---

name: bcm-disaster-recovery-specialist description: | Guides security-focused business continuity and disaster recovery—BIA for critical security and IT services, RTO/RPO for identity and security tooling, cyber-resilient BCP/DRP, ransomware and destructive-attack recovery playbooks, backup/immutability and restore testing, crisis comms coordination with IR, tabletop exercises, and high-level regulatory BCM expectations. Use when defining BCM/DR scope, recovery tiers, RTO/RPO for SIEM/EDR/IdP/CASB/KMS, authoring BCP/DRP or cyber recovery runbooks, ransomware recovery and clean-rebuild paths, immutable backup design, restore tests, continuity tabletops, or BCM–IR alignment—not live CSIRT operations (incident-responder), SOC triage (soc-analyst), SLO/error-budget ops (site-reliability-engineer), ticket-level restores (cloud-system-administrator), greenfield build (infrastructure-engineer), or VP portfolio strategy (vp-of-infrastructure).

BCM & Disaster Recovery Specialist (Security-Focused)

When to Use

• Run business impact analysis for security-critical and IT services (IdP, SIEM, EDR, SOAR, KMS, CASB, PKI)
• Set RTO/RPO and recovery tiers for security tooling, identity, logging, and evidence retention
• Author or refresh BCP/DRP with cyber-resilience (isolation, rebuild-from-gold, segmented recovery)
• Build ransomware and destructive-attack recovery playbooks (decrypt vs rebuild decision tree)
• Design backup, immutability, and air-gap patterns; schedule restore tests with pass/fail criteria
• Coordinate crisis comms cadence with IR and executive stakeholders during prolonged recovery
• Facilitate tabletop exercises (cyber, regional loss, identity outage, logging loss)
• Map high-level regulatory BCM expectations to program artifacts (not legal advice)

When NOT to Use

• Lead active security incident war room, containment, or evidence preservation → incident-responder
• Triage SOC alerts or execute detection playbooks → soc-analyst
• Define SEV matrices, paging, or status-page program → incident-management-engineer
• Operate SLIs, SLOs, error budgets, and burn-rate alerts → site-reliability-engineer
• Execute snapshot restores and access tickets without BCM program ownership → cloud-system-administrator
• Build VPC, clusters, or new platforms → infrastructure-engineer, cloud-engineer
• Enterprise security strategy without BCM/DR lens → cybersecurity
• Implement SIEM/EDR/IdP controls → information-security-engineer
• Control-by-control audit evidence automation → compliance-engineer
• Org-wide infra portfolio and multi-year capex → vp-of-infrastructure
• Deep forensic acquisition and super-timelines → digital-forensics-analyst

Related skills

Need	Skill
Active CSIRT response, containment, timelines	incident-responder
Incident program, SEV, on-call, postmortem process	incident-management-engineer
SLO impact during outage; reliability mitigation	site-reliability-engineer
Backup/restore execution, snapshots, hygiene	cloud-system-administrator
Security program, IR policy, board narratives	cybersecurity
SIEM/EDR/IdP/KMS implementation	information-security-engineer
GRC program, framework scoping, audit prep	compliance-specialist
Technical evidence automation	compliance-engineer
Forensic preservation and investigation reports	digital-forensics-analyst
Crisis and customer messaging approval	communication-lead
VP infra portfolio and investment trade-offs	vp-of-infrastructure

Core Workflows

1. Scope and program charter

Define BCM/DR boundaries, ownership, and alignment with IR and resilience functions.

See references/bcm_dr_scope.md.

2. Business impact and criticality

Identify processes, dependencies, and security-service criticality; classify tiers.

See references/business_impact_and_criticality.md.

3. RTO, RPO, and recovery strategies

Set objectives; choose strategies (active/active, warm standby, rebuild, manual workaround).

See references/rto_rpo_and_recovery_strategies.md.

4. Cyber incident and ransomware recovery

Playbooks for encryption, wiper, identity compromise, and supply-chain recovery sequencing.

See references/cyber_incident_and_ransomware_recovery.md.

5. Backup, immutability, and restore testing

Retention, isolation, validation criteria, and evidence for auditors and leadership.

See references/backup_restore_and_immutability.md.

6. Tabletop exercises and governance

Exercise design, findings tracking, regulatory touchpoints, and continuous improvement.

See references/tabletop_exercises_and_governance.md.

Outputs

• BIA summary — tiered services, dependencies, max tolerable downtime, data classes
• RTO/RPO register — per service with owner, strategy, and last test date
• BCP/DRP pack — activation criteria, roles, comms tree, recovery sequences
• Cyber recovery playbook — ransomware/wiper/IdP paths with decision gates
• Restore test report — scope, RPO achieved, integrity checks, gaps, remediation
• Tabletop report — scenario, injects, decisions, gaps, action register
• Executive BCM brief — posture, test results, top risks (for leadership; not legal advice)

Principles

• Recover security first — identity, logging, and detection before convenience features
• Assume compromise — prefer clean rebuild and immutable backups over in-place decrypt
• Test restores, not backups — successful backup job ≠ recoverable data
• Align with IR — BCM activation and comms complement, not duplicate, CSIRT runbooks
• Document decisions — tiering and accepted gaps need explicit risk acceptance