Cyber resilience is the ability to prepare for, respond to and recover from cyber security incidents. It helps organisations protect themselves from cyber risks, defend against and limit the severity of attacks, and ensure that business operations continue to function in the event of a disruption.
Why is cyber resilience important?
The cyber threat landscape has changed significantly in the past few years. Organisations are storing huge amounts of data, which has led to an increase in coordinated and opportunist attacks, as well as accidental breaches.
To give you an idea of how serious the threat landscape has become, Ponemon Institute’s Third Annual Study on the Cyber Resilient Organization found that:
- 64% of respondents said the volume of security incidents has increased in the past 12 months;
- 65% said the severity of incidents has increased; and
- 57% said the time it takes to resolve an incident has increased.
These figures tell us two things: security incidents are occurring with such regularity that it’s impossible to deal with all of them, and the damage that security incidents cause means that organisations must find a way to deal with breaches more effectively.
That’s where cyber resilience comes in. It provides a way of addressing security that acknowledges that traditional security measures are essential, while also accepting that the best defence is often the ability to respond quickly to breaches.
Who should adopt cyber resilience?
Most organisations have some set of processes that resemble cyber resilience, but it won’t be as effective as a fully integrated approach. The process can be as simple or as complex as you like, so there’s no reason all organisations can’t become cyber resilient.
Those who want advice on how to get started should take a look at our Cyber Resilience Framework.
The Cyber Resilience Framework
Every organisation will have its own requirements when achieving cyber resilience depending on, for example, their size, industry and regulatory requirements.
The IT Governance Cyber Resilience Framework outlines everything you need to know about the approach, helping you tailor your cyber resilience strategy.
It contains four levels of cyber resilience maturity:
- Core: for organisations getting started with cyber security.
- Baseline: covering the majority of controls that are necessary to meet legal and regulatory requirements.
- Extended: for those building resilience by securing suppliers, services and continuity.
- Embedded: in which cyber resilience objectives are aligned with wider business objectives.
The framework also identifies key controls of effective cyber resilience, and explains which controls are necessary to meet the requirements of various laws and best practices, including the GDPR (General Data Protection Regulation), PCI DSS (Payment Card Industry Data Security Standard), Cyber Essentials, ISO 27001 and ISO 22301.