By Darren Thomson
Originally used as a consulting term, the concept of a minimum viable company (MVC) is becoming increasingly recognised in cybersecurity, with businesses building strategies designed to protect their core operations to maintain essential services when dealing with cyberattacks.
As KPMG puts it, an MVC is the “smallest possible version of an organization that can still function and serve customers should an incident bring down part(s) of the operations and systems.” As such, it “offers the potential to maintain business continuity and to help minimise business disruption.”
In theory that makes sense, but the big question here is, of course, how can an organization define and implement the minimum viable company concept so they can maximise resilience?
The first step is to identify the systems that must be secure and operational at all times. This will always include critical applications, assets, processes, and people, which collectively can ensure the business can keep ticking over until normal operations have been fully restored.
More specifically and central to any minimum viable company strategy is maintaining core IT infrastructure, such as ensuring secure access to authentication and identity management services remains in place. Alongside this, essential communication platforms, such as email, messaging, and collaboration tools (Microsoft 365, Google Workspace, etc.), must remain operational to support internal teams and external stakeholders. The objective here should always be to reinstate availability as soon as possible in the event these systems are impacted by a security breach.
Equally important is data integrity and availability. Businesses need confidence that their most valuable information remains intact, recoverable, and protected against corruption or ransomware attacks. The same applies to essential business applications, and from financial systems to customer-facing platforms and operational workflows, these assets must be protected so business functions keep running.
Don’t forget, this kind of resilience relies as much on people as on technology. In this context, clearly defining the roles and responsibilities of key personnel in the MVC hierarchy can play a huge role in determining how well an organization can deliver on its recovery objectives.
Developing a cyber-resilient culture is key
Clearly, forward planning is fundamental to minimum viable company effectiveness, but this isn’t just about shoring up key technologies and having a playbook ready, as important as these things are. MVC also depends on implementing and supporting a culture whereby organizations become more cyber-resilient on a fundamental level.
There can be no doubt, for example, that organizations that build awareness training into their continuous improvement processes are much better placed to avoid security breaches than those that do not. This ethos should also extend to scenario planning and cyber recovery drills that put processes to the test and identify any shortcomings. Should a security crisis happen, businesses that have at least some idea of what to expect, what their immediate priorities should be, and how decision-making processes will operate, should be well placed to recover to a minimum viable state without serious delay.
Looking more closely at how an MVC strategy drives technology investment, there are some core priorities that almost all organizations will need to address. This includes establishing robust best practices that go beyond traditional backup strategies, including the use of immutable, air-gapped copies of critical data. This is not only essential to prevent the specific problems associated with ransomware encryption but also to ensure that clean recovery points are always available. Regular validation of these recovery points helps guarantee data integrity, minimising the risk of restoring compromised files.
Advanced backup and disaster recovery solutions also play a key role in maintaining operational integrity. Here, there is a growing role for AI-driven technologies, which are now helping to improve security by proactively detecting and responding to emerging cyber incidents. What’s more, automated cyber recovery testing ensures that restoration processes remain effective and that key technologies will perform as required, even under the pressure caused by a security failure.
While running in MVC mode is far from ideal, it offers enormous advantages over the levels of downtime and disruption seen when organizations aren’t well prepared. With typical recovery times stretching from just a few days to several months accompanied by existential business risk, operating at a minimum viable level can seem very attractive compared to the alternative of complete operational failure.
Ultimately, businesses that embrace MVC principles are not only mitigating downtime, but also protecting their reputation and long-term viability.
The author
Darren Thomson is Field CTO EMEAI at Commvault
Resilience Forward comment
Business continuity professionals will probably see an intersection between the concept of a minimum viable company and the maximum tolerable period of disruption (MTPD).
MTPD refers to the longest time a critical business process can be disrupted before the organization’s viability is at serious risk. It serves as a key input for setting recovery time objectives and prioritising response strategies during incidents and crises. The MVC, as described above, can complement business continuity and crisis management planning by helping organizations maintain essential structure and function long enough to maximize the tolerable disruption window.
The MVC closely aligns with the concept of the minimum business continuity objective (MBCO), which defines the lowest acceptable level of outputs – services and/or products – needed to achieve business objectives during a disruption. However, the key difference is that the MVC focuses on the minimal viable form of the entire organization, including core structures and capabilities, rather than just outputs.
