The COO's Guide to Cyber Resilience: Part Three : Protect, Contain & Recover
Our practical series continues in this third part of the series. Providing a practical goal is not to prevent every attack, it is to make sure that an attack cannot stop our critical business services. That approach reframes and removes the fear out of the subject and gives the COO the test that they can measure.
The Five Disciplines, that Carry most of the Weight
1. Start from the Business, not the Network. Name the handful of services the business cannot fail at (taking orders, paying, producing, settling client money) and set a tolerance for how long each can be down. Map each service to the dependancies (systems, data, people and suppliers) they depend on. This is the same mapping continuity and operational resilience already requires, and probably already exists in your business. It is ready to tell the security team where your protection money is wisely spent.
2. Get the Fundamentals right and Keep them right. Breach data constantly shows attackers mostly walk through known doors. In the 2026 Verizon report, exploitation of known vulnerabilities overtook stolen credentials as the leading way in, at 31% of breaches, and only about a quarter of the most actively exploited vulnerabilities were fully fixed.
For a COO these fundamentals are a very short list: multi factor authentication on every remote and administrative account, prompt patching of internet facing equipment, retirement of unsupported systems, and backups that are isolated, immutable and restored in test. Cyber Essentials Plus is a sensible external baseline for both the business and for your suppliers.
3. Limit the Blast radius by Design.
Assume something will get in, thats right. Now decide in advance how far it can travel. Separate your networks so that office IT cannot reach production or payment systems freely; give staff and suppliers only the access their role needs; keep administrator accounts separate from everyday accounts; and harden the service desk, because password resets and account recovery are a favoured route for social engineering. Containment is also a governance decision: agree now who may isolate a system, take a service offline or cut a supplier connection, so that decision is not debated at 3am. Just clear preventative work to make it harder and hardening
4. Rehearse running the Business without its Systems.
The airports affected by the Collins Aerospace incident kept flying because they could fall back to manual check in. Every critical service needs a documented degraded mode, the materials to run it, and staff who have practised it. This is where continuity planning and cyber response meet most directly. Mature your response and the people responsible for it.
5. Recover to a Plan, Measure to Business Terms.
Having backups is not the same as being able to rebuild cleanly. Agree the order in which services return, start with heartbeat services, test how long a clean rebuild of a critical system actually takes, and compare that time with the tolerance set in step one. The gap between the two is the most useful single number a COO can ask for.
Wrap these in a standing detection and response capability: round the clock monitoring, an incident response retainer agreed before it is needed, and a crisis management team that has exercised and experienced a cyber scenario with legal, communications and regulatory notification in the room.
Managing the Function
Naturally the COO owns the outcome (services stay within tolerance) and delegates the specialism (how attacks are prevented and then contained). That division keeps cyber accountable to the business without turning the COO into a security engineer.
• Independent Challenge. The person who leads security should not report solely to the person who runs IT delivery, or security findings compete with delivery deadlines and lose. A line to the COO or chief risk officer, with direct access to the audit or risk committee, is the more defensible model.
• One Forum. A single resilience group, chaired by the COO, covering cyber, third party risk, continuity and crisis management, removes the gaps that appear when four committees each assume another is watching.
• Right Sizing. Smaller firms rarely need a full time CISO; a part time or fractional CISO plus a managed detection service is often proportionate. The managed provider then becomes one of your most critical suppliers, and the Cyber Security and Resilience Bill is bringing many of them into regulatory scope for that reason.
Measures that tell the COO something
Activity counts (attacks blocked, training completed, phishing clicks) say little about resilience. Outcome measures do, here are a few helpful guidelines to look for.
Measure | What it tells the COO |
Tested time to restore each critical service, against its tolerance, and core groups | Whether recovery promises are real, how dependant is the reliance |
Share of critical internet facing vulnerabilities fixed within the agreed window | Are the most common entry routes closed |
MFA coverage across staff, administrator and supplier accounts | Whether stolen passwords alone can get in |
Top tier suppliers have current control evidence with tested stress plans | Whether supply chain exposure is actually managed, and workarounds exist |
Exercise actions closed on time | Lessons become changes, which beed maturity |
Time to detect and contain in the last incident or exercise | How large the blast radius would be, how quickly it will be contained |
Unapproved AI tools in use | Whether data is leaving through the side door, or decisions are not being validated |
• Board Literacy. The Cyber Governance Code expects directors themselves to build enough cyber understanding to challenge what they are told. A short annual board session, built around the organisation's own scenario rather than generic threat statistics, is the most efficient way to meet that expectation. Have you NED experience to draw on?
So, the Twelve questions the COO should ask:
Here is our guide to the twelve clear questions that ask for evidence, not reassurance. Each one below can have a weak answer, that's what the COO is listening for.
On What Matters
1. Which services would hurt us most if they stopped for a week, and how long can each be down before the harm is intolerable? Weak answer: Provides a list of Systems rather than Business Services.
2. For each of those Business Services, which suppliers could stop it? Weak answer: "The procurement register has that information".
On Protection and Blast Radius
3. If one staff laptop or one supplier account were taken over this afternoon, what could the attacker reach? Weak answer: "Our firewall would stop that".
4. Who can authorise isolating a system or cutting a supplier connection out of hours, and have they done it in an exercise? Weak answer: "We would get together on a call".
5. How many of our critical internet facing systems are unpatched beyond our agreed window today? Weak answer: A percentage figure with no list or evidence behind it.
On Recovery
6. When did we last restore a critical system from backup, end to end, and how long did it take compared with our tolerance? Weak answer: "Backups run Nightly and are sucessful and protected".
7. Could we operate our most important service manually for three days, and who has practised it? Weak answer: Silence, Probably or In Theory.
On Suppliers
8. Which of our top tier suppliers would tell us within 24 hours if they were breached, and is that in the contract? Weak answer: "They are ISO certified, its in their SLA".
9. Where are several of our critical services relying on the same provider? Weak answer: No one has looked.
On Assurance and AI
10. What has independent testing found in the last year, and which findings remain open? Weak answer: Only internal self assessment.
11. Which AI tools are staff using, approved or not, and what data is going into them? Weak answer: "We have a policy".
12. If we had to notify a regulator within 24 hours, who drafts it, who approves it, and have we rehearsed it? Weak answer: "Legal would handle it".
Next in the series: Part 3 weighs risks against rewards, sets out where AI helps and where it exposes the business, and gives a 30, 90 and 180 day plan.
Chris Oliver FBCI is Principal Director of Armstrong Resilience, a Guernsey based consultancy and software house specialising in business continuity, cyber security, third party risk and resilience.
hello@armus2.com or +44 (0) 1481 251683
Comments