Cyber Resilience & Recovery · ACE-03

Your plans say you can recover. Could you prove it this afternoon?

Every organisation has recovery documents. Far fewer have recovery evidence. The difference only becomes visible during an incident, which is the most expensive possible moment to discover it. Twenty questions separate paper resilience from proven resilience.

20 QUESTIONS · 15 MINUTES · INSTANT SCORE · NO EMAIL REQUIRED

Answer as the organisation stands today, based on evidence you could produce, not plans you could point to.

SCORING: Yes = 2 · Partly = 1 · No = 0 · Don't know = 0. On this topic, not knowing is the finding.

Would the recovery actually work?

Section A · Recovery reality
Q1
Have your recovery time claims been proven in a witnessed, timed restore test in the last 12 months, not just stated in a document?
A recovery time objective that has never been measured is a hope, not an objective.
Q2
Could you restore a critical system if your identity provider, password vault or backup console was itself part of the outage?
The most common recovery failure is a dependency loop: the restore needs a system that is also down.
Q3
Do you know which of your backups are immutable or offline, and would therefore survive a ransomware event?
Encrypting or deleting backups first is standard attacker tradecraft, not an edge case.
Q4
Do you know your actual data loss window from the last restore test, rather than the scheduled backup frequency?
Backup frequency is not the same as data loss. Failed jobs and unmonitored replication widen the window silently.

Does the business agree what comes back first?

Section B · Impact and priorities
Q5
Is there a current business impact analysis naming which services must come back first, agreed by the business rather than assumed by IT?
When everything is priority one, the real order gets decided mid-incident, by whoever is loudest.
Q6
Are maximum tolerable outage times agreed with the executive, in hours, per critical service?
"As soon as possible" is not a tolerance. Boards discover their real tolerance at hour six.
Q7
Do your recovery priorities cover what critical services actually depend on: SaaS platforms, suppliers and key individuals, not just servers?
A modern outage maps poorly to a server list. The dependency you missed is the one that extends the outage.
Q8
Do you know which critical processes now depend on AI tools or automated decisions, and what happens when they stop?
AI dependence is accumulating faster than continuity plans are being updated to reflect it.

Are you ready for the worst day?

Section C · Ransomware readiness
Q9
Is there a defined, rehearsed decision path for a ransom demand: who decides, who advises, and the organisation's position on payment?
This decision involves legal, sanctions and insurance dimensions. Three in the morning is not when to design it.
Q10
Could your most critical service operate for days with core IT unavailable, using documented and practised manual workarounds?
Recovery takes longer than the plan says. The gap is bridged by people, or it is not bridged.
Q11
Are your recovery runbooks and contact trees accessible when the network, email and document platforms are all down?
The plan stored only on the SharePoint that is encrypted with everything else is not a plan.
Q12
Could you isolate compromised parts of the network quickly without taking your own critical services down in the process?
Containment that amputates the business is a second incident. Segmentation only counts if it has been tested.

Has anyone actually practised?

Section D · Exercising and evidence
Q13
Has the executive team completed a cyber tabletop in the last 12 months that forced real decisions, not a walkthrough of the plan?
Reading the plan aloud is not an exercise. Decisions under time pressure are what get tested in real incidents.
Q14
Do exercises rehearse the regulatory clock: who starts SOCI reporting, OAIC notification or APRA obligations, and when?
Some reporting obligations run in hours from awareness. The clock starts whether or not anyone in the room knows it.
Q15
Are exercise and test findings tracked to closure with owners and dates, and visible to the executive?
A finding raised twice across two exercises is not a finding. It is a decision not to fix it.
Q16
Have critical suppliers been included in an exercise, or had their own recovery claims tested rather than taken on trust?
Your recovery time includes theirs. A supplier's untested plan is your untested plan.

Could you stand behind it?

Section E · Governance and reporting
Q17
Is a named executive accountable for cyber resilience, with authority that spans IT, business units and suppliers?
Resilience crosses every boundary in the organisation. Accountability that stops at the IT budget line does not.
Q18
Are delegations clear for an out-of-hours incident: who may shut systems down, approve emergency spend and speak publicly?
Incidents reliably arrive when the delegate is on leave. Ambiguity here costs hours at the worst time.
Q19
Does the board receive resilience reporting in business terms: services, tolerances and test results, rather than backup success rates?
"99% backup success" tells a board nothing about whether the business could operate on Tuesday.
Q20
Could you evidence your resilience program today to a regulator, insurer or major client, referencing a framework such as ISO 22301, CPS 230 or your CIRMP?
Insurers and regulators have stopped accepting policy documents as proof. They ask for test results and dates.
0 of 20 answered

Your result

0 / 40

Want the gap summary and a 90-day starting plan?

Enter your details and Leon Hutcheson will personally send a short summary of your weakest areas and a prioritised 90-day starting plan. No automation, no sequence emails.

Your answers are emailed to Aceline only. They are not stored in any marketing platform and you will not be added to a list.