Cyber resilience: what good looks like and the 12 measures every organisation should consider

Nathan Chadwick · October 20, 2026 · 25 min read

TLDRRead the short version

Cyber resilience is the ability to anticipate, withstand, recover from and adapt to an attack. Prevention is one input. The NCSC's September 2026 guidance is blunt that avoiding a highly disruptive incident is not guaranteed.
The costliest recent UK incidents were operational, not data breaches. The Cyber Monitoring Centre put Jaguar Land Rover at £1.9bn, with the vast majority caused by lost manufacturing output. Resilience is about keeping the business running.
2026 data converges on four weak points: identity (79% of ransomware attacks in the Sophos survey), unpatched exposure (31% of breaches in Verizon's DBIR), third parties (48% of breaches), and recovery capability, which decides what an incident costs.
Twelve measures cover govern, withstand, detect and respond, and recover: board ownership, minimum viable operations, identity, patching, segmentation, suppliers, detection, rehearsed response, an extortion plan, immutable backups, a tested rebuild path for identity, and finance and learning.
Start with proof, not policy. Restore one critical service and your identity system from scratch, time it, and keep an offline copy of your plan, contacts and insurance details. The gaps you find are your real roadmap.

Prevention is not the plan#

The most expensive cyber event in UK history was not a data breach. Nobody's customer database made the headlines. A car factory stopped.

In late 2025 the Cyber Monitoring Centre estimated that the attack on Jaguar Land Rover cost the UK economy £1.9 billion and affected more than 5,000 organisations. Its analysts were clear about the cause: the vast majority of the loss came from lost manufacturing output at JLR and its suppliers, not from stolen data.

That is the shift cyber resilience is built for. For years the conversation was about keeping attackers out and protecting data. Both still matter. But the organisations that came through the last two years best were not necessarily the ones with the strongest perimeter. They were the ones that could keep operating, recover safely, and learn faster than the attacker could adapt.

NIST defines cyber resiliency as the ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources. Those four verbs are a good test for any programme:

Anticipate: do you understand your critical services, your exposure and your adversaries well enough to prepare?
Withstand: when something gets through, does it stay small, or does it spread?
Recover: can you restore the business, and not only the data, to a trusted state, in a known time?
Adapt: does every incident and exercise change how you operate?

The NCSC's September 2026 guidance, Preparing for a highly disruptive cyber incident, says it plainly: although organisations should take steps to prevent attacks, there is no guarantee of avoiding a highly disruptive incident, and preparation for recovery is "a core resilience capability, not an afterthought". NCSC CEO Richard Horne, quoted in the same document, calls the ability to absorb attacks, contain their impact, sustain critical operations and recover quickly "a core competence for any digital organisation".

This post is the practical version of that idea: what cyber resilience should actually look like, which measures every organisation should be considering, and how to start without needing a seven-figure budget.

What the 2026 data says#

I have pulled together the main 2026 reports and government sources, because the numbers shape what to prioritise. A few caveats first. These are different datasets with different methods. Verizon analyses confirmed breaches. Sophos surveys ransomware victims. IBM models breach costs. They do not always agree on the entry point, and I will flag where. They do agree on the themes that matter.

The threat is rising and getting faster#

The NCSC handled 429 incidents in the year to August 2025, and 204 of them (48%) were nationally significant, up from 89 the year before. That is about four a week. Highly significant incidents rose 50%, the third consecutive annual increase. The NCSC also notes many incidents are never reported to it, so this understates reality.
Verizon's 2026 Data Breach Investigations Report found vulnerability exploitation is now the most common initial access vector in breaches at 31%, ahead of credential abuse at 13%. Only 26% of vulnerabilities in CISA's Known Exploited Vulnerabilities catalogue were fully remediated in 2025, and the median time to fix rose to 43 days.
IBM's 2026 Cost of a Data Breach Report found one in four malicious breaches were AI-enabled, up 56%, and that these cost about $1 million more than average. The global average breach cost reached a record $4.99 million.
The time to identify and contain a breach rose for the first time in five years, to 247 days in IBM's data. Breaches that took more than 200 days cost $5.65 million on average versus $4.32 million for those contained sooner.

The weak points are consistent#

Identity: the Sophos State of Ransomware 2026 survey found 79% of ransomware attacks started with an identity-based approach. In incidents where compromised credentials were the root cause, 97% of organisations had MFA enabled in some capacity. MFA was there. It was not enough, or not everywhere.
Third parties: Verizon reports third-party involvement in 48% of breaches, up from 30%. Its analysis of the root causes points to unglamorous failures: missing MFA, poor credential rotation, and a lack of least privilege.
People and process: the human element was present in 62% of breaches. Verizon also found click rates in mobile-centric social engineering (voice and text) about 40% higher than email.
Exposed edge: Sophos found that 59% of ransom demands following an exploited firewall vulnerability were $1 million or more, against 48% of demands overall. Privileged position means bigger impact.

Note the apparent disagreement. In Sophos's ransomware-victim survey, exploited vulnerabilities fell to 18% as a root cause while phishing and malicious email rose to the top. In Verizon's breach data, exploitation led. Both sources also expect AI-accelerated vulnerability discovery and exploitation to push that number up. Different populations, same advice: you cannot bet on a single entry point.

Recovery decides the cost#

Sophos found 55% of ransomware victims recovered within a week, 83% within a month, and backups were used to recover data in 66% of encryption cases, up from 54% the year before. Mean recovery cost was $1.7 million, with a median of $375,000.
In Sophos's earlier backup analysis (2024 survey data), attackers tried to compromise backups in 94% of ransomware attacks and succeeded in 57% of those attempts. Where backups were compromised, median recovery cost was about eight times higher ($3 million versus $375,000), and only 26% recovered within a week versus 46%.
Coveware's Q2 2026 data shows ransom payment rates at a record low of 19%, but data exfiltration featured in 76% of cases. Backups do nothing for stolen data, which is why resilience now has to cover extortion, not just encryption.

Read together, the data says three things. Attackers are getting in through identity, exposure and suppliers. Detection is slow. And what separates a bad week from a business-threatening quarter is whether you can recover on your own terms.

Three incidents that define the lesson#

Maersk, 2017: you cannot restore anything without identity#

When NotPetya hit Maersk, the company located backups for almost all its individual servers. What it could not find was a backup of its roughly 150 Active Directory domain controllers. They were designed to replicate to each other, which worked until all of them were wiped at once. After a global search, the team found one surviving domain controller in a Ghana office, which had been offline because of a power cut when the malware spread.

The data was too large to send over the office's bandwidth, so it travelled by hand: Ghana to Nigeria, then onto a flight to the UK. Maersk rebuilt 4,000 servers and 45,000 PCs in about ten days, and its chair put the total cost at between $250 million and $300 million. Full recovery took close to two months.

The lesson is not "Maersk got lucky". It is that identity is the dependency of every other dependency, and replication is not a backup.

Marks & Spencer, 2025: the front door was a phone call#

M&S chairman Archie Norman told MPs the attackers used "sophisticated impersonation", appearing as an individual with their details, and that a third party was part of the point of entry. He also said M&S closed its systems down as part of its defence, which was the right call, but that bringing them back up in a safe form is very difficult. The company suspended online shopping for nearly seven weeks, and the chairman discussed a hit to profit of around £300 million with the committee.

His colleague Nick Folland's advice to other businesses is the one I would put on a wall: make sure you can run your business on pen and paper, because that is what you need for a period while systems are down. Norman's other piece of advice sounds basic and rarely is: have a rigorous map of how your systems interface, what is hosted where, and who has access.

Jaguar Land Rover, 2025: the supply chain is the blast radius#

The CMC classed JLR as a Category 3 systemic event. Beyond the headline number, its recommendations read like a resilience checklist for boards: recognise that operational disruption is the biggest cyber risk for most businesses, identify the critical digital assets needed to deliver value, challenge compromise scenarios, have recovery plans to contain losses when key systems fail, strengthen IT and OT boundaries, and map supply chain dependencies, including how much of your revenue depends on a single customer.

Three incidents, three different attackers and sectors, one pattern. The breach was survivable in principle. What hurt was the time it took to run the business without the systems, and rebuild them safely.

What cyber resilience should look like#

Frameworks can feel abstract, so here is a more useful test. An organisation with real cyber resilience can answer five questions, with evidence rather than assurance:

What are our critical services, and how long can we be without each one? Not systems. Services: taking orders, paying staff, dispatching, treating patients, billing.
What is our minimum viable operation, and how would we run it without IT? The NCSC defines minimum viable operations (MVO) as the lowest level of capability at which the organisation can safely continue to operate, meet its legal and regulatory obligations, and maintain trust with customers, partners and staff.
Who decides at 2am, and with what authority? Including shutting systems down, invoking recovery, and speaking publicly.
Can we rebuild identity and critical systems from a trusted state, and have we proved it? "We have backups" is not an answer. A timed restore is.
Which suppliers could take us down, and what is the plan when they do?

If you cannot answer one of those, you have found your first piece of work. The rest of this post is the set of measures that gets you to a confident answer.

Twelve measures every organisation should consider#

These loosely follow the lifecycle in NIST CSF 2.0, whose six functions are Govern, Identify, Protect, Detect, Respond and Recover. Scale each one to your size. A 30-person firm and a 30,000-person group both need all twelve. They will just implement them differently.

Govern: make resilience a leadership decision#

1. Put the board in charge, with decision rights agreed in advance#

Resilience fails when it is treated as an IT project. The UK's Cyber Governance Code of Practice sets out five board-level principles: risk management, strategy, people, incident planning, response and recovery, and assurance and oversight. Its incident principle expects a response and recovery plan, exercised at least annually with relevant internal and external stakeholders, with lessons feeding back into the plan.

In practice that means:

A named executive owner for cyber risk, and a stated risk appetite that includes how long you can tolerate losing each critical service.
Pre-agreed decision principles: who can authorise disconnecting systems, when to involve the regulator, and your stance on ransom payments, written before the pressure arrives. The NCSC recommends delegated authority so out-of-hours decisions are not blocked waiting for a senior leader.
Directors who understand their personal obligations. Under NIS2, for example, management bodies must approve and oversee cyber risk measures and can be held liable for non-compliance.

2. Define critical services and your minimum viable operation#

This is the highest-leverage exercise on the list, and it costs workshops rather than technology. For each critical service:

Name the business owner and the supporting systems, including identity, networking and suppliers.
Agree a recovery time objective (how long you can be down) and recovery point objective (how much data you can lose) that the business, not IT, signs off.
Document a manual workaround and test it. Can the shop floor take orders on paper? Can finance pay critical suppliers without the ERP? Can the clinic run on printed rotas and records?
Rank restoration order, so a rebuild follows a plan and not a shouting match.

M&S's "pen and paper" advice and the CMC's call for boards to identify critical digital assets are the same point: you can only prioritise recovery for services you have already defined.

Withstand: slow the attacker and limit the spread#

3. Treat identity as the control plane#

If the data points one way, it is here. In practice:

Phishing-resistant MFA (passkeys or FIDO2 security keys) for administrators first, then everyone. Push approvals and SMS codes can be relayed or fatigued, as the Sophos "97% had MFA" figure suggests. CISA's guide to implementing phishing-resistant MFA is a good starting point.
No standing admin access. Separate admin accounts, just-in-time elevation, and privileged access workstations for the highest-value roles. The NCSC specifically recommends protecting backup administration with privileged access workstations and keeping the MFA method off the device used to administer backups.
Harden the help desk. Both M&S and the wider Scattered Spider pattern show resets are an attack path. Require strong verification for password and MFA resets (call back to a registered number, manager approval, or a verified in-person or video check), apply extra scrutiny to new MFA method registration, and monitor activity straight after a reset. Hold outsourced help desks to exactly the same standard.
Inventory non-human identities: service accounts, API keys, OAuth apps and, increasingly, AI agents. IBM found fewer than half of organisations were securing these in AI workflows.
Detect identity abuse, not just block it. I wrote about this in Identity risk is rising: why ITDR belongs in every security programme.

4. Shrink and patch your exposed attack surface, fast#

With exploitation now the top entry point in Verizon's data, and the NCSC warning organisations to prepare for a "vulnerability patch wave" as AI accelerates vulnerability discovery, patching speed is a resilience metric, not a hygiene chore.

Know what is internet-facing: firewalls, VPNs, remote access gateways, mail, web apps, forgotten cloud instances. If you do not know it exists, you cannot patch it.
Adopt an "update by default" policy. The NCSC's best-practice timescales are 5 days for internet-facing services, 7 days for operating systems and applications, and 14 days for internal systems, and faster when a critical vulnerability is being actively exploited.
Enable automatic updates and hot patching where available, and prioritise perimeter and security tooling first.
Replace end-of-life technology that cannot be patched, especially anything exposed to the internet. The NCSC is explicit that patching alone will not fix technical debt in unsupported kit.
Track CISA KEV entries specifically. The median organisation in Verizon's data had 16 of them to deal with.

5. Segment, so one compromise is not a total compromise#

Maersk, M&S and the CMC's JLR recommendations all circle back to interconnectedness. Norman noted that the hybrid of old and new systems made it harder to compartmentalise and made lateral movement easier.

Separate IT from OT, and test that a total IT outage does not take operations down with it. The CMC pointed to Colonial Pipeline, where OT was inoperable largely because of the impact of IT outages.
Tier your environment, so credentials that administer domain controllers never touch ordinary workstations.
Put management interfaces, backup infrastructure and identity systems in their own protected zones.
Rehearse isolation. Know how to cut internet and inter-site links quickly, and what breaks when you do. The NCSC recommends deciding in advance whether controlled disruption is preferable to the uncontrolled disruption of an attacker.

6. Manage supplier and third-party risk as a resilience issue#

Verizon's 48% figure, M&S's third-party entry point and JLR's supplier fallout say the same thing: your resilience includes everyone you depend on and everyone connected to you.

List the suppliers whose outage would stop a critical service, and those with privileged access into your environment.
Give suppliers least-privilege, time-bound access with MFA, and apply your help desk verification standards to theirs.
Put security and incident notification obligations into contracts, and ask critical suppliers to show a tested recovery plan.
Plan for the supplier being down, not just compromised. The NCSC recommends planning for abrupt loss of supplier services and understanding key suppliers' own resilience arrangements.
Use the NCSC's supply chain security guidance as a structure if you do not have one.

Detect and respond: shorten the attacker's window#

7. Get visibility, and have someone watching out of hours#

IBM's average of 247 days to identify and contain a breach is a sign most organisations cannot see what is happening. Organisations using security AI and automation extensively cut breach costs by an average of $1.93 million and shortened the lifecycle by 65 days.

Centralise logs from identity, email, endpoints, firewalls, cloud and backup systems, and store them somewhere an attacker cannot erase them. The NCSC lists logging that is centrally collected, retained and accessible during recovery as a technical preparation step.
Make sure someone with authority to act is watching 24/7. Ransomware is typically deployed outside business hours, which I covered in The grey zone. A managed detection and response service is the realistic route for most organisations.
Agree containment actions in advance, such as disabling an account, isolating a host or revoking sessions, so responders do not wait for sign-off.

8. Have an incident response capability you have actually rehearsed#

Most plans fail on contact with reality, and the NCSC says as much: "many plans fail in practice". What helps:

A plan that survives the outage. CISA's #StopRansomware Guide advises keeping a hard copy and an offline version of the plan, and having it reviewed and approved by the CEO or equivalent. The NCSC adds offline contact lists for key staff, suppliers and partners, and your cyber insurance details stored offline.
Out-of-band communications. If email and Teams are down or untrusted, how do you reach the response team, executives, your insurer and your regulator? Set up and test an alternative channel.
A retained incident response provider. The NCSC recommends all UK organisations, whatever their size, engage an NCSC-assured Cyber Incident Response provider before an incident. Check whether your insurance already includes one, and be clear who investigates and who rebuilds.
Regulatory clocks. NIS2 requires an early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours and a final report within a month. GDPR's 72-hour personal data breach clock applies in parallel. Know who files what, and when.
Investigate before you restore. The NCSC is firm that rushing recovery before understanding the incident significantly increases risk, including re-compromise.
Exercises. The NCSC's free Exercise in a Box includes a ransomware scenario that takes 15 to 30 minutes with three to five people. There is no excuse for not running one this month. Move on to a full executive tabletop, then a technical recovery test.
People. Plan rotation and rest for responders. The M&S chairman told MPs his cyber team had little or no sleep, or three hours a night. Burned-out responders make mistakes.

9. Plan for extortion, not only encryption#

Coveware found data theft in 76% of Q2 2026 cases, and its field CISO warns that "in most extortion cases, deletion cannot be independently proven". An organisation with perfect backups can still be blackmailed.

Know what sensitive data you hold, where it lives and who can reach it. You cannot assess a theft claim without this.
Reduce what is there to steal. Retention limits and data minimisation are resilience measures.
Agree in advance how you will assess a claim. Coveware suggests four questions: what have we verified, what is the attacker claiming, what are we assuming for now, and what would change our decision?
Understand the risks of paying. The NCSC and UK law enforcement do not encourage or condone payment. There is no guarantee of access to your data or deletion of stolen data, systems may remain compromised, you may be targeted again, and some groups are sanctioned entities, so payment could break sanctions law.

Recover: restore the business, not just the data#

10. Build backups that survive a determined attacker#

Attackers go after backups first, so treat backup infrastructure as a Tier 0 asset. The NCSC's guidance on ransomware-resistant backups and offline backups boils down to:

At least one copy that is offline or immutable. Write-once storage, soft delete with enforced retention, and delayed deletion with a trustworthy alert all stop an attacker with admin rights from simply deleting your recovery path.
Separate credentials and separate administration from your main domain. If a Domain Admin compromise can delete your backups, you do not have backups. Do not rely on multiple copies in a single cloud service.
Back up everything needed to rebuild, not just data: applications, identity systems, trust infrastructure such as certificate authorities, and configuration. The NCSC lists all of these.
Scan before you restore, and only connect backups to known-clean systems. Ransomware may have sat in your environment for a while before detonating.
Monitor the backup system itself. Alert on job failures, deletion attempts and replication lag. I covered a simple routine in Running a restore drill without the drama.
Be aware of the trade-offs. CISA cautions that immutable storage may not meet certain compliance criteria and misconfiguration can be costly, so plan retention deliberately.

Backups you have never restored are a hope, not a control.

11. Prove you can rebuild identity and core infrastructure from scratch#

This is the measure Maersk wishes it had tested, and the one most organisations skip because it is hard.

Write and rehearse an Active Directory or Entra ID recovery plan. Microsoft's Active Directory Forest Recovery Guide is a template, but its own planning for compromise guidance explains the catch: if an attacker had privileged access to domain controllers, malicious changes replicate to every DC, and you cannot trust the directory without a known-good backup or a complete record of the attacker's changes. Sometimes the right answer is a pristine new forest.
Keep golden images, infrastructure as code and software installers offline and version-controlled, as CISA suggests, so rebuilds do not depend on hardware or downloads you can no longer access.
Store network diagrams, asset inventories and dependency maps separately from production, and document restart sequencing. Rebuilding shared services in the wrong order wastes days.
Plan data reconciliation. If you run on manual workarounds for two weeks, how do you merge that new data with restored systems into one correct dataset? The NCSC calls this out explicitly.
Know your cloud break-glass path: emergency admin accounts for SaaS and cloud tenants, protected with strong authentication and accessible even if the corporate network is offline.
Have enough capacity. Resetting thousands of credentials, reimaging devices and issuing replacement laptops is resource-intensive, and the NCSC says critical response roles should never rely on a single individual.

12. Fund it, insure it, and learn from it#

Liquidity and insurance. Understand what your cyber policy covers, what it excludes, and what the insurer expects (many require specific controls, and many include incident response support). M&S told MPs it had restructured its policy to retain the first layer of exposure and insure for the worst case. Check you could fund several weeks of disruption.
Cyber Essentials. The NCSC says organisations with Cyber Essentials controls are 92% less likely to make a cyber insurance claim, and eligible UK organisations with turnover under £20 million get cyber liability insurance included when certifying the whole organisation. It is the minimum baseline for smaller organisations.
After-action reviews. NIST's small business quick-start guide recommends an after-action report documenting the incident, response and recovery actions, and lessons learned. Do this for exercises as well as real incidents, with owners and dates on every action.
AI governance. Verizon found frequent employee use of AI tools at work tripled from 15% to 45% in a year, and shadow AI is now the third most common non-malicious data leakage activity. Set clear policy and provide approved tools, or sensitive data leaves through a side door.

The regulatory picture in one section#

Regulation is converging on resilience, so building these capabilities also reduces compliance risk.

NIS2 (EU) requires management accountability, risk management measures, and tiered incident reporting: early warning in 24 hours, notification in 72 hours, final report in one month. Maximum fines are set at no less than €10 million or 2% of worldwide annual turnover (whichever is higher) for essential entities, and €7 million or 1.4% for important entities.
DORA (EU financial sector) requires an ICT risk framework, documented backup and recovery procedures, a resilience testing programme, and threat-led penetration testing at least every three years for in-scope entities.
The UK Cyber Security and Resilience Bill will reform and extend the NIS Regulations. At the time of writing it is at the House of Lords report stage and has not yet received Royal Assent, so check its latest status if you operate essential services or are a managed service or data centre provider.
NCSC Cyber Assessment Framework 4.0 is the outcome-based standard for essential services, now covering attacker understanding, secure software, monitoring and threat hunting, and AI risk.
NIST CSF 2.0 added a Govern function, and makes a good spine for anyone else. NIST also publishes a Small Business Quick-Start Guide with a recovery playbook outline.

You do not need all of these. Pick one as your spine: Cyber Essentials plus the NCSC's small organisation guidance for the smallest firms, NIST CSF 2.0 for most mid-size organisations, and CAF where you run essential services.

A practical plan: 30, 90 and 365 days#

In the next 30 days (cheap, fast, high value)#

List your top five critical services, with an owner and a tolerable downtime for each.
Create an offline pack: the incident response plan, contact lists (staff, suppliers, insurer, incident response provider, regulator), network diagrams, and insurance policy details. Store it somewhere that survives your network being gone, including paper.
Change help desk reset procedures so no password or MFA reset happens on knowledge-based checks alone.
Check that admin accounts have MFA and that backup administration is separated from your main domain. Confirm at least one backup copy is offline or immutable.
Inventory internet-facing systems and patch anything with a known exploited vulnerability.
Run the NCSC's ransomware Exercise in a Box scenario with your leadership team.
Retain an incident response provider, or confirm your insurer's panel.

In the next 90 days#

Restore one critical service, end to end, and time it. Include its identity and network dependencies. Record every surprise.
Write manual workarounds for your three most critical services, and test one for half a day.
Set up out-of-band communications and verify everyone in the response team can use them.
Centralise logs in a location attackers cannot erase, and arrange 24/7 monitoring or a managed service.
Identify your top ten suppliers by dependency and access, and send them a resilience questionnaire.
Draft your decision principles: shutdown authority, regulator contact, ransom stance, who speaks publicly.

Within 12 months#

Run a full tabletop with the board or executive team, followed by a technical recovery test of identity from backup.
Segment IT and OT and test isolation procedures.
Roll out phishing-resistant MFA to administrators and high-risk users, and remove standing privileged access.
Formalise a continuous patching process with internet-facing SLAs measured against the NCSC timescales.
Build supplier resilience requirements into contracts at renewal.
Review insurance, liquidity and, where appropriate, certify to Cyber Essentials Plus, ISO 27001 or the framework you chose.

Measure what matters#

Counting tools or training completions will not tell you if you are resilient. These measures will:

Time to restore identity (measured in a real test, not estimated).
Percentage of critical services with a successful restore test in the last six months.
Time to patch internet-facing critical vulnerabilities, against the NCSC's five-day target.
Percentage of privileged accounts using phishing-resistant MFA.
Mean time to detect and contain, tracked from exercises and real alerts.
Time to assemble the incident team via the out-of-band channel.
Percentage of critical suppliers with evidence of a tested continuity plan.

And here are five questions a board can ask this quarter:

Which of our services would hurt most if they were down for three weeks, and what is our plan?
When did we last restore from backup, and how long did it take?
If our directory was wiped tonight, how would we get people logging in again?
Which suppliers could stop us operating, and what happens if they are compromised?
Who has authority to take the key decisions at 2am on a Sunday?

The NCSC's Cyber Security Toolkit for Boards also offers a useful reminder here. Frame metrics around success, such as how many staff reported a suspicious message, rather than how many failed a phishing test, so people are not incentivised to stay quiet.

Where resilience programmes quietly fail#

Having looked across the guidance and incidents, the same failure modes appear repeatedly:

The plan lives on the thing that is down. The playbook sits on the file server that is now encrypted, and the contact list is in the directory that no longer exists.
Backups that were never restored, or that share credentials with the domain the attacker now controls.
Disaster recovery designed for hardware failure, not for an intelligent adversary who has destroyed backups and sits in your identity system.
Compliance mistaken for resilience. A certificate shows controls existed at a point in time. It does not prove you can recover in three days.
IT owns it alone. Operations, HR, legal, finance and communications all have recovery workstreams. The NCSC's recovery guidance describes running recovery as a formal programme with named workstream leads.
Nobody can decide. Waiting for the one person with authority, who is on a plane, can cost a day.
Rushing back online. Restoring before understanding the intrusion risks reinfection and a second outage.
No learning loop. Findings from exercises sit in a report. Nobody owns the actions.

Resilience is a muscle#

No programme will stop every attack. The honest framing, and the one the NCSC, NIST and the people who lived through Maersk, M&S and JLR all share, is that something will eventually get through, and what matters is how much of the business you keep and how fast you get the rest back.

The good news is that most of the work is not exotic. It is knowing what matters, shrinking the ways in, limiting the spread, watching for trouble, keeping recovery paths an attacker cannot reach, and rehearsing until the plan is muscle memory. Start with the 30-day list. The first restore test will teach you more than any report.

If you do one thing this week, do this: find out how long it would take to get identity and your single most critical service back from nothing. If you do not know, that number is your resilience gap.

References#

Sources and further reading for the claims above.