Has your organization established and communicated resilience objectives (such as recovery time objectives) for critical capabilities and services across different operating states?

Resilience objectives define how quickly critical systems and services should be restored after disruption. These objectives should cover various operating states including normal operations, under attack scenarios, and recovery phases. For example, a resilience objective might specify that customer-facing payment systems must be restored within 4 hours of disruption, while internal email systems can tolerate a 24-hour recovery window. Evidence of fulfillment could include a documented Business Continuity Plan or Disaster Recovery Plan that clearly defines recovery time objectives (RTOs) and recovery point objectives (RPOs) for each critical system, along with communication records showing these objectives have been shared with relevant stakeholders.