Cyber resilience engineering and recovery plan

Cyber resilience engineering and recovery plan

RS-01 — Resilience policy

[Organisation] engineers and operates [system] to sustain the essential functions identified by its stakeholders under the adverse conditions within its approved design scope. Resilience planning addresses the ability to anticipate disruption, withstand its effects, recover required capability and adapt when circumstances or assumptions change. The system owner connects these outcomes to business or mission needs and records the limits of the claim.

Resilience includes deliberate compromise as well as equipment failure, error, supplier interruption and environmental stress. Recovery planning considers the possibility that the original environment, credentials or data can no longer be trusted. Availability during ordinary operation is not treated as proof that the system can sustain essential work during compromise.

RS-02 — Essential functions and disruption criteria

The owner identifies the functions whose loss would cause unacceptable consequences, the stakeholders relying on them and the resources required to sustain them. The record includes dependencies on personnel, information, identity services, communication, facilities, suppliers and administrative capability. The owner identifies which dependencies are shared and whether their loss affects both normal and recovery arrangements.

Stakeholders establish the acceptable interruption, data loss, degraded capability and recovery priorities for each essential function. The record distinguishes a desired target from demonstrated recovery performance. Where a target cannot currently be met, the gap is recorded with its consequence and decision. Recovery priorities reflect the order in which dependent functions can actually be restored.

RS-03 — Select engineering approaches

The engineering lead evaluates resilience approaches against the essential functions, threat scenarios and practical constraints. The analysis considers segmentation, redundancy, diversity, integrity validation, restricted privilege, contextual awareness, monitoring and coordinated response where they address the identified scenario. The chosen techniques, expected effect, implementation and evidence are recorded in architecture decisions.

Redundant instances are assessed for shared identity, administration, software, data and supplier dependencies. Diversity is assessed for the maintenance and assurance burden it creates. Isolation is assessed for its effect on essential information exchange. Adaptive response is bounded by the authority granted and the conditions under which it may act. Selection follows the system need rather than assuming that a catalogue of techniques must all be implemented.

RS-04 — Prepare recovery capability

The operations owner maintains instructions for declaring a recovery event, establishing command and communication, identifying a trustworthy recovery point and restoring functions in dependency order. The plan identifies backup locations, access arrangements, restoration tools, configuration sources, required keys and supplier assistance. Copies needed during an outage are available through the continuity arrangements recorded in the plan.

Recovery preparation distinguishes data restoration from restoration of a trustworthy service. The owner identifies how restored software, configuration, identities and data will be checked and how a suspected cause of compromise will be addressed. The plan records conditions for returning to ordinary operation, including verification, stakeholder communication and the authority to make that decision.

RS-05 — Exercise and assess

The owner schedules exercises appropriate to the essential functions and identified adverse conditions. Each exercise has objectives, scope, participants, authority, constraints and expected evidence. The plan identifies whether the activity is a discussion, component restoration, integrated recovery or operational exercise. Its assurance claim is limited to what that activity can demonstrate.

Results record elapsed times, data state, functioning dependencies, unsuccessful steps and deviations from the instructions. The assessor compares results with the approved criteria and identifies whether apparent success relied on conditions unavailable in the disruption scenario. Corrective actions address technical, procedural, supplier and staffing weaknesses. A backup job completing successfully is not recorded as a successful restoration test.

RS-06 — Operate during disruption

When a qualifying event occurs, the authorised coordinator records the situation, affected essential functions and the decision to activate the plan. Actions and observations are logged with time and actor. Changes to normal authority, access or operating modes are recorded with their scope and duration. Communication identifies service limitations, expected updates and instructions relevant to affected stakeholders.

The team assesses whether the recovery basis remains trustworthy as new information emerges. If a chosen recovery point or environment is suspect, the authority records an alternative decision and its consequences. Return to service includes validation of the restored function and confirmation of continuing monitoring. Temporary arrangements remain tracked until closed or adopted through normal change control.

RS-07 — Adapt and maintain

Following an exercise, incident or material change, the owner reviews whether the essential-function model, assumptions and selected approaches remain appropriate. Lessons are applied to requirements, architecture, operations and supplier arrangements. The review can change the recovery strategy or acceptable operating model through an authorised stakeholder decision. The owner retains evidence of the previous position and the reason for adaptation.