recovery of operations. It has become clear that just having good back-ups of data is an inadequate business response.   

Without the ability to quickly restore minimal viable service levels with accurate data and restoration of critical applications, networks, devices and systems architecture, organizations are at high risk of extending disruption from attacks. Executive management, shareholders, customers and then journalists will ask legitimate questions regarding how quickly minimal service levels can be restored. How have you prepared for this type of attack? 

Three years ago, Global Resilience Federation’s Business Resilience Council (BRC) launched a multi-sector working group to establish a framework to address all aspects of data, systems, and processes recovery from a destructive attack. The ORF’s multi-sector volunteer team of experts included security and resilience practitioners and consultants from many industry sectors. The working group spent over two years to develop the Operational Resilience Framework (ORF) which was then reviewed by over a hundred organization before version 1.0 was released (www.grf.org/orf). 

The ORF provides rules and implementation aids that support a company’s recovery of data, systems and processes based on establishment of minimum viable services levels and objectives for immutable backup and recovery. The ORF is a vendor agnostic solution and establishes a set of rules that are uniquely not prescriptive with a goal of reaching a goal of operational resilience for the enterprise that is consistent with existing standards.

 A summary of the path towards operational resilience identified by the ORF include:

  1. Implement an industry-recognized standard IT and cybersecurity controls framework.
  2. Understand the organization’s role in the ecosystem. 
  3. Conduct an inventory and allocate business processes, systems, and data sets into three categories- Operations Critical, Business Critical, and Business as Usual.
  4. Define your organization’s impact tolerance for disruptions to each Operations Critical service. 
  5. Preserve the Data Sets necessary to support Operations Critical and Business Critical services.
  6. Develop Operations Resilience processes to enable recovery and restoration of Operations Critical and Business Critical services within acceptable impact tolerances.
  7. Independently evaluate design and test periodically.

The ORF is designed to be broadly applicable, with downloadable documents including:  

  • Rules targeted to practitioners with information on the steps, terminology, implementation aids, and future activities.
  • A mapping of the rules to NIST and ISO controls.
  • A glossary document with defined key terms.
  • A business-oriented implementation scenario to explain use cases in the form of a plausible incident.

In the face of a destructive cyberattack or massive natural disaster, enterprises must plan to mitigate the impact based on pre-established minimal viable service levels and objectives. Don’t be unprepared.

The ORF working group is now working on various ORF implementation tools including a maturity model, training programs and operational resilience exercises for multiple sectors. Visit www.grf.org/orf to download the complimentary documents to enhance your organization’s resilience against destructive events and maintain operational continuity.  

Bill Nelson is Chair at the Global Resilience Federation

You Might Also Read:

Zero Trust: A Paradigm Shift in Cybersecurity:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Hollywood Stars Strike Over AI Human Replacements
WEBINAR | Uplevel Your Cloud Security Posture With CSPM »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

InformationWeek

InformationWeek

InformationWeek is the world's most trusted online community for business technology professionals like you.

Help Net Security

Help Net Security

Help Net Security has been a prime resource for information security news and insight since 1998.

Exostar

Exostar

Exostar is the cloud platform of choice for secure enterprise and supply chain collaboration solutions and identity and access management expertise.

AVL Mobile Security

AVL Mobile Security

AVL Mobile Security is a market-leading mobile security company for anti-virus and threat intelligence in the mobile Internet.

Sphonic

Sphonic

Sphonic provides regulated institutions of any size a powerful compliance & risk platform to quickly and securely onboard new customers and manage ongoing AML and Fraud & Risk trends.

ValidSoft

ValidSoft

ValidSoft is a security software company, providing telecommunications-based multi-factor authentication, identity and transaction verification technology.

Calypso AI

Calypso AI

Calypso AI build software products that solve complex AI risks for national security and highly-regulated industries.

International Cybersecurity Forum (FIC)

International Cybersecurity Forum (FIC)

The International Cybersecurity Forum (FIC) has established itself as the benchmark event in Europe in terms of digital security and trust.

Aurora Systems Consulting

Aurora Systems Consulting

Aurora is a Cybersecurity solutions provider with a portfolio consisting of security consulting, products and services that proactively prevent, secure and manage advanced threats and malware.

HolistiCyber

HolistiCyber

HolistiCyber provide state-of-the art consulting, services, and solutions to help proactively and holistically defend against a new era of constantly evolving cyber threats.

Matrixforce

Matrixforce

Matrixforce is a vetted IT support provider that uses the patented Delta Method of streamlining technology for financial and professional service firms to reduce complexity and avoid risk.

RB42

RB42

RB42 (formerly Nexa Technologies) provide cyber defense solutions (ComUnity, secure and encrypted messaging, detection of interception tools, etc) and cyber defense consultancy service.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Cyber Security Certification Australia (CSCAU)

Cyber Security Certification Australia (CSCAU)

CSCAU is the world’s first 'for mission' industry council set up to address small and medium-sized business (SMB) cyber resilience through annually updated certifiable standards.

M7 Services

M7 Services

M7 Services are a comprehensive Managed Services Provider (MSP) with a focus on delivering cutting-edge information technology solutions and unparalleled customer service.

Foresights

Foresights

Foresights is a Nordic company utilizing advanced intelligence tradecraft and extensive cyber security capabilities to deliver services and advisory tailored to our client’s critical requirements.