# SP-034 Cyber Resilience

Status: active. Release 26.02. Modified 2026-02-07. Licence: CC BY-SA 4.0.

Scope: Enterprise architecture pattern for designing systems that survive cyber attacks, maintain critical operations under degraded conditions, and recover rapidly. Covers graceful degradation, immutable infrastructure, isolated recovery environments, and business continuity integration.
Use when: This pattern is essential for any organisation where a prolonged technology outage would cause significant financial, reputational, or safety harm. It is particularly critical for: financial services organisations subject to DORA or operational resilience regulation, healthcare organisations where system availability affects patient safety, critical national infrastructure operators, organisations that have...
Not when: Very small organisations with simple technology environments and high tolerance for downtime may find the full resilience architecture disproportionate, though basic backup and recovery capability is always appropriate.

## Controls (37, NIST SP 800-53 ids)
- Critical (13): CP-02, CP-04, CP-06, CP-07, CP-09, CP-10, IR-03, PM-08, RA-09, SA-08, SC-07, SC-32, SI-07
- Important (22): AC-02, AC-05, AU-02, CA-02, CA-07, CP-08, IA-02, IA-05, IR-04, IR-08, PL-02, PM-09, PM-11, PM-14, PM-30, RA-03, SA-09, SC-12, SC-13, SC-28, SC-36, SI-17
- Standard (2): SI-13, SR-10

## What each critical control mitigates (13)
- CP-02 Contingency Plan: T-CR-004, T-CR-011
- CP-04 Contingency Plan Testing: T-CR-010
- CP-06 Alternate Storage Site: T-CR-001, T-CR-003, T-CR-007, T-CR-009
- CP-07 Alternate Processing Site: T-CR-002, T-CR-007, T-CR-008, T-CR-011
- CP-09 System Backup: T-CR-001, T-CR-002, T-CR-004, T-CR-005, T-CR-006, T-CR-009
- CP-10 System Recovery and Reconstitution: T-CR-001, T-CR-002
- IR-03 Incident Response Testing: T-CR-010
- PM-08 Critical Infrastructure Plan: none of the threats below
- RA-09 Criticality Analysis: none of the threats below
- SA-08 Security and Privacy Engineering Principles: T-CR-005, T-CR-011
- SC-07 Boundary Protection: T-CR-003, T-CR-007
- SC-32 System Partitioning: T-CR-003, T-CR-007
- SI-07 Software, Firmware, and Information Integrity: T-CR-002, T-CR-005

## Threats and the controls that mitigate them (12)
- T-CR-001 Ransomware encrypting production data and systems: CP-09, CP-06, SC-28, CP-10
- T-CR-002 Destructive wiper malware destroying systems beyond repair: CP-07, CP-10, SI-07, CP-09
- T-CR-003 Backup infrastructure compromise rendering recovery impossible: SC-07, AC-02, CP-06, SC-32
- T-CR-004 Domain controller compromise destroying identity infrastructure: IA-02, AC-02, CP-02, CP-09
- T-CR-005 Supply chain attack corrupting trusted software repositories: SI-07, SR-10, SA-08, CP-09
- T-CR-006 Insider sabotage of recovery infrastructure: AC-05, AC-02, AU-02, CP-09
- T-CR-007 Coordinated attack on production and backup simultaneously: SC-07, SC-32, CP-06, CP-07
- T-CR-008 Cloud provider outage affecting all hosted services: SC-36, CP-07, CP-08, PM-30
- T-CR-009 Encryption key loss preventing access to encrypted backups: SC-12, SC-13, CP-09, CP-06
- T-CR-010 Recovery failure due to untested or outdated procedures: CP-04, IR-03, PM-14, CA-02
- T-CR-011 Circular dependency preventing system recovery sequence: CP-02, CP-07, SA-08, PL-02
- T-CR-012 Third-party service failure cascading to critical operations: PM-30, SA-09, CP-08, SC-36

## More
- The critical controls and what each mitigates, as JSON (a few KB): /api/v1/patterns/SP-034/crosswalk?emphasis=critical
- The same for every control, with its clauses in a framework: /api/v1/patterns/SP-034/crosswalk?framework={framework id}. Framework ids are listed in /llms.txt
- The pattern's prose, examples and references as JSON, 29 KB: /api/v1/patterns/SP-034
- Page for people: /patterns/sp-034/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.
- Related: SP-011 Cloud Computing Pattern; SP-013 Data Security Pattern; SP-025 Advanced Monitoring and Detection; SP-028 Secure DevOps Pipeline; SP-029 Zero Trust Architecture; SP-031 Security Monitoring and Response

This card, the API and the page are generated from one file. Checking one against another adds no evidence.