Defining the MVC: Recover faster from cyberattacks by restoring what matters most

Most organizations in UK and across Europe don’t struggle to recover from cyberattacks such as ransomware because they lack backups .

They struggle because they try to restore everything at once.

In the aftermath of a major cyber incident, the instinct is to bring every system back online as quickly as possible.

It feels like the fastest path back to normality.

However, in reality, this approach often slows recovery down, reintroduces cyber risk and undermines trust just when the organization needs it most.

In fact, those that recover fastest start from a different premise.

They assume large parts of their organization will be unavailable or untrusted, and they plan accordingly.

This mindset leads to a much clearer goal - restore what matters most, quickly, and in a state you can trust.

What is critical to survival? Focusing on the critical areas of an organization is the idea behind the Minimum Viable Company (MVC) concept, sometimes referred to as the Minimum Viable Organization.

It is a definition of what must exist for the organization to survive in challenging conditions such as a cyber incident.

It’s not just a technology concept, it’s a business definition of survival in terms of the minimum combination of people, processes, technology, documentation , facilities, and third-party dependencies required to keep a business functioning and creating value.

Where to start getting an MVC up and running? There are five key capabilities when it comes to operationalizing an MVC: 1.

Clarity on critical services: A precise understanding of the systems and dependencies that directly support revenue and mission-critical operations is needed here.

To understand the MVC, it is key to map systems to business value.