When a Cyber Incident Hits, What Would You Recover First?

Imagine it is Monday morning. A ransomware attack has disrupted critical business services. The immediate threat has been contained, but customer operations remain affected, employees cannot access essential systems and leadership wants to know one thing: What do we recover first and how quickly can we restore it safely?

Finance wants its systems back. Customer-facing teams need their platforms online. Operations needs critical processes running. Meanwhile, IT is assessing which systems can be recovered fastest.

The challenge is that recovery priorities are being debated during a crisis rather than established beforehand.

For CISOs, having security controls, backups and disaster recovery plans is essential, but these capabilities alone do not guarantee effective recovery. Organisations must understand which business services matter most, what technology supports them and what conditions must be met before systems can be trusted again.

This is where a Crown Jewel Assessment, supported by a Cyber Business Impact Analysis (Cyber BIA), becomes critical.

Recovery priorities should not be negotiated during an incident. They should be established, validated and agreed upon long before one occurs.

Why Traditional BIA Needs a Cyber Perspective

Business Impact Analysis (BIA) has long helped organisations identify critical business processes, assess the consequences of disruption and define recovery time objectives (RTOs) and recovery point objectives (RPOs).

However, cyber incidents introduce challenges that require a more security-focused approach.

During a ransomware attack, identity systems may be compromised, attackers may retain access to the environment and backups may contain malicious code or reflect an already compromised state. Restoring an application does not necessarily mean it is safe to reconnect.

CISOs must therefore look beyond availability and consider the integrity and security of the recovery process.

Key questions include:

• Which business services would suffer the greatest impact if disrupted?
• Which applications, data, infrastructure and identities support those services?
• Which assets are most attractive to attackers or could enable widespread compromise?
• Which systems and dependencies must be restored first?
• How can recovery points and restored environments be validated?
• Who owns recovery decisions and has the authority to accept residual risk?

A traditional BIA provides the foundation for understanding business priorities. A Cyber BIA extends this understanding to include cyber threats, technical dependencies, recovery sequencing and security assurance.

The objective is not simply to restore services quickly, but to restore them safely, in the right sequence and within an acceptable level of business risk.

Crown Jewels: Identifying What the Business Cannot Afford to Lose

Crown Jewels are the business services, information assets and technology capabilities whose compromise or prolonged unavailability would have the greatest impact on an organisation.

They are not necessarily the largest applications or the most expensive systems. Their significance lies in the consequences of their disruption.

Depending on the organisation, Crown Jewels may include:

• Critical business services: Customer platforms, payment processing and essential service delivery.
• Sensitive information: Intellectual property, customer records and regulated data.
• Enterprise applications: ERP, financial systems and platforms supporting core operations.
• Identity and access management: Identity providers, directory services and privileged access systems.
• Operational technology: Manufacturing systems and infrastructure supporting essential operations.
• Foundational technology: DNS, network connectivity and shared cloud services that enable critical applications.

Identifying Crown Jewels requires more than maintaining an inventory of important systems. It requires connecting business priorities with the technology and data that underpin them.

Consider identity infrastructure. It may not generate revenue directly, but its compromise can disrupt access across the enterprise and undermine recovery itself. Such dependencies can be as critical as the business applications they support.

The goal is to establish a clear view of what matters most, why it matters and what must be protected and recovered first.

Recovery Depends on Understanding Dependencies

Consider a customer-facing digital platform identified as a top recovery priority. Restoring the application may appear straightforward, but it could depend on identity services, databases, DNS, network connectivity, certificates and cloud infrastructure.

If these dependencies remain unavailable or compromised, the application cannot deliver business value. Reconnecting it to an untrusted environment could also expose it to further compromise.

This highlights an important distinction: business recovery priorities and technical recovery sequences are not always the same.

The business may need a particular service restored first, while the underlying technology must be recovered in a different order.

Dependency mapping helps organisations understand which foundational services must be restored first, where shared dependencies create concentration risk and which gaps could delay recovery.

For CISOs, this provides a practical foundation for recovery planning, security investment prioritisation and collaboration across cybersecurity, IT, business continuity and business operations.

The focus shifts from restoring individual systems to restoring the business services that matter most.

Fast Recovery Is Not Always Trusted Recovery

During a cyber incident, every hour of disruption can translate into lost revenue, operational delays and customer dissatisfaction. Speed matters, but restoring systems before they are sufficiently validated can create further disruption.

A backup may be available but compromised. A server may be operational but still vulnerable to the original attack. A restored application may be clean in isolation but depend on compromised identity infrastructure.

CISOs must therefore balance recovery speed with confidence in the integrity of the restored environment.

This requires organisations to establish clear recovery assurance criteria, including:

• Validating the integrity and suitability of recovery points.
• Investigating the incident to understand its scope and persistence.
• Addressing compromised credentials and privileged access.
• Remediating vulnerabilities that enabled the attack.
• Validating dependencies and security controls before reconnecting systems.
• Defining approval processes for restoring services and accepting residual risk.

The level of assurance should reflect the incident and the criticality of the affected service. However, every critical service needs a defined basis for determining when it is safe to return to operation.

Successful recovery is not simply about how quickly systems come back online. It is about restoring critical business services without reintroducing unacceptable risk.

Turning Crown Jewel Insights into Business Outcomes

A Crown Jewel Assessment and Cyber BIA deliver value beyond incident response. Together, they help CISOs establish a business-aligned view of cyber resilience and make more informed decisions about risk and recovery readiness.

These insights can help organisations:

• Prioritise investments: Focus security spending on assets and dependencies with the greatest business impact.
• Identify recovery gaps: Assess weaknesses in backup coverage, recovery sequencing, access controls and recovery assurance.
• Strengthen accountability: Establish clear service ownership, recovery responsibilities and decision-making authority.
• Validate resilience: Test whether critical business services can be restored within agreed recovery objectives.
• Improve executive alignment: Communicate cyber risk in terms of business disruption, recovery readiness and operational impact.

This also changes the conversation with leadership. Instead of asking whether backups exist or recovery procedures are documented, organisations can assess whether they can restore critical services within an acceptable timeframe and risk threshold.

That is a more meaningful measure of cyber resilience.

The CISO’s Real Test: Knowing What Comes First

Cyber resilience is not achieved through technology alone. It requires organisations to connect business priorities, cyber risks, technical dependencies and recovery decisions into a coherent strategy.

A Crown Jewel Assessment, combined with a Cyber BIA, helps establish this foundation. It enables CISOs to understand what must be protected, what must be recovered first and what conditions must be met before recovery is considered successful.

This work must happen before an incident, when stakeholders have time to align priorities, address dependencies and validate recovery plans.

When a cyber incident strikes, leadership will not simply ask whether systems can be restored. It will ask whether the organisation can continue serving customers, protect critical information and sustain essential operations.

You cannot recover what you did not prioritise. And you cannot confidently restore what you cannot trust.

For CISOs, cyber resilience starts with knowing what matters most—and ensuring the organisation is prepared to recover it when it matters most.