Cyber Recovery

Cyber Recovery: beyond backup

The question is no longer whether you will be attacked, but when. The modern cybercriminal is a professional, armed with advanced techniques that go beyond your traditional security measures. They target not only your production systems, but increasingly and successfully the backups intended for your recovery. This means you are not just looking for Disaster Recovery; you are looking for proven Cyber Resilience capabilities.

So the crucial question is: Can you actually recover after an attack that has infected your IT infrastructure?

Traditional Disaster Recovery plans fall short in this regard. They are designed for local calamities, not for the global, simultaneous impact of a cyber attack. With more than 30 attempted ransomware attacks per minute, the threat is greater than ever. This makes a strategic Cyber Recovery plan necessary for vital organizations and the financial sector in the Netherlands.

Our Cyber Recovery service fills the gaps in existing legislation, such as DORA and NIS2, and makes your organization truly cyber resilient. We go beyond the mandatory checkboxes and focus on the foundation of recoverability so that your IT Resilience does not depend on luck.

Our framework: the PATCH model

ARC People uses the self-developed PATCH model as a versatile framework. It serves as a structured basis for assessing the current situation (baseline Cyber Recovery or audit) and implementing improvements (implementation). It provides a clear, step-by-step approach to ensure your recovery after ransomware, for example.

• P - Plan: This section includes establishing the recovery scope. This means identifying the critical business processes and associated systems, applications and data that must be recoverable. This ensures a focused approach and avoids unnecessary investments.
• A - Isolate, Shut Down, Analyze: This revolves around the preparedness of your backups. This element of the framework focuses on the presence of a physical or virtual airgap, the immutability (immutability) of the backups and the ability to analyze restore data for the presence of malware.
• T - Testing: This phase focuses on validating recoverability. It includes the presence of a thorough test plan, the frequency of testing and the availability of a realistic test environment. After all, a backup is only useful if it actually works in practice.
• C - Crisis Organization: This element includes the structure and procedures for recovery after an incident. This includes the clarity of the crisis organization, the assignment of roles and responsibilities, and the availability of resources for recovery. Even if the IT infrastructure is completely inaccessible.
• H - Recovery: The H focuses on the recovery strategy. This includes the procedures in place for the actual recovery, such as the choice of recovery environment (including in-place, new hardware or the cloud) and the decision on when to start the recovery process.