By Tim Sherbak
As organizations continue to embrace AI and digital transformation, data is increasingly at the heart of business strategy. It fuels innovation, informs decisions, and drives customer experiences. At the same time, it has become a prime target for cybercriminals. In this context, cybersecurity leaders – particularly CISOs – are under growing pressure not only to safeguard the perimeter from attacks, but also to quickly respond to these disruptions that risk compromising operations, reputation, or compliance.
Many CISOs already oversee strong security programs focused on prevention, detection, and response. However, as ransomware attacks have become more persistent and sophisticated, there’s growing recognition across the industry that resilience – particularly rapid, secure recovery -needs to be an integral part of the security strategy.
This shift doesn’t require a total overhaul of your current approach. Rather, it invites a deeper collaboration between cybersecurity and IT infrastructure teams, ensuring that backup, recovery, and resilience strategies are aligned with broader risk management objectives. Here are some key areas where CISOs can provide strategic input, ask the right questions, and guide their teams toward stronger cyber readiness.
Evolving from protection to preparedness
Traditionally, security programs have prioritized prevention: firewalls, identity access management, endpoint protection, and network monitoring. These controls are essential and effective. However, experience has shown that no organization is completely immune to compromise. Whether through phishing, software vulnerabilities, or insider threats, attackers often find a way in.
Resilience planning accepts this reality and focuses on how quickly and cleanly an organization can recover. It’s not just about bouncing back – it’s about doing so in a way that maintains business continuity, meets regulatory standards, and preserves stakeholder trust. For CISOs, this may mean expanding conversations around recovery to include not only IT and operations, but risk, compliance, and business leadership as well.
A practical look at backup and recovery readiness
Resilience isn’t new – but the tools and strategies supporting it have evolved significantly. When reviewing your organization’s current posture, here are a few areas that may warrant attention or collaborative improvement:
Backup speed and frequency
Many organizations are now adopting all-flash (NVMe) backup appliances that enable faster backups and more frequent restore points. This matters in a ransomware scenario, where having a recent, uninfected copy of your data can significantly reduce data loss.
Consider exploring with the infrastructure team whether backup windows are short enough to support near-real-time protection for your most critical workloads – and whether those systems can restore data at the speed that the business requires.
Immutable and isolated backups
Immutable backups – read-only copies that cannot be modified or deleted – have become a best practice for defending against ransomware. If your organization doesn’t already use immutable storage, it might be worth discussing options to incorporate it, especially for high-risk or regulated data sets.
Offline and offsite backups (such as air-gapped systems or secure cloud storage) can also provide essential protection if local systems are compromised.
Encryption and access control
As ransomware groups increasingly exfiltrate data for extortion, encrypting backup data is a strong safeguard – especially when combined with multi-factor authentication and role-based access control. Ensuring that backups are secure aligns well with broader zero trust principles that many organizations are already pursuing.
Backup validation and testing
Even the best backup systems can fall short if recovery processes are untested or inconsistently executed. If it isn’t taking place already, consider advocating for periodic validation testing of backup and recovery procedures – either as part of incident response drills or disaster recovery exercises. This is particularly important for ensuring confidence in long-term backup integrity and compliance readiness.
Storage efficiency and deduplication
Efficient backup solutions that include deduplication can help your teams maintain multiple restore points without dramatically expanding infrastructure. This not only improves cost-effectiveness but also strengthens recovery flexibility – enabling the organization to revert to a clean state from multiple historical points.
Strategic alignment and governance
Cyber resilience also has important policy and governance implications. As CISO, your influence is crucial in helping the organization align backup and recovery strategies with regulatory compliance, business continuity requirements, risk frameworks, and incident response and crisis communication plans. It is important to make sure that data protection policies are up to date, well-documented, and tested across different departments. It might also be worth exploring whether the organization is treating backup data as sensitive—subject to the same controls as production environments.
Fostering cross-functional collaboration
One of the most effective ways to advance cyber resilience is by fostering strong collaboration between InfoSec and IT infrastructure teams. Backup systems have traditionally been managed by infrastructure or storage teams, but cybersecurity now plays a critical role in their design and protection. Bringing both teams together to define joint priorities – for example, which systems require immutable backups, which restore points are most critical, or how to handle recoveries during an active incident – can result in a more comprehensive and confident posture.
Facilitating these discussions helps ensure resilience becomes not just a technical objective, but an organizational commitment. Often, it begins with a few key questions:
- If we were hit with ransomware tomorrow, how quickly could we recover?
- Which systems or data sets are most critical to our operations – and are they protected with immutability or isolation?
- Do we have visibility into backup status and validation testing across departments?
- Are our recovery processes aligned with our risk tolerance and business continuity goals?
These questions help identify gaps, clarify expectations, and bring resilience into everyday security conversations. They also reinforce your position as a strategic partner – not just in preventing threats, but in ensuring the organization can recover and thrive after an incident.
A forward-looking perspective
Cyber resilience is a cornerstone of modern data security and protection. By ensuring recovery is part of the conversation, CISOs can help their organizations withstand the unexpected -and come back stronger. As a trusted advisor, we encourage CISOs to continue driving this shift with their teams. Through a deeper focus on backup architecture, more collaboration across functions, and greater visibility into recovery readiness, greater cyber resilience can be achieved. With the right tools, policies, and partnerships in place, your organization can move from reactive recovery to strategic resilience – ready for what’s next, no matter what.
The author
Tim Sherbak, Enterprise Products and Solutions Manager, Quantum
