Notifications
Clear all
Topic starter
09/07/2026 5:54 pm
TL;DR: Enterprises are split between comprehensive and staged recovery strategies, yet 54% lack confidence they can recover from a major disruption or cyberattack and only 46% feel very confident, according to Commvault and GigaOm research. The core problem is that recovery planning remains technology-led when business continuity demands business-first prioritisation.
NHIMG editorial — based on content published by Commvault: Minimum Viable Recovery and the recovery gap
By the numbers:
- 54% of enterprises lack confidence in their ability to recover from a major disruption or cyberattack.
- 96% of organizations surveyed support minimum viable recovery.
- 92% of comprehensive approach adopters can recover to minimum viability in under a week.
Questions worth separating out
Q: How should security teams build a recovery plan around business-critical services?
A: Start by identifying the minimum set of business services that must return first, then map those services to the systems, identities, and dependencies that support them.
Q: Why do recovery programmes fail even after heavy resilience spending?
A: They often measure technical restoration while ignoring whether the organisation can resume critical operations.
Q: What breaks when recovery priorities are based on technical metrics alone?
A: Teams restore what is easiest to see, not what is most important to the business.
Practitioner guidance
- Define minimum viable business services first Identify the smallest set of business functions required to operate and map each one to its supporting applications, identities, and dependencies.
- Rank identities by recovery criticality Classify service accounts, administrator roles, and operational credentials by which business services they restore.
- Pre-assign recovery decision ownership Assign explicit owners for access restoration, privilege approval, and service validation so recovery does not depend on ad hoc coordination during an outage.
What's in the full report
Commvault's full research covers the operational detail this post intentionally leaves for the source:
- The full survey breakdown of how organisations split between comprehensive and staged recovery models.
- The methodology behind minimum viable recovery and how the research team translated it into a business-led framework.
- The underlying response data on recovery confidence, prioritisation, and organisational readiness.
- The practical comparison between technical recovery metrics and business-first restoration priorities.
👉 Read Commvault’s research on minimum viable recovery and the recovery gap →
Minimum viable recovery: is your recovery plan business-led?
Explore further
09/07/2026 5:55 pm
Business-led recovery is now an identity governance problem, not just a resilience problem. Recovery order determines which identities, privileges, and service dependencies return first, so it cannot be separated from IAM and NHI governance. If the business cannot define what must come back first, the recovery programme will default to what is technically visible instead of what is operationally critical. Practitioners should treat recovery prioritisation as a control plane for access restoration.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Who should own recovery sequencing for identities and services?
A: Recovery sequencing should be owned jointly by security, infrastructure, and business stakeholders, with clear decision rights defined before an incident. Identity restoration, especially for privileged and operational accounts, needs named accountability so access comes back in the right order and with the right constraints.
👉 Read our full editorial: Minimum viable recovery exposes the enterprise recovery gap
