← OCRR overview

Elevated Resilience TTPs Assessment

Appraise the value of change before committing resources.

Multiple assessments to appraise proposed changes to policy, process or technology that could strengthen your existing resilience and improve your OCRR. Compare the Guided position with proposed Elevated outcomes and examine the trade-offs.

Contact SSD to discuss OCRR Discuss your assessment →

Move from findings to an investment discussion.

Multiple assessments to appraise proposed cyber resilience TTPs build on the initial Industry Defaults Assessment and Guided findings, comparing agreed improvement options before you commit resources.

Cyber resilience tactics, techniques and procedures (TTPs) include the policies, processes and technology choices that support your operational arrangements. The assessment helps you explore their business rationale before implementation.

What you can appraise

  • Appraise cyber simulations
    • Network Availability
    • Compromised Backups
    • Data Compromise
    • Data Exfiltration
    • Other agreed disruption scenarios
  • Adjusted policies and processes
    • MVP (minimum viable operational capability)
    • RTO (recovery time objective)
    • Backup Retention
    • OS recovery types
  • Model the operational impact of proposed technology changes
    • Security – Prevent
    • Backup & Recovery
    • Data Posture Management
    • Other agreed technology options

What you can compare

  • Compare Guided versus Elevated TTP outcomes
  • Cost-benefit analysis versus trade-offs
  • Support business case development

Incident Response adjustments

Use the Guided position to review current escalation, service recovery priorities, workforce workarounds and response dependencies. Appraise agreed changes to policies, processes and recovery arrangements through Elevated, then use exercises and operational evidence to validate the proposed changes.

Explore Incident Response adjustments →

A structured appraisal pathway.

Step What you review Why it matters
1 · Agree the baseline The existing capabilities and recovery assumptions assessed through Guided. Provides a consistent reference for the comparison.
2 · Define an improvement An agreed policy, process or technology change and the assumptions it would affect. Keeps the appraisal connected to a specific business decision.
3 · Compare outcomes Guided and Elevated operational, data, financial and people findings. Shows where the proposed change may create value or introduce trade-offs.
4 · Examine complete costs Implementation, transition, ongoing operation and any additional support. Helps avoid comparing a benefit with only part of the required investment.
5 · Establish the evidence needed Feasibility, applicability, service dependencies and validation of the proposed capability. Supports a proportionate approval and implementation decision.

Example: appraising a recovery improvement.

Suppose your organisation is reviewing a proposed recovery technology. Start with your existing recovery capability and the assumptions used in Guided.

  • Which restoration assumptions would the proposal change?
  • How would those changes relate to data availability and usable services?
  • What might they mean for staff workarounds, productive capacity and recovery expenditure?
  • How does the option compare with an adjustment to policy or process?
  • What evidence is needed to support the claimed improvement?

Illustrative appraisal pathway, not a measured customer result or a forecast of a specific attack.

A useful business case includes the trade-offs.

The preferred option may depend on operational feasibility, ownership, cost, implementation time and the evidence available. A favourable modelled comparison is a reason to investigate an option, not proof that its benefits will be achieved.

Appraising a simulation or proposed change in OCRR does not mean the tool executes a cyber simulation, deploys a product or validates control effectiveness. Exercises, technical testing and implementation validation are separate activities.

Bring the right people into the decision.

Finance can scrutinise the assumptions and complete cost. Operations can examine service continuity and workforce implications. IT and security can assess implementation and technical evidence.

Together, the outputs help explain what change is proposed, which existing capability it addresses, what benefit is being appraised and what must be established before approval.

Discuss an Elevated Assessment →

Explore the connected outputs.

Clarity today. A more resilient tomorrow.

Make your next resilience decision better informed.

Start with a no-cost, industry-based Executive Summary. Then decide whether to refine the assessment around your organisation and explore improvement options.

Contact SSD to discuss OCRR Discuss a Guided Assessment →