Cyber resilience and ransomware recovery: A backup you have not restored is a hope, not a plan.
We work out what the business needs back first, design recovery around it, and prove it by restoring for real. You leave with measured recovery times, not assumed ones.
For
Leaders who must show the business can restart after ransomware, an outage or a destructive attack.
You get
A recovery order, a tested runbook, measured recovery times and a design for backups an attacker cannot reach.
How it runs
Business first: which services matter and how long you can be without them. Then technology.
Not included
Running a live recovery during an attack. See Ransomware Recovery and Recovery & Restoration.
Recovery has an order, and getting it wrong costs days
Everything depends on something else. We map those dependencies and write the order down. The numbers below are a sequence, not a ranking of importance.
- 1
People can sign in
Identity services come back first. Without them nothing else can be rebuilt or trusted.
Directory, authentication, admin access
- 2
The network and names work
Core connectivity and DNS let systems find each other.
Network core, DNS, remote access
- 3
Backups are safe and readable
The backup platform itself is verified clean before any restore.
Backup servers, immutable copies, keys
- 4
The services that earn and protect
The few business services with the shortest tolerance for downtime.
Payments, orders, core platform
- 5
Data stores
Databases and file stores, restored to a point before the damage.
Databases, file shares
- 6
Everything else
The long tail returns in waves as capacity allows.
Internal tools, reporting, archives
Your own order will differ. The point is that it is written down and tested.
Documented, or proven
| Item | Assumed recovery | Tested recovery |
|---|---|---|
| Recovery time | A number in a document, from a vendor or a guess. | A number measured in a restore exercise, with the gaps listed. |
| Dependencies | Known to a few people. | Mapped and written in the runbook. |
| Backups | Assumed intact. | Restored, scanned and checked for integrity. |
| When you find out | During the attack. | In an exercise you scheduled. |
Three kinds of exercise
Level 1
Executive tabletop
Leaders walk through a ransomware scenario. We test decisions, authority and communication.
Level 2
Technical restore test
Engineers restore a chosen service from backup in an isolated space and time it.
Level 3
Full recovery exercise
A larger rebuild across several services, run with the business watching the clock.
Why recovery is part of security
48%
of breaches in 2025 involved ransomware.
Verizon DBIR 2026
14 days
median time an attacker was inside before detection in 2025, enough time to find and damage backups.
Google Cloud, M-Trends 2026
What you hold at the end
- Dependency mapWhat each critical service needs to run, in one picture.
- Recovery runbookThe order, the steps and the people, written so someone new can follow it.
- Restore test reportMeasured recovery time and data loss, with what failed and why.
- Backup designCopies kept offline or immutable, separate credentials, tested regularly.
- Executive exercise reportDecisions made, gaps found and actions with owners.
Grounded in public guidance
NIST CSF 2.0, Recover function
Covers executing the recovery plan and communicating during recovery.
ISO 22301
The international standard for business continuity management.
EU DORA, Articles 11 and 12
Require financial entities to have continuity plans, backup policies and restoration procedures, and to test them.
Works well with
- Recovery & RestorationRuns the technical restore when you need it for real.
- Ransomware RecoverySpecialist recovery from an encrypted environment.
- Resilience TestingRepeats exercises as your systems change.
Questions we hear
What are RTO and RPO?
RTO is how long a service can be down. RPO is how much data you can afford to lose. We set both with the business owner, then test whether you meet them.
Do our backups protect us from ransomware?
Only if an attacker cannot reach or alter them, and you have restored from them. We check both.
Can you test without disrupting production?
Yes. Most restore tests run in an isolated environment. Larger exercises are scheduled with the business.
Do we need to test every year?
Systems change, so recovery drifts. We recommend a schedule based on how fast yours change and what your regulator expects.
Find out your real recovery time.
Name the one service you cannot lose. We test how fast it comes back.
