What happens when a federal agency discovers during a cyberattack that its recovery plan describes a capability it does not actually possess?
Agencies have invested heavily in preventing cyber incidents through zero-trust architectures, stronger monitoring, improved detection and increasingly sophisticated incident-response plans. Those investments matter. But they do not answer one critical question:
If essential systems went down today, how quickly could the mission actually recover?
Agencies operate through complex ecosystems of cloud platforms, legacy systems, operational technology, contractors, shared services, data and mission partners. A disruption in one area can quickly cascade across others. Cyber recovery therefore cannot remain primarily an IT concern.
Recovery is a mission capability.
From Recovery Plans to Recovery Readiness
Most agencies have recovery plans. Fewer can demonstrate that those plans will work under operational pressure.
Recovery-time objectives, compliant systems, available backups and assigned responsibilities are important, but they do not prove that an agency can restore critical mission capabilities when needed.
NIST SP 800-61 Revision 3 reinforces a broader approach by integrating incident response across the Cybersecurity Framework 2.0. Recovery includes prioritizing restoration, verifying assets, validating essential services and confirming successful restoration.
The question is no longer simply, “Do we have a recovery plan?” It is: “Can we demonstrate that the mission can recover?”
Five Questions Leaders Should Ask
Executives do not need to become incident-response engineers, but they should know whether organizational confidence is supported by evidence.
1. What must recover first?
Not every system has equal mission value. Recovery priorities should reflect mission criticality and the services, data, applications, people and infrastructure supporting essential outcomes.
2. How recently have we proved it?
Testing a backup is not the same as demonstrating recovery. Exercises should test whether systems, data, identities, dependencies, communications and decision authorities can function together under realistic conditions.
3. Can we trust what we restore?
Restoring compromised data, configurations or software can reintroduce an incident. Recovery requires verification, not simply restoration.
4. What dependencies could stop us?
A restored application may remain unusable because an identity service, network, cloud environment, contractor or external data source is unavailable. Leaders need visibility into these dependencies before an incident exposes them.
5. Who makes the decisions?
Recovery quickly becomes a governance issue. Who establishes restoration priorities, accepts residual risk, authorizes reconnection and determines when operations can safely resume? Those decisions should not be invented during a crisis.
Measure What Matters
Recovery readiness should be measurable. Leadership dashboards should move beyond whether plans and exercises exist and instead show:
- Percentage of mission-critical services successfully recovered during exercises
- Demonstrated versus required recovery time
- Percentage of critical backups integrity-tested
- Critical services with unresolved recovery dependencies
- Time required for critical recovery decisions
- Unresolved lessons from previous exercises
These measures distinguish assumed readiness from demonstrated readiness.
A four-hour recovery-time objective is an assumption. Repeatedly restoring the capability within four hours under realistic conditions is evidence.
A Backup Is Not Recovery
One of the most dangerous assumptions is equating backup availability with recoverability.
CISA recommends offline, encrypted backups and regular testing of their availability and integrity. NIST guidance likewise emphasizes creating, testing and incorporating backups into recovery exercises.
But a backup is an asset. Recovery is an outcome.
An agency must access the backup, verify its integrity, restore it into a trusted environment, reconnect dependencies and return the capability safely to mission operations.
Technology alone cannot accomplish that. Recovery also depends on people, processes, governance, communications and leadership decisions. Exercises must test the enterprise, not merely the technology.
Create a Recovery Learning Loop
Every exercise and real-world incident reveals something: hidden dependencies, unclear authorities, outdated procedures, technology constraints or incorrect assumptions.
Those lessons should feed directly into architecture, investments, training, continuity planning and future exercises:
Plan → Exercise → Measure → Learn → Improve → Revalidate
Over time, agencies move from documenting recovery to engineering resilience.
The Executive Test
Executives should ultimately be able to ask two words: “Show me.”
Show me that our highest-priority mission services can be restored. Show me how long it actually takes. Show me that restored data can be trusted. Show me our remaining dependencies and what we learned from the last exercise.
That changes the conversation from confidence based on plans to confidence based on evidence.
Because after a cyber incident, resilience will not be measured by how comprehensive the recovery plan looked before the attack.
It will be measured by whether the mission kept moving afterward.
Dr. Rhonda Farrell is a transformation advisor with decades of experience driving impactful change and strategic growth for DoD, IC, Joint, and commercial agencies and organizations. She has a robust background in digital transformation, organizational development, and process improvement, offering a unique perspective that combines technical expertise with a deep understanding of business dynamics. As a strategy and innovation leader, she aligns with CIO, CTO, CDO, CISO, and Chief of Staff initiatives to identify strategic gaps, realign missions, and re-engineer organizations. Based in Baltimore and a proud US Marine Corps veteran, she brings a disciplined, resilient, and mission-focused approach to her work, enabling organizations to pivot and innovate successfully.
Leave a Reply
You must be logged in to post a comment.