Roadmaps Security roadmaps Governance, risk, compliance and audit
Keep the organisation running through and after an attack: impact analysis, recovery objectives, immutable backups, disaster recovery, crisis management and ransomware resilience.
Estimated time: 15–26 months · At about 10 hours a week.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Business continuity keeps the business running, disaster recovery restores IT, and cyber resilience assumes the attacker is still there. Learn how they fit together.
Work out which services matter most, what they depend on, and how long they can be down before the damage is serious. Everything else follows from this.
RTO is how fast you must recover; RPO is how much data you can lose. Set them per service from the impact analysis and design backups to meet them.
Multiple copies, different media, one offsite and one offline or immutable. Backups you have not restored from are not backups.
Plans must be usable at 3am by people under stress: who does what, in what order, with which contacts. Short checklists beat long documents.
Ransomware encrypts systems and backups, steals data and takes weeks to recover from. It is the scenario every resilience plan must handle.
Immutable storage, air-gapped copies and separate credentials stop attackers deleting or encrypting backups. Design the backup system as a target.
Hot, warm and cold sites, cloud DR, replication and failover. Match the design to each service's objectives and cost.
Restore real systems regularly, time it, and compare with the objectives. Test the identity system and the backup system first; everything depends on them.
After an attack you must rebuild without reintroducing the attacker: clean images, verified backups, rotated credentials and a known-good order of restoration.
Executives need a structure for decisions, communications and legal issues during a major incident. Define the crisis team, its cadence and its authority.
Rehearse with the people who would actually respond, from technical teams to the board. Exercises find the gaps that plans hide.
DORA, financial regulators and NIS2 require mapped critical services, impact tolerances and tested resilience. Learn the duties and the evidence.
Define the services whose failure would harm customers or markets, and the maximum tolerable disruption. Then prove you can stay within it.
Map the people, systems, suppliers and data behind each critical service. Hidden dependencies are what turn a small outage into a big one.
Redundancy, segmentation, graceful degradation and the ability to run critical processes manually. Build resilience into systems, not just plans.
Critical suppliers and cloud providers fail too. Plan for their outages and for leaving them, and test what you can.
Test against scenarios that would really hurt: loss of the identity provider, a destructive wiper, a cloud region down for days. Learn where tolerances break.
Set the resilience ambition, the investment and the programme to get there, tied to the services that matter most to customers and regulators.
Boards must be able to say the organisation can withstand severe disruption. Give them tested evidence, not assurances.
Every exercise and real incident should change something. Run honest reviews and track the improvements to completion.
Cyber resilience accepts that some attacks will succeed and plans for the organisation to keep delivering its critical services anyway, then recover fully. It joins business continuity, disaster recovery and incident response into one capability.
The work covers finding out which services matter most and how long they can be down, designing backups and recovery that survive ransomware, rehearsing crises with executives, and meeting operational resilience regulation. It needs both technical recovery knowledge and the ability to work with the whole business.
Ransomware and destructive attacks have shown that prevention alone fails. Regulators now demand demonstrated resilience, and boards want to know how long the business could survive an outage. Organisations need people who can answer that with tested plans.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact