The Ultimate Guide to Minimum Viability

Develop a Plan 

Developing a plan for minimum viability

Developing a plan for minimum viability starts well before an attack. 
At a high level, these are the practices involved to define what minimum viability means for your organization and how you’ll achieve it in the event of an attack: 
 
Accurate and aligned view of the core processes and dependent systems. 
These are the systems required to minimize downtime so an organization can resume delivering on its mission with minimal disruption (e.g., caring for patients, serving citizens, educating students, supporting customers, etc.).

Organizations usually tier applications and services by priority to the business. For example, ServiceNow’s Business Continuity Management model categorizes applications as:

Understanding the cost of downtime for those core resources. This is most commonly measured in cost per minute/hour/day, customer loyalty, patient care, brand impact, regulatory fines, and more. A 2024 report from Enterprise Management Associates puts the average cost of an outage at $14,056 per minute. 

Clear and actionable plan to restore critical systems, data, and processes. 
This includes a focus on both cyber resilience and recovery, thereby maintaining continuity and trust. Focus on who does what and how the teams work together.


Note that a disaster recovery plan can’t be relied on to cover the damage caused by a cyberattack. In our “Preparedness Gap: Why Cyber-recovery Demands a Different Approach from Disaster Recovery” report, we surveyed 500 IT and security leaders to understand how organizations handle disaster vs. cyber recovery, 92% of respondents said they’ve suffered from attacks explicitly targeting backups.  


71% said those kinds of attacks accounted for half or more of all attacks. This, and other factors, make cyber recovery more complicated.

Practiced ability to enable minimum viability with a focus on cyber resilience. Having a plan alone is not enough. As Mike Tyson famously said, “Everyone has a plan until they get punched in the mouth.”


As part of minimum viability, organizations must include the ability to automate, test, audit, and continually improve rapid restoration, confirming they are ready to remain resilient in the face of evolving threats. This can be tabletop exercises, simulations, and actual testing of the technology involved so you know what to expect when the worst happens.


Remediation of threats and removing back doors prevents further damage. It also prevents bad actors from getting back into the environment, allowing for clean recovery operations without disruption.

Restoration of the previous state without proper threat remediation post-recovery threat scanning, and a period of observability means your systems could be exploited again. Data must be checked and applications purged of potential backdoors and vulnerabilities that could let attackers back in as soon as you think you’ve recovered.

Next-gen cyber recovery architecture.
Enables encryption, immutability/indelibility, hardening, any-to-any portability, and dynamic scaling, thereby increasing overall flexibility.

Establishing a strong approach to minimum viability is particularly important today, when the cost of downtime is significant, both financially and reputationally.  

Recommended practices

Recommended practices for minimum viability

1. Air-gapped copies
Keep immutable, indelible copies of critical data in at least one air-gapped cloud environment.

Cyberattacks often target backup environments to spread malicious code and block easy recovery. Once breached, all data in those networks is at high risk. Immutable and air-gapped copies are usually the last line of defense for recovery.


2. Frequent testing
Go beyond checklists and simulations and automate operational cyber recovery testing for applications, infrastructure, and data required for minimum viability. Cyber recovery is a complex, resource-heavy process that affects all IT operations.

To prepare for breaches, you must test the process at scale, identify gaps and risks, adjust the plan, and repeat. This includes testing incident response plans, disaster recovery plans, and cyber recovery plans, as well as participating in tabletop exercises.

3. Last-known good
Establish and test practices, processes, and automation to verify clean recovery points for critical applications, infrastructure, and data. Recovering clean data is crucial after a breach. Every minute of downtime can cost thousands of dollars, so reinfection can be disastrous for a business. Quickly and accurately identifying and restoring clean data minimizes the impact and helps restore operations before irreparable damage occurs.


4. Isolated forensics
Automate the recovery processes for conducting rapid, isolated forensics, including access and availability of critical security and cyber resilience tooling.

Forensics are critical to understand security incidents and to mitigate damage or prevent them from happening again. Isolating these forensic environments allows for in-depth analysis without the risk of reinfection or lateral movement. It also frees up production environments to recover, rebuild, and quickly restore operations in parallel.


5. Hardened infrastructure
Strengthen overall security by reducing vulnerabilities, minimizing attack surfaces, and improving its ability to resist cyber threats.

A hardened infrastructure safeguards sensitive data, enables system stability, and minimizes the risk of breaches, which can lead to costly downtime and reputation damage.

6. Isolated recovery environment (IRE)/cleanroom
Acts as a safety net for businesses, providing a controlled, secure space to restore operations and systems without the risk of further contamination and a controlled environment for forensics.

If a company’s network is compromised by malware or ransomware, the IRE remains safe from these attacks. This allows the company to restore systems and data securely. A cleanroom is a controlled environment where infected systems can be safely analyzed, cleaned, and recovered before being reintroduced to the network.

You may not need all the steps for every incident but knowing and practicing them are important. As our Preparedness Gap survey shows, cyber recovery plans were partially invoked in more than half of reported incidents. 

Minimum Viability

Conclusion

Identifying and returning to minimum viability is crucial for any organization to recover quickly and maintain essential operations after a cyberattack. Having the right workflows and following best practices are critical to success.