5 Markers of Cyber Maturity 

Même si les organisations peuvent citer certaines mesures de cybersécurité comme prioritaires, c’est leur comportement qui compte vraiment. C’est l’un des principaux enseignements tirés de notre premièreCyber Recovery Rapport de préparation, dans le cadre de laquelle nous nous sommes associés à GigaOm pour mener une enquête auprès de 1 000 responsables mondiaux des technologies de l’information et de la sécurité.

When analyzing the most resilient organizations, we found that they employed many measures, but five practices rose to the top when determining their true readiness. We call these practices maturity markers (see 5 Markers of Cyber Recovery Readiness, below).

Organizations demonstrating four or five markers are considered cyber mature. These companies report experiencing fewer breaches and recovering faster when they do get breached.

Cependant, notre enquête a révélé que seules 4 % des organisations ont mis en place l’ensemble des cinq indicateurs, et que 13 % seulement en appliquent au moins quatre. Au bas de la courbe de maturité, 14 % n’ont mis en place aucun indicateur clé.

While fewer than half of all organizations feel confident in their recovery plans, more than half of cyber mature organizations (54%) feel substantially more confident in their ability to recover critical systems and data following a major incident.

5 indicateurs de l’état de préparation à la Recovery après un incident informatique

An organization’s level of cyber maturity can be measured by the presence of five markers. The most mature, cyber-ready organizations demonstrate four or five of these:

• Des outils de sécurité permettant une alerte précoce face aux risques, y compris les risques liés aux personnes internes. 

Early warning security tools are technologies and systems designed to detect potential cyber threats before they can cause significant harm. These tools aim to identify risks at the earliest possible stage, allowing organizations to respond proactively rather than reactively. Examples include Intrusion Detection Systems, Deception Technology, Intrusion Prevention Systems, Security Information and Event Management, User and Entity Behavior Analytics, and Endpoint Detection and Response.

• Un site « dark » ou un système secondaire dont la propreté est avérée est en place.   

Maintaining an isolated, pre-configured or dynamic isolated recovery environment (for example, a cleanroom) that remains unaffected by cyber incidents at the primary site. This secondary site can be quickly activated for business continuity and data integrity in the event of a cyber attack or major failure. It enhances cyber resiliency by providing a secure failover option, minimizing downtime and complexities of failover.

• Un environnement isolé permettant de stocker une copie immuable des données.   

Involves maintaining a separate, air gapped (that is, immutable and indelible) copy of data secured behind a third party’s infrastructure. The data remains unchanged and protected from cyber threats, including ransomware and malicious insider actions. It enhances data integrity and availability, providing a reliable recovery option in case of data corruption or loss.

• Définition de guides opérationnels, de rôles et de processus pour la gestion des incidents.   

A crucial capability for cyber resilience for a structured and efficient response to cyber incidents. Tested runbooks provide step-by-step instructions for handling various types of incidents, reducing confusion and response time. Clearly defined roles and processes ensure that every team member knows their responsibilities, promoting coordinated efforts. This preparedness speeds up recovery and helps maintain operational continuity during and after cyber events.

• Mesures spécifiques visant à démontrer l’état de Readiness à la reprise après un incident cybernétique et à évaluer les risques.   

Metrics and tests that demonstrate an organization’s ability to recover from cyber incidents and assess associated risks. These measures, such as regular recovery drills and risk assessments, provide insight into the effectiveness of recovery plans and identify potential vulnerabilities. They are important for cyber resiliency in particular, as well as preparedness, validation of recovery strategies, and to highlight areas for improvement.

Téléchargez leRapportcomplet pour en savoir plus sur la manière dont votre organisation peut mieux se préparer à faire face à une violation de données.