Topic starter
30/07/2026 10:51 pm
TL;DR: Minimum viable business, or MVB, shifts disaster recovery from restoring systems to restoring the smallest set of business capabilities needed to operate safely, with identity, DNS, routing, observability and cloud configuration often deciding whether recovery actually works, according to ControlMonkey. The real risk is not failed backup, but restoring an environment that still cannot authenticate, route traffic, or prove it is safe to use.
Editorial analysis by NHI Mgmt Group, based on content published by ControlMonkey: “How to Define Your Minimum Viable Business in Disaster Recovery”.
Key questions
Q: What breaks when identity services are not restored during disaster recovery?
A: If authentication, privileged access, or SaaS permissions are missing, restored systems may remain unusable even though workloads and data are back.
Q: Why do cloud recovery plans fail when configuration is not versioned?
A: Because cloud recovery depends on more than data and compute.
Q: How should security teams define minimum viable business for recovery planning?
A: Start by identifying the smallest set of services, data, processes, and approvals needed to continue operating after disruption.
Practitioner guidance
- Map business capabilities to recovery dependencies Identify which customer-facing and internal business services depend on identity, routing, observability, and cloud policy before assigning recovery tiers.
- Version identity and configuration state together Protect IAM policies, groups, roles, service principals, DNS, load balancers, WAF rules, and SaaS permissions as recoverable configuration assets.
- Test survival-mode recovery paths Run exercises that restore only the minimum business capability needed to operate safely while the rest of the environment remains degraded.
Bottom line: Minimum viable business recovery reframes disaster recovery around the business capabilities that must come back first, not around infrastructure alone.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:54 pm
Identity is now a recovery dependency, not a supporting control. When authentication, privileged access, service principals, or SaaS permissions are broken, the business cannot safely use what it has restored. That makes IAM part of resilience architecture rather than an afterthought. Practitioners should treat identity services as first-class recovery assets, not just access infrastructure.
A question worth separating out:
Q: Who should decide what belongs in the minimum viable business?
A: Business leaders should define which services must operate first, CIO and infrastructure teams should define how they can be restored, and security leaders should validate whether the restored state is safe. If one function owns the decision alone, recovery priorities usually skew toward technical convenience instead of operational reality.
👉 Read our full editorial: Minimum viable business recovery depends on identity and config