Short · Operational resilience · 1 min read
Your Recovery Time Objective Is a Business Promise
By Dr. Lin Clark
A two-hour recovery target sounds reassuring until somebody asks what returns in two hours, whether the data is trustworthy, and who decides it is safe to reopen. Too often, the number was negotiated in a meeting and never demonstrated in a restore.
The operational question
Contingency planning begins with business impact and recovery priorities (Swanson et al., 2010). I start with the service a customer depends on, then trace the infrastructure, identities, vendors, data, and people required to restore it.
What the guidance actually says
Recovery is part of incident response, not a separate exercise that starts after security goes home (Nelson et al., 2025). Restoring a compromised environment before establishing trust can bring the attacker’s foothold back with the application.
Where the plan breaks
Contingency planning and control assessment are part of the NIST control catalog (Joint Task Force, 2020). I want a timed demonstration and evidence that the restored service actually works. A successful backup job is useful, but it is not that demonstration.
The evidence I would ask for
CSF 2.0 connects cybersecurity decisions with business and mission needs (Pascoe et al., 2024). Business owners should set tolerable disruption; technical teams should demonstrate what they can deliver. Neither group should invent the other’s answer.
The decision that matters
Trustworthy systems engineering is a lifecycle discipline (Ross et al., 2022). A restore that worked before a major identity or vendor change is not proof that it still works. The dependency chain must be exercised again.
If your recovery promise has never survived a realistic restore, I can help establish what is actually possible.
References
- Swanson, M., Bowen, P., Phillips, A., Gallup, D., & Lynes, D. (2010). Contingency planning guide for federal information systems (NIST SP 800-34 Rev. 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-34r1
- Nelson, A., Rekhi, S., Souppaya, M., & Scarfone, K. (2025). Incident response recommendations and considerations for cybersecurity risk management: A CSF 2.0 community profile (NIST SP 800-61 Rev. 3). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-61r3
- Joint Task Force. (2020). Security and privacy controls for information systems and organizations (NIST SP 800-53 Rev. 5). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-53r5
- Pascoe, C., Quinn, S., & Scarfone, K. (2024). The NIST cybersecurity framework (CSF) 2.0 (NIST CSWP 29). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.CSWP.29
- Ross, R., Winstead, M., & McEvilley, M. (2022). Engineering trustworthy secure systems (NIST SP 800-160 Vol. 1 Rev. 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-160v1r1