Back to all
Cyber resilience is no longer just a technical discussion. Now, it’s making its way into legislation, and it isn’t enough for organisations to say they’re secure – they need to prove it.
Doing that involves a lot of moving parts – and on hand to take attendees through it in our recent webinar were James Thackrah (Channel Account Manager, Object First) and Kris Haynes (Head of Technology, Axess Systems).
Webinar Recap
How the Cyber Security and Resilience Bill is Raising The Bar
One of the key themes in the session was that the Cyber Security and Resilience Bill isn’t new, but its scope is expanding. This affects more organisations than many might expect.
Originally, the Bill focused on operators of essential services like energy, healthcare, water, and digital infrastructure. These sectors were already seen as critical because disruption could affect daily life.
Now, it has a broader view of responsibility across the supply chain itself. In practice, this means that data centres, managed service providers, and other organisations picked by the government as “designated critical suppliers” may now fall within scope.
And even if you’re not in those categories, you can’t assume this is someone else’s problem. As Kris argued, all firms should treat the Bill as a best-practice baseline for future platform design.
The webinar also covered reporting expectations from the Bill, and while they’re significant on their own, they also show why the Bill matters now. It’s pushing resilience from a technical aspiration into an operational and governance requirement.
Recovery Planning Starts With Realistic Worst-Case Thinking
Kris also introduced a practical exercise that lets people assess their recovery readiness. To start, imagine a major ransomware event – one that takes out AD, DNS, virtualisation, file servers, backups, databases, applications, and support services.
Then ask your team: how would you deal with it?
If different people respond with different recovery priorities and assumptions about what to do first, that’s a warning sign. A team that can’t align before an incident will struggle under pressure during one.
Kris argued that this alignment is key to good resilience planning. This means leadership must sign off on the maximum tolerable downtime, the order of recovery, and the business consequences of disruption.
Without advance alignment, recovery risks become as much a political problem as a technical one.
Zero Trust for Backup and Recovery: Protecting The Last Line of Defence
James Thackrah went a step further, arguing that data resilience is mandatory for business survival in this regulation age. He outlined how zero trust principles extend into backup and recovery – and how they can apply to backup architecture itself.
Alongside outlining several core principles, James made a distinction between standard immutability and what Object First calls “absolute immutability”.
He mentioned this as a critical differentiator, because backup systems are often targeted directly. If attackers can compromise backup infrastructure, they can remove the organisation’s last reliable path to recovery.
By contrast, absolute immutability means even an attacker with administrative credentials cannot modify or delete the protected data.
James’ broader point wasn’t only about Object First. It recognised that recovery architecture must be intentionally designed to remain trustworthy even when the wider environment is not.
Case Studies
The webinar also included several examples that reinforced the need for a recovery-first mindset.
One example was a UK multi-trust academy that experienced a ransomware incident. Backups were compromised, and the Object First backup was described as the only surviving copy. Following its incident response plan and restoring the server from this backup, systems were restored.
Another was the reference to Knights of Old. Here, one weak password was the starting point of an attack that ultimately destroyed a long-established company.
Taken together, these examples supported James’ central claim: resilience isn’t just about preventing attacks, but preserving the ability to recover when prevention fails.
Practical Takeaways
Kris reinforced the psychological pressure organisations face during an active attack, reiterating the need for board-level business impact analysis and stakeholder sign-off before an incident. He also urged attendees to question whether suppliers and MSPs provide adequate assurance and take resilience seriously.
He also challenged attendees to test recovery, not just backup success, stating that a green status in backup software isn’t the same as evidence that systems can be restored under pressure.
Ultimately, the session made a clear case for cyber resilience entering a new phase. Availability and security controls still matter, but the focus is shifting toward recoverability – and there are multiple ways for all organisations to keep up.
Thank you to Kris and James for lending their time and expertise! Want to see the full discussion? Watch the webinar now.
Previous