Our approach and framework alignment
Capability assessment with business decisions in view.
OCRR assesses existing Operational Cyber Resilience capabilities and connects the findings with operational priorities, productive capacity and financial decisions. Understand the scope of the assessment and how it can support wider security frameworks such as Cyber Defense Matrix, MITRE ATT&CK, incident response phases, etc.
How the assessment works.
Our Operational Cyber Resilience Rating (OCRR) is delivered exclusively by a consultant using the Cyber Resilience ROI Assessment Tool. It reviews four connected disciplines: Operational, Data, Financial and People Resilience.
| Stage | Basis of assessment | Your next decision |
|---|---|---|
| Industry Defaults | Industry-default assumptions provide an initial generic representation and five-page Executive Summary; they do not reflect your actual environment. | Which capabilities and assumptions warrant organisation-specific review? |
| Guided | Information about your existing environment, policies and recovery arrangements refines the assessment. | Where should your organisation investigate or improve? |
| Elevated | Agreed policy, process and technology changes are compared with the Guided position. | Which improvement options warrant investment and further validation? |
The initial no-cost industry generic summary is available within 2 days. Guided requires less than 2 hours of your time, with a detailed overview within 7–14 days. Agree scope, information requirements, delivery start point and commercial terms when arranging further work.
How OCRR fits alongside other approaches.
Choose the approach that answers your immediate business question. Financial risk modelling, continuous monitoring, live control testing and a capability assessment serve related but different needs.
| Approach | Primary decision it supports |
|---|---|
| OCRR capability assessment | Understand existing Operational Cyber Resilience, financial context and improvement priorities through a delivered, staged assessment with limited client involvement. |
| Cyber risk quantification | Examine financial risk models and scenario-based loss assumptions. |
| External security ratings | Review externally observed security posture and supplier findings. |
| Breach and attack simulation | Obtain technical evidence of how security controls behave against selected test activity. |
| Enterprise resilience platforms | Maintain broader service dependencies, impact tolerances, exercises and ongoing resilience workflows. |
OCRR can help establish where to focus. Specialist testing, response expertise and service-dependency evidence can then support the assurance and operational work your organisation requires.
How OCRR supports the Cyber Defense Matrix.
OCRR adds business-impact and investment context to capability discussions using Sounil Yu’s Cyber Defense Matrix. The published matrix organises Identify, Protect, Detect, Respond and Recover across Devices, Apps, Networks, Data and Users, with dependencies on people, process and technology.
You can use the assessment to discuss which capability gaps relate to critical services, which recovery assumptions need scrutiny and which investments deserve investigation.
| Matrix function | OCRR contribution to your decision | Additional evidence needed |
|---|---|---|
| Identify | Use estate, workforce, storage and agreed disruption assumptions to discuss existing capability and business priorities. | Asset ownership, critical-service dependencies and control inventory. |
| Protect | Compare the business rationale for agreed technology or policy improvements. | Applicability, deployment costs and evidence of control effectiveness. |
| Detect | Explain why time without usable services matters to people and operations. | Detection telemetry and validated detection times. OCRR does not measure detection coverage. |
| Respond | Inform priorities using affected employees, recovery labour and governance considerations. | Response playbooks, escalation, communications and capability evidence. |
| Recover | Compare prioritised and whole-estate recovery assumptions with productivity and financial implications. | Recovery tests, trustworthy data and validated application and network dependencies. |
Devices, Data and Users connect with recovery, storage and People outputs. Apps and Networks require additional dependency evidence to establish usable service recovery. Governance can inform ownership and budget decisions across the matrix without adding another function.
A populated matrix requires a separate inventory of controls, evidence and owners. Estate counts alone cannot establish coverage.
OCRR alignment with MITRE ATT&CK.
MITRE ATT&CK describes observed adversary tactics and techniques and supports threat modelling and defensive assessment. MITRE recommends prioritising relevant techniques rather than pursuing blanket coverage.
A consultant can use relevant ATT&CK behaviours as context for a capability review, record affected assets and examine the recovery arrangements and assumptions through OCRR. Technique selection needs support from threat intelligence and the client’s environment.
| Illustrative technique | Business question for OCRR | Evidence needed |
|---|---|---|
| T1486 · Data Encrypted for Impact | Under agreed data-unavailability conditions, how would existing recovery arrangements support employees, critical services and productive capacity? | Affected scope, recovery tests, data availability and service dependencies. |
| T1490 · Inhibit System Recovery | How robust are the recovery options being assumed if recovery mechanisms are impaired? | Protected recovery copies, recovery architecture and validated alternative restoration paths. |
OCRR and seven incident-response phases.
The following uses Cyber Management Alliance’s seven-phase model: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned and Continuous Testing. OCRR’s contributions are proposed advisory applications.
| Phase | How OCRR supports your decision | Required operational evidence |
|---|---|---|
| 1 · Preparation | Establish an existing-capability baseline, workforce assumptions and recovery priorities; identify investment questions. | Approved plans, owners, critical-service objectives and validated inputs. |
| 2 · Identification | Use agreed disruption breadth to review affected business areas and resilience assumptions. | Actual incident findings. An “Attack Effect” input is a planning assumption, not a detection result. |
| 3 · Containment | Inform discussion of isolation trade-offs and the employees or services that may lose access. | Response expertise, containment options and authorised operational decisions. |
| 4 · Eradication | Make recovery labour and dependencies visible when considering work needed before restoration. | Forensic findings and evidence that the environment is suitable for recovery. |
| 5 · Recovery | Compare prioritised and full-estate recovery, RTO status, productivity and financial implications. | Practical restoration tests and validation of usable business services. |
| 6 · Lessons Learned | Compare observed disruption with assumptions; revise recovery priorities and investment questions. | Actual timelines, impacts, costs and an agreed post-incident review. |
| 7 · Continuous Testing | Use planning scenarios to guide rehearsal priorities; refresh inputs and track improvement evidence. | Exercises and technical recovery tests performed separately. |
OCRR’s strongest direct connection is to preparation and recovery planning, where its outputs make the implications of existing capability visible. Identification, containment and eradication depend on operational response capabilities. Lessons learned and testing provide evidence to improve subsequent assessments.
Keep assessment and assurance clearly connected.
The framework alignments describe proposed reporting and advisory uses. They do not establish automated framework mapping, technical coverage scoring, validated control effectiveness or endorsement by the framework owners.
Leadership gains business and investment context while retaining the specialist assurance, technical evidence and response expertise needed to execute the plan.
Framework sources
- Sounil Yu · Cyber Defense Matrix
- MITRE · ATT&CK resources
- MITRE · T1486 Data Encrypted for Impact
- MITRE · T1490 Inhibit System Recovery
- Cyber Management Alliance · Seven phases of incident response
Framework references reviewed for the Comparative Value and Benefits report, 20 October 2026.
Explore the connected outputs.
Clarity today. A more resilient tomorrow.
Make your next resilience decision better informed.
Start with a no-cost, industry-based Executive Summary. Then decide whether to refine the assessment around your organisation and explore improvement options.
