7.1: Recovery point objective (RPO) and recovery time objective (RTO) targets differ considerably across sectors.
a. What is your sector’s typical RPO/RTO for different workloads?
💡 Consider the difference between a high-frequency trading firm that loses millions per minute of downtime versus LLMShoppes in Chapter 3 where LLMShoppes functions merely as an auxiliary tool for the organization. What defines "acceptable loss" in your specific industry? It is also helpful to know that RPO/RTO can also be defined more granuarly, especially when you have varying levels of criticality of assets. (This often arises from a crown jewel analysis which we first visited in detail in Discussion 2.3)
b. Will different levels of strictness of RPO/RTO affect the overall organizational strategy in terms of incident planning, and the necessary financial investments to achieve said RPO/RTO?
💡 Achieving near-zero downtime requires expensive active-active redundant data centers, whereas a 24-hour RTO might only need cheap cold backups. How does the required speed of recovery directly dictate the IT budget? Start by understanding the definitions between cold, warm and hot back-up sites.
c. How would you balance investments into restoration capabilities against other organizational requirements?
💡 Every dollar spent on idle backup servers is a dollar not spent on new product development. How do executives weigh the probability of a catastrophic failure against the certainty of daily operational costs?
7.2: Tabletop Exercises (TTX) scenarios are highly dependent on the RPO/RTO of the organization. If the RPO/RTO requirements are lax, there exists windows of time to perform IR.
a. Can you create a TTX targeting two different parts of your organization that contains different RPO/RTO requirements?
💡 Target two different parts of the organization with different levels of criticality.
b. Suppose the “less strict” environment was discovered to be breached, triggering the IR process. Later, it was discovered that the “stricter” environment was also breached, changing expectations on RPO/RTO. How would your organization respond to this in a more agile manner?
💡 How does the incident command structure adapt to rapidly shrinking recovery windows?
7.3: There have been more single point-of-failure incidents recently. Examples include the Crowdstrike, AWS1 and Cloudflare2 outages. How practical is it to design operational resiliency and failover modes that avoid such points of failure?
💡 Building a truly multi-cloud, vendor-agnostic architecture prevents a single supplier's bad update from taking you offline, but it vastly increases engineering complexity. When are such resiliency requirements needed?
1 AWS Outage Analysis: October 20, 2025. (2025). Thousandeyes.com; ThousandEyes. Link2 Prince, M. (2025, November 18). Cloudflare outage on November 18, 2025. The Cloudflare Blog. Link
7.4: Discussions 7.1 and 7.2 relate to the concepts of RPO and RTO. We can link these concepts to the first question in the Threat Modeling Manifesto: what are we working on?
a. How do the concepts of RPO and RTO link to the concept of crown jewels?
💡 If everything is labeled a crown jewels, IR prioritization breaks down. This should hint at the need for a prioritization exercise which includes a tiering of systems depending on criticality.
b. How would different RPO and RTO requirements lead to architectural differences in system design, and affect back-up and recovery policy?
💡 A system with an RPO of five minutes requires continuous asynchronous replication, while one with an RPO of one week just needs a weekly backup. How does this dictate the choice of back-up solutions?
7.5: In smaller organizations, there is usually insufficient in-house IR capability.
a. What capabilities should be developed in-house, and what capabilities could be outsourced? (Hint: recall Chapters 1 – 5.)
💡 You cannot outsource understanding your own business logic or internal politics (or for that matter, accountability), but you can outsource deep malware reverse engineering. What is the minimum internal context required to make a Managed Security Service Provider (MSSP) effective?
b. How would the writing of the policy, plans and procedures differ in the event of such a shared responsibility model between the organization and outsourced parties?
💡 An internal playbook might say "isolate the server," but a shared playbook must explicitly define *who* has the authority and credentials to push that button. How do you smoothen such administrative issues in a crisis?
c. The organization is still accountable (in the context of RACI3) for incidents. What are the business consequences and risks in such an outsourcing model?
💡 You can outsource the technical work, but you cannot outsource the regulatory fines or the PR disaster. When the third-party responder drops the ball, how does the organization handle the legal fallout?
3 Matthews, B. (2024, April 19). Understanding responsibility assignment matrix (RACI matrix). Project Management. Link
7.6: In the LLMShoppes example, we made two variations from a typical IR process: the usage of a SaaS and the introduction of LLM components within the solution.
a. Comment on the lack of control from LLMShoppes’s perspective during an incident.
💡 When LLMShoppes' core AI feature is hosted by a third-party vendor, an outage means them require filing a support ticket, but that depends on the service level agreements (SLA) between the vendor and LLMShoppes. What limitations are there to their first hours of incident response given the limitations of a SaaS model?
b. Suppose LLMShoppes decides to self-host their LLM on AWS. This requires the management of their own EC2 instance and database solutions (we assume S3 buckets in this case). Tools such as AWS Macie become important to use due to the need to protect PII. How would the IR process change?
💡 Moving in-house provides visibility but also means more responsibility in the shared responsibility model. If a self-hosted LLM starts leaking PII, how does the IR team coordinate with cloud engineers to contain the AWS environment?
c. Research on the possible actions that can be taken on the LLM should it be self-controlled, as opposed to said functionalities being outsourced to a third-party as per ChatbotForAll. How would MAESTRO be useful?
💡 With a self-hosted model, you can physically sever the agent's API connections, wipe its memory buffers, or dynamically rewrite its system prompts mid-incident. How does the MAESTRO framework help identify which specific AI layer needs to be isolated?