Cyber Resilience: What It Is and How to Build It
Cyber resilience is the ability to anticipate, withstand, recover from and adapt to adverse conditions, attacks or compromises. That is NIST's definition, and it matters because it plans for the day prevention fails.
This guide separates resilience from security and continuity, then gives a build plan you can run with free tools: impact analysis, backups, response rehearsal and recovery testing.
Updated 3 November 2026
Cyber resilience vs cyber security vs continuity
| Discipline | Main question | Typical output |
|---|---|---|
| Cyber security | Can we stop and detect attacks? | Controls, monitoring, patching. |
| Business continuity | Can the business keep operating through any disruption? | Continuity plan, alternates, communications. |
| Cyber resilience | When an attack succeeds, how fast do critical services come back and what do we change? | Tested recovery, rehearsed response, lessons applied. |
NIST's SP 800-160 Vol. 2 Rev. 1 treats cyber resiliency as an engineering discipline used with systems security engineering, aimed at systems that can survive cyber attacks.
How to build cyber resilience, step by step
- Decide what must survive. List critical services and set how long each can be down. The Business Impact Analysis Lab runs this as a board drill.
- Make recovery real. Check your backup design with the 3-2-1-1-0 backup checker and then restore from backup on a schedule. A backup you have not restored is a hope.
- Test your readiness. Rate yourself on 14 areas with the incident response readiness scorecard; check availability attacks with the DDoS readiness scorecard.
- Rehearse. Run a ransomware tabletop (guide), use the Cyber War Room for decisions and the IR Playbook Lab for sequence.
- Write the continuity plan. Follow the business continuity plan guide, including manual workarounds and who speaks to customers.
- Map it to a framework. Use the NIST CSF 2.0 assessment; resilience work sits mostly under Govern, Respond and Recover.
- Learn and adapt. After each exercise or incident, change a control, a plan or a contract, and retest.
Resilience for operational technology
Where a cyber event can stop a physical process, resilience also means safe manual operation and segmentation so a problem on the corporate network does not reach the plant. Start with the OT and ICS security hub.
Frequently asked questions
What is cyber resilience?
Cyber resilience is the ability to anticipate, withstand, recover from and adapt to adverse conditions, stresses, attacks or compromises on systems that use cyber resources. This is the definition NIST publishes in its glossary, drawn from SP 800-160 Vol. 2 Rev. 1 and SP 800-53B. The point is to keep the business running when prevention fails.
What is the difference between cyber security and cyber resilience?
Cyber security focuses on preventing and detecting attacks. Cyber resilience assumes some will succeed and focuses on keeping critical services running, recovering quickly and learning. Resilience includes security, plus recovery, continuity and adaptation.
What are the main parts of a cyber resilience strategy?
Know which services matter and how long you can be without them (business impact analysis), protect and test backups, rehearse incident response, plan continuity and communication, and feed lessons back into controls. NIST CSF 2.0 organises this with its Govern, Identify, Protect, Detect, Respond and Recover functions.
How do I measure cyber resilience?
Use outcomes you can test: time to detect, time to restore each critical service against its target, whether backups restore cleanly, and how a rehearsal went. Targets come from your business impact analysis; avoid borrowing benchmark numbers that do not match your services.
Is cyber resilience the same as business continuity?
No, but they overlap. Business continuity plans keep the organisation operating through any disruption. Cyber resilience applies the same thinking to cyber events specifically, adding the technical recovery steps (clean restore, credential reset, containment) that an attack requires.
What is the insurer called Resilience?
Resilience is also the name of a cyber insurance company, so searches for the word alone often find it. This guide is about the concept of cyber resilience, not a vendor.