Topic starter
09/07/2026 3:32 pm
TL;DR: Misalignment between IT and security slows detection, complicates recovery, and widens blast radius, according to Commvault, which frames unified incident response and recovery, guided workflows, and Secure by Design as the operating model for cyber resilience. The real issue is governance continuity, because resilient recovery fails when operational and security decisions are not coordinated.
Editorial analysis by NHI Mgmt Group, based on content published by Commvault: “The Art of Alignment: A Step-by-Step Guide to Building a Shared Mindset”.
Key questions
Q: How should teams coordinate IT, security, and recovery during a cyber incident?
A: Teams should use a single incident command model that assigns clear ownership for detection, containment, recovery, and validation.
Q: Why does misalignment between IT and security increase cyber risk?
A: Misalignment increases risk because it slows containment, creates inconsistent recovery decisions, and widens the time window in which attackers can move or persist.
Q: What breaks when recovery is handled separately from incident response?
A: The organisation loses continuity between what was found, what was contained, and what is safe to bring back online.
Practitioner guidance
- Standardise incident-to-recovery handoffs Define a single workflow that carries compromise evidence, recovery approval, and restoration status across IT and Security without manual re-entry.
- Make restoration conditional on security validation Require every recovery runbook to confirm affected assets, active indicators, and containment state before production return.
- Align shared resilience KPIs Track time to detection, time to validated recovery, and readiness test completion as joint metrics for IT and Security leaders.
Bottom line: Misalignment between IT and Security is not just inefficient, it changes how quickly an organisation can detect, contain, and safely recover from incidents.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:54 pm
Shared operational control is now part of cyber resilience. Resilience is not only about backup capability or response tooling. It depends on whether IT and Security can make the same recovery decision with the same evidence at the same time, which is a governance property as much as an operational one. Where that shared control is missing, response speed drops and recovery becomes less trustworthy. Practitioners should treat cross-functional execution as a resilience control surface.
A question worth separating out:
Q: What should organisations measure to know whether resilience alignment is working?
A: Use shared metrics that cover time to detection, recovery speed, restoration validation, and readiness testing outcomes. If those measures do not improve together, the teams may be recovering faster while actually validating less thoroughly. Alignment works when operational speed and security assurance improve at the same time.
👉 Read our full editorial: IT and security alignment is becoming a cyber resilience control