Insights · Field note · Infrastructure and resilience
Resilience metrics boards understand
Uptime percentages and backup success rates do not tell a board whether the business would survive a bad day. Five measures do.
Boards understand resilience when it is reported as the answer to one question: if a critical service failed today, how long until it is back, with how much lost, and have we proved it. The measures that answer it are the recovery time and recovery point objectives per critical service set by the business; the measured results from the last test against those objectives; the date and scope of the last recovery test and the last continuity exercise; the single points of failure known and the plan for each; and the open gaps from testing with owners and dates. Uptime history and backup job success are inputs, not answers.
In detail
What the evidence shows.
Objectives the business set
For each critical service, the maximum tolerable downtime and data loss, set through impact analysis by the people who own the process. Reported alongside the measured capability, so the board sees the gap rather than a number without context.
Proof, dated
The last recovery test per critical service: when, what scope, measured time and loss, pass or fail. The last continuity exercise: when, who, what was found. An untested plan is reported as untested. The board should notice when a date is old.
Single points of failure
The components, people, suppliers and facilities whose loss would stop a service, with the mitigation or the accepted risk for each. This is the list that changes board decisions, because each item is a budget or an acceptance.
Gaps and decisions
What testing found, who owns the fix, when it closes, and what the board is asked to approve. In the same structure every period so the trend is visible. See recovery testing cadence and evidence, executive risk reporting and the executive risk report template.
Sources
Primary references.
- NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems
- ISO 22301:2019, Security and resilience, business continuity management systems, requirements (ISO)
- Performance Data engagement observations (first-hand: David Selakovic); method described under Infrastructure Resilience and Partner and White-Label Delivery.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days