Executive Summary

The Problem
The organization currently protects on-prem workloads with Rubrik/Cohesity/Commvault and cloud/SaaS workloads with native AWS and Azure backup. This is standard data protection, not cyber resilience. Backups that are reachable from production, mutable, or dependent on the same identity systems attackers compromise will not survive a determined ransomware attack. Recent incidents across the industry show that attackers now target backup infrastructure directly, often before triggering encryption.

The Objective
Build a ransomware-resilient recovery capability centered on an air-gapped, immutable vault (VaaS or private managed), paired with tested identity recovery, prioritized business-service restoration, and validated clean-room recovery. The goal is not faster backups; it is a proven ability to recover trusted, clean, business-critical operations even if production, Active Directory, and primary backup infrastructure are all compromised simultaneously.

The Approach
A phased 180-day build-out, structured so each phase produces a working capability rather than a plan. 30 days establishes governance, risk baseline, and vault architecture decisions. 60 days stands up the vault, immutability controls, and identity recovery foundations. 90 days delivers a validated clean-room recovery capability and first full-scale test. 120-180 days extends coverage, embeds monitoring and SOC integration, and matures the program into a measured, continuously improving capability with executive-level reporting.

What Changes
• Data protection: On-prem and cloud backups move from mutable, network-reachable copies to immutable, air-gapped, access-controlled vault copies.
• Identity: Active Directory, Entra ID, and PKI recovery become explicit, tested procedures rather than an assumed byproduct of restoring servers.
• Recovery focus: Recovery is measured and reported on business services (payroll, ERP, patient care) rather than individual VM restore counts.
• Assurance: A permanent clean room validates that recovered systems are free of malware before reconnecting to production.
• Governance: Recovery readiness, vault coverage, and RTO/RPO compliance become recurring metrics reviewed by a steering committee, not a one-time project.
Investment & Ownership

Requires an executive sponsor, a cross-functional steering committee, budget for vault infrastructure (VaaS subscription or private managed vault build), and dedicated program leadership to drive the 180-day build and the ongoing maturity cadence beyond it. Success is measured by tested recovery, not backup completion rates.