How do you assess the business impact and risk of data loss and downtime in case of a backup failure?

Business Impact Analysis will give you a good overall idea of where to prioritize your resilience effort, and where your backup, data and operational capabilities should be focused. Sometimes, it will lead to review architecture in order to be able to achieve a better resilience, and reduce potential time to repair, and achieve shorter recovery time objective on the critical business functions.

Assessing the business impact and risk of data loss involves a detailed risk assessment. Drawing from my experience in IT consulting, using both qualitative and quantitative methods enhances this evaluation. For instance, incorporating a weighted risk matrix can precisely quantify potential impacts of various failure scenarios, like hardware malfunctions or cyberattacks. This approach not only prioritizes the risks but also informs the development of more targeted, resilient backup strategies. Additionally, regular scenario planning and simulations can significantly fortify the organization's preparedness, ensuring rapid recovery and minimizing operational disruption.

The risk assessment phase will bring you different kinds of metric which could be quantitative or qualitative. This process will also allow to map risk across the organizations, and eventually identify risks that overlap critical area of the business and therefore, would benefit even more from proper compensation measures.

RPO can be translated in "how much work or production are you accepting to lose". This measurement is not considering the recovery time which is measure by the RTO, therefore, when considering the RPO, we must keep in mind that this is based on the time of the incident, when the data is loss. The time spent after the incident falls under the RTO value.

RTO depends on how fast your recover, basically, from the incident, how long does it takes to return to operations. RTO value should be based on your existing recovery plan, and updated following your latest full recovery test. Recovery is only possible if your backups are valid, and therefore, this value is highly dependent on the success of the recovery.

The cost benefit analysis is often overlooked, as the consideration only involve the actual production loss, and cost of recovery. It can actually be evaluated in a quantitative and qualitative manner. The initial cost of an incident could be based on the average manpower cost, multiplied the amount of work hours lost. Usually this helps justifying a better investment on backup and security. All the technical costs should be included in the evaluation, especially in the the non obvious ones, such as extra bandwidth cost for restoration in cloud, and additional workloads. Backup strategy must include immutable backups, as a cyber incident may lead to backup deletion by an attacker. Immutable backups can't be deleted, even from administrator