While organizations may cite specific cyber security measures as priorities, it’s how they behave that truly matters. This was a key insight found in our inaugural Cyber Recovery Readiness Report, in which we partnered with GigaOm to survey 1,000 global IT and security leaders.

When analyzing the most resilient organizations, we found that they employed many measures, but five practices rose to the top when determining their true readiness. We call these practices maturity markers (see 5 Markers of Cyber Recovery Readiness, below). 

Organizations demonstrating four or five markers are considered cyber mature. These companies report experiencing fewer breaches and recovering faster when they do get breached. 

However, our survey found that only 4% of organizations have deployed all five markers, and just 13% practice at least four. At the bottom of the maturity curve, 14% have no key markers in place at all.

While fewer than half of all organizations feel confident in their recovery plans, more than half of cyber mature organizations (54%) feel substantially more confident in their ability to recover critical systems and data following a major incident. 

5 Markers of Cyber Recovery Readiness

An organization’s level of cyber maturity can be measured by the presence of five markers. The most mature, cyber-ready organizations demonstrate four or five of these:  

• Security tools to enable early warning about risk, including insider risk.?

Early warning security tools are technologies and systems designed to detect potential cyber threats before they can cause significant harm. These tools aim to identify risks at the earliest possible stage, allowing organizations to respond proactively rather than reactively. Examples include Intrusion Detection Systems, Deception Technology, Intrusion Prevention Systems, Security Information and Event Management, User and Entity Behavior Analytics, and Endpoint Detection and Response. 

• A known-clean dark site or secondary system in place.???

Maintaining an isolated, pre-configured or dynamic isolated recovery environment (for example, a cleanroom) that remains unaffected by cyber incidents at the primary site. This secondary site can be quickly activated for business continuity and data integrity in the event of a cyber attack or major failure. It enhances cyber resiliency by providing a secure failover option, minimizing downtime and complexities of failover.  

• An isolated environment to store an immutable copy of the data.???

Involves maintaining a separate, air gapped (that is, immutable and indelible) copy of data secured behind a third party’s infrastructure. The data remains unchanged and protected from cyber threats, including ransomware and malicious insider actions. It enhances data integrity and availability, providing a reliable recovery option in case of data corruption or loss. 

• Defined runbooks, roles, and processes for incident response.???

A crucial capability for cyber resilience for a structured and efficient response to cyber incidents. Tested runbooks provide step-by-step instructions for handling various types of incidents, reducing confusion and response time. Clearly defined roles and processes ensure that every team member knows their responsibilities, promoting coordinated efforts. This preparedness speeds up recovery and helps maintain operational continuity during and after cyber events. 

• Specific measures to show cyber recovery readiness and risk.???

Metrics and tests that demonstrate an organization’s ability to recover from cyber incidents and assess associated risks. These measures, such as regular recovery drills and risk assessments, provide insight into the effectiveness of recovery plans and identify potential vulnerabilities. They are important for cyber resiliency in particular, as well as preparedness, validation of recovery strategies, and to highlight areas for improvement. 

Download the full report to find out more about how your organization can be better prepared for a breach.