Abid Adam

Business continuity focuses on keeping business operational during a disaster, while disaster recovery focuses on restoring data access and IT infrastructure after a disaster. When we talk about Business Continuity and/or Disaster Recovery (BCM or DRM) from the Application/Data/Information Management perspective, Recovery Point Objective (RPO), Recovery Time Objective (RTO), and Maximum Tolerable Downtime (MTD) are some of the most relevant aspects and are positioned at the the very core of the both processes. Recovery Point Objective (#RPO) is all about data loss tolerance. It is the maximum targeted period in which data can be lost without severely impacting the recovery of operations. If a business process could not lose more than one day's worth of data, then the RPO for that information would be 24 hours. RPO is very useful to help determine the frequency of backups for a given system. Recovery Time Objective (#RTO) is used to identify the planned recovery time for a process or system which should occur before reaching the business process's maximum tolerable downtime. For example, if a business process could not sustain for more than one day without normal operations, then the first RTO should be less than 24 hours. RTOs can be helpful in determining what kind of recovery and/or redundancy may be required. Maximum Tolerable Downtime (#MTD), also sometimes referred to as Maximum Allowable Downtime (#MAD), represents the total amount of downtime that can occur without causing significant harm to the organization's mission. MTD is important to define so continuity planners can select and implement appropriate recovery methods and procedures to ensure downtime does not exceed acceptable levels. If you didn’t defined those for the most important applications (also known as the "crown jewels"), then you didn't set up your BCM/DRM processes properly and you have no real insight in how big is the #impact in case that disaster strikes.

204

10 Komen

Dear Auditors, Auditing Cyber Resilience Cyber resilience is no longer only about technical recovery. Organizations depend on their ability to adapt, withstand, and recover from disruptive events, whether cyberattacks, outages, or supply chain failures. An effective audit must go beyond IT controls and look at the broader business continuity framework. 📌 Assess resilience governance Start with governance. Is there an executive owner for resilience? Are board members engaged? Review policies and charters to see whether resilience is defined, measured, and reported as a strategic capability rather than only a technology function. 📌 Examine risk assessments and impact analyses Business Impact Analyses (BIAs) form the foundation of continuity planning. Audit whether BIAs are current, complete, and aligned with enterprise risks. Weak BIAs lead to recovery priorities that miss what truly matters to the business. 📌 Review continuity and recovery planning Go beyond checking whether a plan exists. Audit the structure: clear roles, escalation paths, and recovery objectives for critical functions. Confirm that plans integrate IT recovery with operations, communications, and supply chain dependencies. 📌 Test backup and recovery effectiveness Audit teams often stop at backup policies. Go further. Verify whether backup data is encrypted, segmented from production, and tested regularly. A backup without validation is a false assurance. 📌 Evaluate crisis management and communication Resilience depends on people as much as systems. Audit whether organizations train employees, run tabletop exercises, and have predefined communication strategies for customers, regulators, and partners. A strong communication plan prevents confusion during crises. 📌 Check third-party resilience Modern enterprises rely on vendors and cloud providers. Audit contracts, SLAs, and vendor risk assessments to ensure resilience expectations are clearly defined and enforced. 📌 Measure resilience maturity Finally, test how results are reported to leadership. Does management receive metrics on recovery time, drill performance, and third-party dependencies? Are lessons learned turned into improvements? Auditing resilience is about confidence: confidence that the business can sustain operations, protect reputation, and recover from shocks. By expanding audits beyond IT systems to governance, planning, people, and vendors, auditors ensure that resilience is built into the enterprise. #CyberResilience #BusinessContinuity #ITAudit #InternalAudit #RiskManagement #AuditLeadership #CybersecurityAudit #OperationalResilience #Governance #CrisisManagement #CyberVerge #CyberYard

51

13 Komen

📊 Risk management maturity isn’t a checklist — it’s a multidimensional capability. If you’re building or auditing a risk program, this 2023 academic model is a must-read. The paper “Risk Management Maturity: A Multidimensional Model” (Bak & Jedynak, 2023) presents a comprehensive framework to assess and evolve enterprise risk management (ERM) practices. It bridges theory and practice in a clear, actionable way. 🔍 Key insights: Five maturity levels from ad hoc to optimized Four core dimensions: Strategy, Processes, People, and Technology Each dimension is broken down into measurable indicators Emphasis on culture, leadership commitment, and risk-aware decision making Useful for self-assessments, audits, GRC roadmaps, or regulatory reporting Why it matters: ✅ Goes beyond ISO 31000 / COSO models ✅ Addresses human and systemic factors in maturity ✅ Great reference for CROs, internal auditors, GRC leads, and consultants 📎 Full PDF attached — valuable for organizations seeking to move from reactive to proactive risk culture. #RiskManagement #ERM #GRC #RiskMaturity #InternalAudit #Compliance #ISO31000 #COSO #Governance #BusinessContinuity #StrategicRisk #RiskCulture

68

Day 6 of 30 – Audit Readiness for Cybersecurity Certifications aren’t just vanity badges — they’re proof of systems, discipline, and trust. In this post, we simplify: 🔹 ISO 27001 – Global ISMS benchmark 🔹 SOC 2 – Cloud-era attestation standard 🔹 DISSA – India’s CMA-powered audit credential Whether you’re in MSMEs, SaaS, BFSI, or healthcare — audits build credibility and mitigate reputational risks. 📲 Swipe through to know what’s best for your setup. #DigitalIndia #DPDPAct #DataProtection #CyberSecurityIndia #MSMECompliance National Informatics Centre, MeitY HLL Lifecare Ltd Steel Authority of India Limited CMA Pushpy Muricken FCMA LLB DISSA .. Institute of Cost Accountants of India The Institute of Internal Auditors Inc. CMA. Deepak Narayanan Khalid Riaz

70

5 Komen

🛡️ SEBI Clarifies Cybersecurity Framework SEBI's April 30, 2025 circular brings much-needed clarity to its Cybersecurity and Cyber Resilience Framework (CSCRF) for all SEBI Regulated Entities (REs). 🔍 Key Highlights: 📊 Updated classification of REs into Qualified, Mid-size, Small-size, and Self-certification categories 📈 Thresholds based on client base, AUM, or trading volume (depending on entity type) 🖥️ M-SOC (Market-Security Operations Center) requirements are now streamlined: Mandatory for Qualified and Mid-size REs + Exemptions granted for entities with <100 clients or very low volume 🔐 HSM (Hardware Security Module) is now compulsory for MIIs & Qualified REs 📝 BSE assigned as reporting authority for IAs/RAs for the next 5 years 📆 Classification must be based on FY 2024–25 and frozen for FY 2025–26 ⏰ Compliance deadline: June 30, 2025 This update enables REs to apply a risk-tiered security model, ensuring regulatory alignment without overburdening smaller players. If you're in charge of cybersecurity, compliance, or IT risk — now is the time to evaluate your classification, confirm SOC obligations, and finalize your cyber audit roadmap for FY 2025–26. #SEBI #Cybersecurity #Compliance #CyberAudit #CyberResilience Nikhil CK Subham Swain, CISA Bharat Sankarushana Darshan Seethal

41

NIST Special Publication 800 NIST SP 800-61r3 Incident Response Recommendations and Considerations for Cybersecurity Risk Management A CSF 2.0 Community Profile Published: April 2025. Credits: Alex Nelson, Sanjay Rekhi, Murugiah Souppaya, Karen Scarfone This publication is available free of charge from: https://lnkd.in/dJerYmHP  https://lnkd.in/dg94zjmH

48