When to Use
- Run business impact analysis for security-critical and IT services (IdP, SIEM, EDR, SOAR, KMS, CASB, PKI)
- Set RTO/RPO and recovery tiers for security tooling, identity, logging, and evidence retention
- Author or refresh BCP/DRP with cyber-resilience (isolation, rebuild-from-gold, segmented recovery)
- Build ransomware and destructive-attack recovery playbooks (decrypt vs rebuild decision tree)
- Design backup, immutability, and air-gap patterns; schedule restore tests with pass/fail criteria
- Coordinate crisis comms cadence with IR and executive stakeholders during prolonged recovery
- Facilitate tabletop exercises (cyber, regional loss, identity outage, logging loss)
- Map high-level regulatory BCM expectations to program artifacts (not legal advice)
When NOT to Use
- Lead active security incident war room, containment, or evidence preservation →
incident-responder - Triage SOC alerts or execute detection playbooks →
soc-analyst - Define SEV matrices, paging, or status-page program →
incident-management-engineer - Operate SLIs, SLOs, error budgets, and burn-rate alerts →
site-reliability-engineer - Execute snapshot restores and access tickets without BCM program ownership →
cloud-system-administrator - Build VPC, clusters, or new platforms →
infrastructure-engineer,cloud-engineer - Enterprise security strategy without BCM/DR lens →
cybersecurity - Implement SIEM/EDR/IdP controls →
information-security-engineer - Control-by-control audit evidence automation →
compliance-engineer - Org-wide infra portfolio and multi-year capex →
vp-of-infrastructure - Deep forensic acquisition and super-timelines →
digital-forensics-analyst
Related skills
| Need | Skill |
|---|---|
| Active CSIRT response, containment, timelines | incident-responder |
| Incident program, SEV, on-call, postmortem process | incident-management-engineer |
| SLO impact during outage; reliability mitigation | site-reliability-engineer |
| Backup/restore execution, snapshots, hygiene | cloud-system-administrator |
| Security program, IR policy, board narratives | cybersecurity |
| SIEM/EDR/IdP/KMS implementation | information-security-engineer |
| GRC program, framework scoping, audit prep | compliance-specialist |
| Technical evidence automation | compliance-engineer |
| Forensic preservation and investigation reports | digital-forensics-analyst |
| Crisis and customer messaging approval | communication-lead |
| VP infra portfolio and investment trade-offs | vp-of-infrastructure |
Core Workflows
1. Scope and program charter
Define BCM/DR boundaries, ownership, and alignment with IR and resilience functions.
See references/bcm_dr_scope.md.
2. Business impact and criticality
Identify processes, dependencies, and security-service criticality; classify tiers.
See references/business_impact_and_criticality.md.
3. RTO, RPO, and recovery strategies
Set objectives; choose strategies (active/active, warm standby, rebuild, manual workaround).
See references/rto_rpo_and_recovery_strategies.md.
4. Cyber incident and ransomware recovery
Playbooks for encryption, wiper, identity compromise, and supply-chain recovery sequencing.
See references/cyber_incident_and_ransomware_recovery.md.
5. Backup, immutability, and restore testing
Retention, isolation, validation criteria, and evidence for auditors and leadership.
See references/backup_restore_and_immutability.md.
6. Tabletop exercises and governance
Exercise design, findings tracking, regulatory touchpoints, and continuous improvement.
See references/tabletop_exercises_and_governance.md.
Outputs
- BIA summary — tiered services, dependencies, max tolerable downtime, data classes
- RTO/RPO register — per service with owner, strategy, and last test date
- BCP/DRP pack — activation criteria, roles, comms tree, recovery sequences
- Cyber recovery playbook — ransomware/wiper/IdP paths with decision gates
- Restore test report — scope, RPO achieved, integrity checks, gaps, remediation
- Tabletop report — scenario, injects, decisions, gaps, action register
- Executive BCM brief — posture, test results, top risks (for leadership; not legal advice)
Principles
- Recover security first — identity, logging, and detection before convenience features
- Assume compromise — prefer clean rebuild and immutable backups over in-place decrypt
- Test restores, not backups — successful backup job ≠ recoverable data
- Align with IR — BCM activation and comms complement, not duplicate, CSIRT runbooks
- Document decisions — tiering and accepted gaps need explicit risk acceptance