Defining the MVC: Recover faster from cyberattacks by restoring what matters most

Most organizations in UK and across Europe don’t struggle to recover from cyberattacks such as ransomware because they lack backups. They struggle because they try to restore everything at once.

In the aftermath of a major cyber incident, the instinct is to bring every system back online as quickly as possible. It feels like the fastest path back to normality. However, in reality, this approach often slows recovery down, reintroduces cyber risk and undermines trust just when the organization needs it most.

In fact, those that recover fastest start from a different premise. They assume large parts of their organization will be unavailable or untrusted, and they plan accordingly. This mindset leads to a much clearer goal – restore what matters most, quickly, and in a state you can trust.

What is critical to survival?

Focusing on the critical areas of an organization is the idea behind the Minimum Viable Company (MVC) concept, sometimes referred to as the Minimum Viable Organization. It is a definition of what must exist for the organization to survive in challenging conditions such as a cyber incident.

It’s not just a technology concept, it’s a business definition of survival in terms of the minimum combination of people, processes, technology, documentation, facilities, and third-party dependencies required to keep a business functioning and creating value.

Where to start getting an MVC up and running?

There are five key capabilities when it comes to operationalizing an MVC:

1. Clarity on critical services:

A precise understanding of the systems and dependencies that directly support revenue and mission-critical operations is needed here. To understand the MVC, it is key to map systems to business value. Without this understanding, it’s impossible to accurately define the MVC.

The first steps focus on undertaking a structured assessment, aligning across business and technology stakeholders, and going through a realistic simulation of how recovery will unfold under pressure. This will uncover the key areas needed to provide just enough capability to keep the organization functioning safely during a crisis and guide recovery.

In practice, this means defining what must function in the first 24 hours, the first 72 hours, and the first week after a disruption.

2. A trusted foundation (Tier 0):

In the event of a cyberattack, many organizations miss the critical foundational layer that allows them to establish identity and access control independently of compromised systems.

This foundational layer is what we call Tier 0 or the control plane for recovery. It includes identity and access management, networking and DNS, privileged access controls, core security tooling, physical access systems, and secure communication channels.

It also covers non-technical dependencies that are easy to overlook until they’re urgently needed such as incident response playbooks, contact lists and escalation paths, insurance policies, and contracts with external responders. These are the foundations underpinning the critical systems that need to be restored after a cyber incident. Without this layer, a trusted recovery is not possible.

3. Isolation of recovery assets:

In the event of a cybersecurity breach, organizations must establish control of their most critical systems. This requires recovering data separately from clean snapshots and investigating in parallel, not sequentially, to ensure the recovered systems are not infected by malicious software.

As part of this process, backups, configurations, and recovery tooling must be protected from the same blast radius as production. If key recovery assets can’t be isolated, a rapid and trusted control of critical systems can’t be achieved.

4. Clean-room recovery capability:

To set up an isolated environment to rebuild systems without reintroducing compromise, organizations need to set up what we call a ‘Digital Jump Bag’. This is a secure, isolated repository containing everything required to establish a trusted recovery starting point to rebuild systems without reintroducing compromise.

5. Validated ability to operate

The next step is to validate the ability of the MVC to operate through realistic crisis scenarios. Resilience must be proven under real-world conditions. Practice is important here because an untested plan remains theoretical. Rehearsals will also help to answer the Board’s most direct question in the event of a cyberattack – how long will it take to restore critical services to a trusted state?

Recovering faster by restoring what matters most

The most common cyber resilience risks are failing to define what must come back first and how to bring it back in a state that can be trusted. That’s the difference between recovery as a process and recovery as a capability.

The MVC isn’t static. As an organization evolves, its definition must evolve too. But the principle stays the same: recovery improves when organizations stop trying to restore everything and start restoring what matters.

We’ve featured the best endpoint protection software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit