Chapter 33 — Security governance, risk and compliance: safety and resilience

Lesson map

Lesson 33 published. Map, example, EX097.

flowchart TD
  N0["Learning outcomes"]
  N1["33.1 Resilience as a governance goal"]
  N2["33.2 Operating under attack"]
  N3["33.3 Testing recovery"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX097"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["33.1 Resilience as a governance goal"]
  N2["33.2 Operating under attack"]
  N3["33.3 Testing recovery"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX097"]

[Learning outcomes]
    |
    v
[33.1 Resilience as a governance goal]
    |
    v
[33.2 Operating under attack]
    |
    v
[33.3 Testing recovery]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX097]

Learning outcomes

You will (1) integrate safety and resilience into governance; (2) plan for continued operation under attack; (3) test recovery objectives.

33.1 Resilience as a governance goal

For an electricity distributor, preventing every incident is impossible, so the board's real goal is resilience: keeping power flowing and restoring services quickly when things go wrong. Nadia learns that NIST CSF 2.0 includes Respond and Recover functions alongside protection and detection, and that ISO/IEC 27002:2022 covers information security during disruption and ICT readiness for business continuity. She helps Ardwell define recovery time objectives for billing, the payment portal and control systems, agreed with the board. Recovery time objectives give the board a measurable test of resilience, as the billing restore in section 33.3 shows.

33.2 Operating under attack

Nadia joins a workshop on operating while office systems are encrypted by ransomware. Control rooms must keep running on isolated systems with paper procedures for switching. Billing can pause for days without harming customers if communication is clear. The payment portal can redirect customers to pay later. Each decision is recorded in a continuity plan. She learns that resilience planning forces governance to decide in advance which services matter most, rather than improvising priorities during a crisis. Prof. Brenner notes that pausing billing for days is acceptable only because communication to customers was planned in advance.

33.3 Testing recovery

Plans must be tested. Ardwell restores billing from backup in a test environment and measures the time: nine hours against a target of eight. Nadia records the gap, its causes and fixes, such as pre-staging restore scripts. A control-room exercise shows that paper procedures are out of date. She learns that recovery tests often fail first time, which is their purpose, and that recording and closing gaps is what turns a plan on paper into real resilience the board can rely on. The nine-hour billing restore against an eight-hour target is a gap small enough to fix with pre-staged scripts.

Worked example

Nadia helps set recovery objectives, plans operation under ransomware and records a nine-hour restore against an eight-hour target.

Synthetic case. Objectives and test results are synthetic; CSF 2.0 and ISO/IEC 27002:2022 are real.

Errors and limits

Tests are rehearsed scenarios. Real crises bring surprises.

Exercises

• EX097 — Board goal. What is Ardwell's real resilience goal?
  Show marking criteria

  Rubric: 3 = keep power flowing and restore services quickly;; 2 = resilience;; 1 = vague;; 0 = none.
• EX098 — Restore gap. How did the billing restore test compare with its target?
  Show marking criteria

  Rubric: 3 = nine hours versus eight;; 2 = over by one hour;; 1 = vague;; 0 = none.
• EX099 — Test purpose. Why are failed first recovery tests valuable?
  Show marking criteria

  Rubric: 3 = they reveal gaps to close;; 2 = learning;; 1 = vague;; 0 = none.

Synthesis

Resilience governance sets priorities in advance and proves recovery through testing.

Continue studying — chapter 33 of 50

← Chapter 32 (draft) · Course chapter index · Chapter 34 (draft) →