Cyber Resilience
Cyber Resilience explained
Cybersecurity aims to reduce risks and prevent or detect attacks. extends this perspective to what happens when a safeguard fails: which services remain accessible, how customers are informed and which systems must recover first. It is not a promise of uninterrupted operation.
The NIST Cybersecurity Framework 2.0 organises cyber risk management into six functions: Govern, Identify, Protect, Detect, Respond and Recover. These provide a framework, not a certificate or proof that a particular organisation is secure. CISA’s ransomware guide adds practical recommendations on updates, phishing-resistant multifactor authentication, protected backups and exercised response and communications plans.
Marketing needs to consider the whole demand journey. A reachable landing page is insufficient if forms fail or the CRM does not receive enquiries. A restored shop is not ready if product data, payments or order confirmations are missing. Recovery checks therefore need technical and business approval.
Backups support restoration but do not reverse possible data exfiltration. Communications and legal assessment must be organised alongside the technical investigation. Applicable notification duties require case-specific review by the responsible specialists; this glossary is not legal advice.
Examples
Hypothetical application
A brand’s shop goes down during a . The team pauses affected advertising, uses an agreed status channel and has IT and shop owners verify recovery. Budget and communications are released only after a complete test order. This is not a Davies Meyer client case.
Key Points
- Assess business processes, not only individual servers.
- Plan protection and controlled recovery together.
- Establish accountability and independent communications before an incident.
Practical application
Map the systems behind an important , including operators, access and dependencies. Agree tolerable downtime and data loss as planning objectives, define an alternative communications channel and exercise recovery through a complete test enquiry or order.
Useful measures
Demonstrated restoration time
Compare time observed in a recovery exercise with the agreed objective; a target is not demonstrated performance.
Tested critical business journeys
Record which forms, orders and data handoffs were actually verified successfully.
Common mistakes
- Equating an existing backup with a tested restoration.
- Treating data exfiltration and encryption as the same problem.
- Presenting framework adoption as security certification.
Sources and context
- NIST: Cybersecurity Framework 2.0
Original release of 26 February 2024: governance and six risk-management functions.
- CISA: #StopRansomware Guide
Prevention, protected backups, response checklist and communications planning.
Frequently Asked Questions about Cyber Resilience
Cybersecurity reduces risk through protection and detection. Cyber resilience also covers response, business continuity and controlled restoration. They complement each other.
No. Access controls, detection, tested restoration, accountability and communications also matter. A backup does not reverse the publication of stolen data.
No. It is a framework for managing cyber risk. Using it does not prove that a particular system is secure.
Loading related terms…
All TermsArticles about Cyber Resilience
Cybersecurity in marketing: When an attack stops demand
An attack does not only affect IT. It can interrupt demand, sales and trust. Plan protection and recovery around your marketing processes.
Marketing as an Operating Discipline: Why Almost Every CMO Talks About AI and Few Have Built It
The gap between intent and execution is not a technology problem, it is an operating model problem. How to move marketing from a project organisation to an operating discipline with systems, roles and cadence.
GEO in practice: Customer questions and evidence
A practical GEO review: choose customer questions, check content gaps and technology, add evidence and assess suitable enquiries.