Resilience and Recovery
Explain the importance of resilience and recovery in security architecture
What you will learn
- Separate recovery time objective from recovery point objective, and know what each measures.
- Compare the three alternate site types by cost and time to operation.
- Name the plan test types and know what each actually proves.
- Explain why an untested backup is not a backup.
"We have backups" is not an answer to the recovery question. The real question is two numbers the organisation sets before the incident: how many hours the service can be down, and how much work it can afford to lose. Every technical decision after that — backup frequency, alternate site type, availability design — follows those two numbers.
Recovery time vs recovery point
| RTO | RPO | |
|---|---|---|
| Measures | Time: how long we can stay down | Data: how much we can afford to lose |
| Direction from the outage | Forward — until we are back | Backward — to the last good copy |
| Which decision it drives | The alternate site type and the availability design | Backup frequency and replication |
One letter separates them
RTO has the T of Time — the time until we are back. RPO has the P of Point — the point in the data we return to. So if the question asks "how many hours of downtime can we take", it is RTO; if it asks "how much work can we afford to lose", it is RPO. NIST's definitions are precise: the first is the length of time a system can be in the recovery phase before harming the organisation's mission; the second is the point in time to which data must be recovered after an outage.
Alternate sites
| Hot site | Fully ready: hardware and current data. Operational in minutes. The most expensive option. |
|---|---|
| Warm site | Hardware and network ready, data not current. Needs hours. The middle ground. |
| Cold site | Space, power and connectivity only. Days to bring up. The cheapest. |
| Geographic dispersion | The distance between sites. An alternate site in the next building does not survive a flood that takes the district. |
| Platform diversity | Varying platforms and providers, so one flaw or one provider's outage cannot take everything down. |
Backups
| Onsite / Offsite | A near copy for fast restore and a distant copy that survives a site disaster. You need both. |
|---|---|
| Replication | Continuous copying to another location. It pushes RPO toward zero and costs more. |
| Snapshot | A point-in-time image of a system. Fast, and not a substitute for an independent copy if the storage itself fails. |
| Journaling | Recording every change, so any moment can be returned to precisely. |
| Backup encryption | A backup is a full copy of your sensitive data outside your usual controls. Always encrypt it. |
Testing the plans
| Tabletop exercise | A discussion around a table: what would we do if? The cheapest test; it exposes gaps in the plan, not in the systems. |
|---|---|
| Simulation | Simulating an incident with real procedures without touching production. |
| Parallel processing | Running the alternate site alongside the primary and comparing, without moving live work to it. |
| Failover test | Actually moving live work to the alternate. The only test that proves recovery works — and the riskiest. |
An untested backup is not a backup
The best-known failure in this area: backups taken for years and never test-restored, so the day they are needed they turn out incomplete, corrupt, or locked behind a lost key. What is measured is the restore, not the copy. If the question says backups exist but were never tested, that is the gap however sound the rest of the architecture looks.
Real-world example: the two numbers decide the budget
A bank and a public library both want a recovery plan. The bank sets RTO at fifteen minutes and RPO at zero: not one transaction may be lost. That requires a hot site, continuous replication, and a very high cost. The library sets RTO at two days and RPO at twenty-four hours: losing a day of catalogue updates is acceptable. A cold site and a nightly backup suffice. Notice the difference is not in the quality of the team but in what downtime costs — and the two numbers are derived from that, not from technology.
What matters on the exam
- RTO is time, RPO is data. The question gives you one and asks for the technical decision that follows.
- An RPO near zero means replication, not a nightly backup. Frequency follows the number, not the reverse.
- "Ready in minutes" = hot site, "an empty space with power" = cold, and between them warm.
- A tabletop exercise exposes gaps in the plan only. If the question asks for proof that recovery actually works, the answer is a failover test.
- Geographic dispersion matters: two sites in one city fall together in a regional disaster.
Quick check
Answer in your head first, then reveal.
An organisation says: "we cannot lose more than five minutes of transactions". Which number is that, and what follows?Reveal the answer
That is an RPO of five minutes — about data, not time. The consequence: near-continuous replication, because an hourly backup can lose up to sixty minutes of work.
What does a failover test prove that a tabletop exercise does not?Reveal the answer
That the systems actually work: the data is there and intact, and the team can bring things up within the target time. A tabletop tests the plan and the understanding, not the capability.
Why is an alternate site in the next building not enough?Reveal the answer
Because it shares the primary's risks: a flood, a fire, or a regional power cut takes both. Geographic dispersion is a requirement, not a refinement.
Why are backups always encrypted?Reveal the answer
Because a backup is a complete copy of your most sensitive data, usually moved and stored outside your normal controls — at a third party or on media in transit. Whoever steals the backup steals everything at once.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.