CISOs need to understand how quickly damage becomes irreversible.
Santiago Pontiroli, Lead TRU Researcher, Acronis a narrative. Those that assemble them beforehand produce evidence. Keep the decision record somewhere that survives the loss of your normal collaboration tooling.
Test the delegation itself
Exercise decision rights under time pressure and with incomplete information, and treat hesitation over who owns a call as a finding rather than an inconvenience. Review automated triggers after every exercise and incident, retiring those that no longer reflect the estate.
Key takeaways
The key takeaway is that closing the tempo gap requires decisions to be made earlier, rather than expecting people to act faster. Every automated response represents a standing delegation of Board authority, but accountability cannot be delegated to a script. Ultimately, responsibility remains with those who approved the policy.
The question for your board
“ Can management demonstrate that every action taken in the first hour of a crisis would be one somebody was authorised to take, and that we could prove it?”
Machine speed and human accountability sit together comfortably, provided the human judgement happens first. That work can only be done well while the building is quiet.
Santiago Pontiroli, Lead TRU Researcher, Acronis
Cyber-resilience goes beyond restoring systems
A cyberattack can end long before its consequences do. Systems return, but orders remain unfulfilled, production runs below capacity and staff work through weeks of accumulated disruption. CISOs need to account for that entire period when assessing cyber-resilience. The objective is to sustain essential operations, limit damage and restore services the organisation can trust.
Recent attacks show why that distinction matters. Following its April 2025 cyberattack, Marks & Spencer restored services in stages, with its online offer restored in August. Its subsequent results described significant operational disruption in the first half of the financial year, followed by a return to sales and profit growth in the second. Technical restoration, customer service and commercial recovery followed different timelines. CISOs should measure each: bringing an application online does not establish whether customers can complete transactions or whether the business can clear its backlog.
Understanding the irreversible consequences of cyberattacks
The October 2026 attacks against French supermarket refrigeration systems add a physical deadline to the discussion. Compromised controls caused temperatures to rise and forced stores to discard food. Restoring refrigeration cannot recover spoiled stock. CERT-FR also warned that resetting vulnerable equipment, while leaving it exposed, could lead to another compromise. Recovery must address both the cause of the incident and its operational consequences. CISOs need to understand how quickly damage becomes irreversible, whether that means spoiled food, interrupted treatment or lost production.
Maintaining essential operations during prolonged disruption
CISA’ s CI Fortify initiative makes sustained operation during disruption an explicit planning objective for critical infrastructure. Operators should prepare to maintain essential services for weeks to months while isolated from business and third-party networks. This requires understanding which dependencies would fail when connections are cut, preparing local or manual alternatives and testing recovery without normal Internet or supplier access. The wider lesson applies across industries: establish what the organisation can safely keep delivering when the connections it normally relies on become unavailable.
Building and testing a business-led cyber recovery strategy
The starting point is to agree with business leaders which services must continue, the minimum acceptable capacity and the disruption the organisation can tolerate. Map the dependencies behind those services, including identity, suppliers, specialist equipment and staff. Establish who can authorise isolation and how operational teams
26 WWW. INTELLIGENTCISO. COM