The Cyber Resilience Manifesto

Cyber resilience is an extension of information security and an evolution of operational resilience. It is “the ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources.” Developing Cyber-Resilient Systems [1] is a NIST [2] Special Publication which is considered the most authoritative resource available today.

An organization’s cyber resilience efforts primarily aim to implement strategies and tactics that ensure the survivability of mission-critical functions before, during, or after a coordinated, destructive cyber-attack. Such cyber resilience strategies and tactics require capabilities to address the continuously evolving risks from advanced and unpredictable adversaries. This implies expanding threat scenario definition and modeling beyond “severe but plausible” and focusing on capable and motivated adversaries introducing “extreme but plausible” threat scenarios. The defender's goal should be to make it costly and difficult for these advanced adversaries to break into the organization’s environment and execute such an attack.

A fundamental step to achieving cyber resilience is identifying and understanding the organization’s critical assets, i.e., critical information assets (data) and information systems (applications), processes, roles, and third parties that are high-value assets, and developing plans to become resilient-by-design. For such identification to be effective, it must focus on the assets’ inherent impact and consider both the business objectives (Voice of the Customer) and the adversary’s (Voice of the Adversary).

Business resilience is the outcome of well-executed information security, operational resilience, and cyber resilience and is defined by the World Economic Forum [3] as “the ability of an organization to transcend any stresses, failures, hazards, and threats to its cyber resources within the organization and its ecosystem, such that the organization can confidently pursue its mission, enable its culture, and maintain its desired way of operating.”