Topic starter
09/07/2026 3:26 pm
TL;DR: Boards and regulators are pushing organisations toward resilience outcomes, while AI systems, backup dependencies, and cross-functional recovery make traditional disaster recovery insufficient, according to Commvault. The real shift is operational: resilience must be continuous, validated, and owned across teams rather than treated as an afterthought.
Editorial analysis by NHI Mgmt Group, based on content published by Commvault: “When Uncertainty Becomes the Operating Condition”.
Key questions
Q: What breaks when disaster recovery is treated as resilience?
A: Recovery often breaks at the point where backups exist but the organisation cannot restore a whole service safely under stress.
Q: Why do board expectations change the way organisations handle cyber resilience?
A: Boards now view outages as business harm events, so recovery performance becomes a governance and accountability issue rather than a technical convenience.
Q: What are the signs that a resilience programme is too siloed?
A: Common signs include unclear restore authority, recovery playbooks that depend on one location or team, and exercises that stop at backup verification instead of full service restoration.
Practitioner guidance
- Define recovery decision rights Assign named owners for restore approval, failover authority, and cross-regional execution before a disruption removes normal coordination paths.
- Test end-to-end restoration under stress Run exercises that validate service recovery, not just backup completion, and include identity systems, administrative access, and downstream dependencies.
- Validate recovered workloads before production return Require integrity checks, dependency confirmation, and compromise screening before reintroducing systems, data, or AI assets into live operations.
Bottom line: Cyber resilience now depends on continuous restoration capability, not just the existence of backup copies or disaster recovery plans.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:46 pm
ResOps is the right response to a recovery problem that traditional disaster recovery was never designed to solve. Backup assurance answers whether data exists; resilience assurance asks whether the service can be restored safely, end to end, under stress. That distinction matters most where identity, privileged access, and operational coordination determine whether restoration can actually happen. Practitioners should treat recovery as a governed capability, not a backup outcome.
A question worth separating out:
Q: How should organisations govern recovery access for critical systems?
A: They should pre-define who can approve restoration, which privileged roles can execute it, and how fallback access is used when the primary team is unavailable. Recovery access should be part of governance, with tested roles and escalation paths that work even when normal operating assumptions do not.
👉 Read our full editorial: Cyber resilience needs ResOps when disruption becomes the norm