Businesses rely on computers, applications, user accounts, and data every day. A hardware failure, stolen password, or cyberattack can interrupt operations and put valuable information at risk.
Cyber resilience is an organization’s ability to prepare for these events, limit their impact, and restore operations. It combines technology with clear responsibilities, established procedures, and regular testing.
The diagram presents three connected areas of cyber resilience: Manage, Secure, and Recover. Together, they support protection across endpoints, cloud environments, networks, identities, network boundaries, and applications.
End-to-end cyber resiliency: Manage, Secure and Recover.
What Does the Diagram Show?
The diagram organizes cyber resilience into three main pillars: Endpoint Management, Security Operations, and Data Protection.
These pillars connect everyday IT maintenance, threat detection and response, and the restoration of data and services. Each addresses a different business need, while supporting the others.
This approach reflects the broader principle that cybersecurity involves preparation, protection, detection, response, and recovery. The NIST Cybersecurity Framework 2.0 covers these activities alongside governance and risk management. NIST Cybersecurity Framework 2.0
1. Endpoint Management: Building a Reliable IT Foundation
Protecting an IT environment starts with knowing which devices exist, how they are configured, and who is responsible for them. Endpoint management helps organizations maintain computers, servers, and other devices throughout their lifecycle.
Remote Management
Remote management allows IT teams to monitor devices, adjust settings, and resolve problems without visiting each location.
This is particularly valuable for businesses with multiple offices or employees working remotely. Faster intervention can reduce downtime and help employees return to work sooner.
Because remote management tools provide significant control over devices, access to them must be carefully restricted and monitored.
Patch and Vulnerability Management
Software can contain weaknesses that attackers may exploit. Patch and vulnerability management helps organizations identify these weaknesses, assess their importance, and apply updates or other protective measures.
Prioritizing vulnerabilities that are actively exploited or affect critical systems helps teams focus their efforts where they matter most. CISA includes regular software and operating system updates among its recommendations for reducing ransomware risk. CISA’s ransomware guidance
Automation
Automation handles recurring tasks such as checking device health, installing approved updates, and sending alerts.
Its main benefit is consistency. Important maintenance tasks can run on schedule with less manual effort, allowing IT teams to focus on issues that require judgment.
Automated changes should include validation and controls to prevent an error from spreading across many devices.
2. Security Operations: Detecting Threats and Taking Action
Even a well-maintained environment can face an attack. Security operations connect protective tools, monitoring, investigation, and incident response.
Endpoint Protection
Endpoint protection helps detect and block malicious software and suspicious activity on computers and servers.
This matters because a compromised device can become an entry point into the wider organization. Depending on the solution, protective actions may include isolating the device to limit the spread of an attack.
XDR and MDR
Extended Detection and Response (XDR) brings together security information from multiple sources. It helps teams connect suspicious activity across devices, user accounts, and other systems.
Managed Detection and Response (MDR) is a service in which security specialists investigate alerts and support incident response. Monitoring coverage and authority to take action depend on the agreed service.
These capabilities matter because an alert needs to be understood and acted on. Connecting the evidence and involving experienced analysts can help organizations respond more effectively.
Mail and Identity Protection
Email and user accounts are common targets for fraud and unauthorized access. A convincing phishing message may persuade an employee to reveal a password, open a malicious attachment, or approve a fraudulent payment.
Protection includes filtering suspicious messages, controlling access, and monitoring unusual sign-in activity. Multifactor authentication—particularly phishing-resistant methods—adds protection against the misuse of stolen passwords. CISA’s access protection recommendations
3. Data Protection: Making Recovery Possible
Data protection gives an organization usable copies of its information and a practical way to restore services.
Preventive measures reduce risk. A prepared recovery process helps limit the consequences when an incident still occurs.
Backup
Backups allow organizations to restore data after accidental deletion, hardware failure, or an attack.
A useful backup strategy must cover the necessary data, run frequently enough, and retain copies for an appropriate period. Those copies also need protection against unauthorized changes and deletion.
CISA recommends maintaining offline, encrypted backups and regularly testing restoration. CISA’s backup and recovery guidance
Disaster and Cyber Recovery
Restoring files is only one part of bringing a business back online. Operations may also depend on servers, applications, networks, user accounts, and replacement equipment.
Recovery after a cyberattack requires additional checks to ensure that systems and backup copies are suitable for safe restoration.
Organizations should decide in advance which services must return first, how long they can remain unavailable, and how much recent data loss the business can tolerate.
Cloud Recovery
Cloud recovery can provide a separate location for backup data or an environment in which applications and services can be restored.
This can be valuable when local infrastructure is unavailable. However, storing data in the cloud does not automatically guarantee recovery. Organizations still need to verify backup protection, access, dependencies, costs, and restoration times.
Data protection and cloud recovery support controlled restoration when systems are unavailable.
A Shared Platform Connects the Components
The foundation shown in the diagram represents capabilities that help the different tools work together:
- Cloud-native: A platform designed for cloud environments can simplify management across distributed systems.
- Open and Extensible: Integrations allow organizations to connect existing tools and add capabilities as requirements change.
- Unified Customer Experience: A consistent interface can reduce the effort involved in working across separate systems.
- AI Powered: Artificial intelligence can assist with analysis and prioritization, supported by validation and human oversight.
- Unified Data Layer: Connected information can provide a more complete view of device health, security events, and backup status.
- Workflow Orchestration: Coordinated workflows link actions such as detecting a threat, isolating a device, notifying the team, and initiating recovery.
These capabilities can improve efficiency. Their value depends on how well the platform is integrated, configured, and used.
Why Do These Components Need to Work Together?
Consider an attack that starts with a phishing email.
Mail protection may stop the message before it reaches an employee. Identity protection may prevent a stolen password from being used successfully. If an attacker reaches a device, endpoint protection and security monitoring may detect the activity and trigger a response. If data becomes unavailable, protected backups and a tested recovery plan support restoration.
Each component plays a distinct role. Together, they help organizations identify problems earlier, contain damage, and resume operations in a controlled way.
Cyber resilience grows from well-maintained systems, effective security monitoring, and tested recovery procedures. Organizations should choose capabilities that match their risks and business needs, with clear responsibility for every stage.