Could you prove you can recover from a cyber attack?
- Data Protection
A cyber recovery guide for regulated firms
If your regulator asked tomorrow, could you prove you can recover your critical services after a cyber attack? For regulated firms in legal services, insurance, pensions, investment management and fund administration, that’s now the question that matters. Cyber recovery isn’t just about having backups. It’s about showing, with evidence, that your whole service comes back when it counts.
This guide explains what cyber recovery means for regulated firms, what regulators expect you to prove, how often to test disaster recovery, and how to get started.
What is cyber recovery, and how is it different from backup?
A backup is a copy of your data. Cyber recovery is getting the whole service working again after an attack: user access, networks, email, client files and the business systems your people rely on, restored in the right order.
The difference matters. Restoring a single file server proves very little if your case management, claims or reporting system depends on five others. Backup is the copy. Recovery is the service.
Regulators, auditors, insurers and clients care about the second one.
Why are regulators asking for proof of recovery now?
For years the question was “are we compliant?” Now it’s “could we prove it?” Compliance is a position. Proof is a document, a test result, a date.
Across the UK and the Crown Dependencies, the direction is the same: the firm stays accountable for operational resilience, whoever runs its systems.
- UK financial services: new rules for operational incident and third-party reporting apply from 18 March 2027.
- Jersey: the JFSC found deficiencies in five of the eight firms in its outsourcing review.
- Everywhere: regulators, auditors and clients increasingly expect evidence of recovery capability, not assurances.
Most regulated firms have backups. Many have a disaster recovery plan. Far fewer could hand their regulator evidence tomorrow that the plan works.
What does your regulator need you to prove?
1. That you can recover the whole service
Your recovery plan should cover everything your people need to serve clients, not just your data. That means identity and user access, networks, communications and core business systems, with an agreed recovery order.
Ask yourself: did your last test recover one system, or the whole service?
2. That you’ve tested recovery, with evidence
Owning recovery technology doesn’t prove it works. A recorded recovery test does. A test with no dated, documented outcome is, for evidence purposes, a test that didn’t happen.
Ask yourself: what did your last test produce that you could hand your regulator?
3. That someone owns recovery
Recovery technology needs maintaining, patching and testing on a schedule. Unmaintained backup vaults and unclear ownership are where good plans quietly fail. Ownership also means knowing who makes each decision in an incident: who invokes recovery, who informs the regulator and who talks to clients.
Ask yourself: who is watching your systems at 3am on a Sunday?
How often should you test disaster recovery?
Often enough to show your plan still works as your systems, suppliers and people change, and always after major changes such as a migration, a new core system or a new provider.
The frequency matters less than the scope and the record. A good disaster recovery test:
- recovers the whole service, not a single system
- follows your agreed recovery order
- is timed against your recovery targets
- records what went wrong and what you fixed
- is re-tested once fixes are in place
What should recovery testing evidence include?
If your regulator asked for proof of recovery, this is what good evidence looks like:
- the date of each test and what it covered
- results, timings and screenshots
- issues found, actions taken and re-test results
- who approved the test and signed off the outcome
- named owners for each recovery decision
- how your suppliers’ roles were covered
Keep it in one place, keep it current, and share the results with your board.
What if your IT provider is the problem?
Third-party risk is now central to operational resilience. Many firms keep their backups with the same provider that runs their systems. That works until the provider itself is affected.
If your provider is the problem, where do you recover? The answer should be somewhere separate. For firms in the UK, Jersey and the Isle of Man, that can mean recovering into a separate data centre, or into a second jurisdiction.
The objections we hear most
“We test once a year. We’re covered.” The test needs to show whether the whole service can recover, and what evidence it produces. Once a year, on one system, rarely does both.
“Our IT provider handles backup.” A backup copy doesn’t tell you how the service recovers if the provider itself is affected.
“Our systems are too complex to recover cleanly.” Then that’s the finding. Too complex to recover is too complex to prove. Start with the environment you have.
“No budget this year.” Start with the most urgent gaps and fix them in planned, affordable steps. Much of what regulators want to see costs time, not new hardware.
How to get started: a five-step cyber recovery checklist
- Find your last recovery test. Check the date, the scope and the evidence it produced.
- List your critical services. Agree what has to come back first for your firm to keep serving clients.
- Map your dependencies, including the suppliers your critical services rely on.
- Name the owners for each recovery decision.
- Get an outside view of your gaps and what to fix first.
Book a free Cyber Recovery Assessment
In 60 minutes, our team reviews how you back up, how you’d recover and who makes the calls. You come away with a recovery risk assessment, a backup and recovery gap analysis and recommended actions, in plain English.
No preparation. No access to your systems. No cost. Backed by data centres we own in the UK and the Crown Dependencies, and 25+ years supporting regulated firms.
Share this article
