Readiness is not established when the plan is written. It is established when people have practiced together often enough, honestly enough, and rigorously enough to act with discipline under pressure. Here is how exercises, training, and lessons learned move cybersecurity readiness from aspiration into practiced organizational competence.

Published in EDPACS (Taylor & Francis), 2026.

Abstract

This article examines the role of structured exercises, disciplined training, and lessons learned programs in advancing cybersecurity readiness across the enterprise. While incident response and recovery capabilities are indispensable during active disruption, their effectiveness depends substantially on the extent to which they have been practiced, evaluated, and refined before a crisis occurs. A mature cybersecurity program therefore requires more than technical controls and documented plans. It requires repeated exercises, transdisciplinary training, realistic command simulations, formal engagement with third party partners, and a disciplined process for converting operational experience into improved readiness. Emphasis is placed on the value of regular Cyber Incident Response Team training, recurring scenario-based exercises, role specific instruction for component leaders and volunteer support personnel, and structured lessons learned sessions that strengthen readiness without imposing undue burden on participants who also carry day to day business responsibilities. This article extends the discussion from restoration and resiliency into the organizational disciplines of exercise design, recurring training, and lessons learned as mechanisms for sustained cybersecurity readiness. It is informed not only by established cybersecurity principles, but also by the author’s extensive firsthand experience in operational cyber leadership across incident response, containment, eradication, restoration, and enterprise readiness activities in complex organizational environments.

“Readiness is not established when the plan is written. Readiness is established when people have practiced together often enough, honestly enough, and rigorously enough that disciplined action becomes possible under pressure.”

Kevin Lynn McLaughlin, PhD

This article extends prior discussion of restoration and resiliency into the organizational disciplines of exercise design, recurring training, and lessons learned as mechanisms for sustained cybersecurity readiness. If restoration demonstrates whether an organization can recover, training demonstrates whether it has prepared itself to do so with coherence, discipline, and institutional steadiness. Readiness, in this sense, is not a static condition created by documentation alone, nor is it the inevitable byproduct of technology investment. It is an organizational capability that must be developed intentionally through repetition, evaluation, correction, and sustained practice over time. Exercise programs test whether command structures function as intended, whether roles are understood, whether communications pathways hold under pressure, and whether technical and nontechnical teams can work through a shared operational framework when uncertainty is high. Recurring training reinforces these capabilities by converting abstract plans into practiced behaviors and by strengthening the trust, familiarity, and command discipline that serious incidents demand. Lessons learned complete the cycle by ensuring that operational experience is not merely observed and archived, but translated into measurable improvements in preparation, decision making, and future execution. Taken together, these disciplines move cybersecurity readiness from the realm of aspiration into the realm of practiced organizational competence.

In mature cybersecurity programs, readiness cannot be assumed merely because policies have been approved, technologies have been implemented, or response procedures and standard operating procedures (SOPs) have been documented. Those elements remain necessary, but they are not sufficient. Under the strain of a serious cyber incident, organizations rarely perform at the level of their plans and SOPs. More often, they perform at the level of their training, their practiced command structure, and the quality of the working relationships they have deliberately built and sustained before the incident begins. Those relationships should not be treated as the product of a single introductory meeting or an isolated coordination session held several years earlier. They must be developed intentionally, reinforced regularly, and maintained over time through recurring interaction, training, exercises, and shared operational experience. Periodic social and professional touchpoints, including occasional breakfast or lunch meetings with key internal partners, third party responders, and other trusted collaborators, can also be valuable because they help build familiarity and trust before those relationships are tested under pressure. Some of these relationship building opportunities may also occur at industry conferences, which can be especially useful because they provide a setting outside the normal office environment and its daily distractions, allowing participants to establish stronger professional bonds and maintain continuity of connection over time. In mature cybersecurity programs, trusted relationships are not static assets. They are living components of readiness that must be cultivated across years if they are to function effectively during a crisis. The same principle of sustained preparation applies to the human demands of extended incident response. Organizations should not assume that every CIRT participant who initially responds will be able to sustain the same level of engagement throughout a prolonged event. Extended incidents create cumulative operational and psychological strain, and research on cybersecurity incident responders has shown substantial burnout associated with workload, limited control, and teamwork challenges (Nepal et al., 2024). For that reason, training, staffing, and command models must be designed in advance with reinforcement, rotation, sustainability, and, where appropriate, cross training across functional areas in mind rather than relying on assumptions of uninterrupted human endurance. Cross training can be especially valuable because it helps preserve continuity when key personnel become unavailable, fatigued, or overextended during prolonged incidents. It also strengthens mutual understanding across the command structure by allowing participants to appreciate the responsibilities, pressures, and information needs of adjacent roles. When applied thoughtfully, such cross training does not eliminate the need for specialized expertise. Rather, it increases organizational adaptability and resilience by ensuring that essential support functions can be reinforced when the incident places sustained demands on the same personnel over time.

A cybersecurity program should be evaluated not only by the sophistication of its preventive controls, but also by the seriousness with which it prepares internal teams, third party partners, and, where possible, trusted federal contacts such as the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) to act together under pressure. Training across these groups is especially valuable because serious incidents often require rapid coordination, aligned communications, evidence preservation, and disciplined command relationships that cannot be built for the first time in the middle of a crisis. At the highest level of maturity, however, this preparation should be understood not merely as cross functional participation, but as a transdisciplinary model of readiness. As Kesler and Liebrock (2025) explain, a transdisciplinary approach goes beyond multidisciplinary and interdisciplinary collaboration by bringing participants together through a shared conceptual framework that integrates discipline specific perspectives, methods, and priorities to address a common problem. In the context of a cybersecurity training program, this distinction is highly important. Technical responders, business leaders, communications professionals, continuity planners, legal advisors, third party specialists, and government partners must do more than attend the same exercise or contribute adjacent expertise. They must learn to think, communicate, and operate through a shared command logic that supports unified decision-making during crisis. This is precisely why transdisciplinary training is so valuable. It reduces fragmentation, strengthens mutual understanding, and prepares the organization to respond through coordinated action rather than parallel activity. In this sense, a mature training program does not simply assemble different stakeholders in the same room. It develops the shared operational framework through which they can act together with greater coherence, trust, and effectiveness when an actual incident occurs (Kesler & Liebrock, 2025).

One of the clearest indicators of an immature cybersecurity program is the assumption that readiness can remain conceptual until a crisis emerges. That assumption is particularly dangerous in cyber incident response, where the opening phase of an event is often characterized by ambiguity, compressed decision timelines, incomplete technical evidence, executive pressure, and significant operational stakes. In this respect, cybersecurity readiness resembles the preparation of a serious team sport more than a purely technical exercise. A team does not become effective on match day simply because the playbook exists or because the players understand their positions in theory. It becomes effective because it has practiced together repeatedly, learned how to communicate under pressure, internalized its assignments, and developed the trust required to act with cohesion when conditions become fast moving and uncertain. Strong teams also learn that belief, discipline, and mutual confidence are not motivational abstractions. They are operational assets developed through repetition, accountability, and shared effort over time. The same principle applies in cyber incident response. A systematic review of cybersecurity training methods found that training generally produces positive effects across topics and approaches, while federal guidance on test, training, and exercise programs emphasizes that exercises familiarize personnel with responsibilities, validate plans and procedures, and strengthen coordination with internal and external stakeholders (Grance et al., 2006; Prümmer et al., 2024). Cyber specific exercise research likewise indicates that realistic scenarios improve incident handling, increase threat awareness, and reveal organizational weaknesses before those weaknesses are exposed in a live event (Alothman et al., 2022). The importance of repetition becomes even clearer under stress. A meta-analysis of pressure training reported a large positive effect on performance under pressure, and stress inoculation research has shown that performance improves when people first understand how stress affects cognition and behavior, then acquire coping and task skills, and finally practice those skills under conditions approximating the operational environment (Low et al., 2021; Robson & Manacapilli, 2014). What practitioners often describe as muscle memory is more accurately understood as the development of automaticity and procedural memory through repeated and disciplined execution. Research on skilled performance under pressure has shown that highly practiced tasks become more automated, whereas pressure can degrade performance when skills are insufficiently consolidated or when individuals are driven back into conscious control of tasks that should already be proceduralized (Beilock & Carr, 2001). In critical cyber moments teams must be able to perform their roles, communicate through the command structure, escalate issues, preserve documentation, hand off responsibilities, and act in concert across functions with a level of fluency that remains dependable even when conditions are adverse. These capabilities are not created during the incident itself. They are built through repeated and disciplined preparation beforehand.

A mature Cyber Incident Response Team, or CIRT, should train regularly and deliberately. In practical terms, one effective model is to host four to six annual training sessions that simulate realistic cyber events. These sessions should be sufficiently grounded in the organization’s actual risk environment to feel credible, and sufficiently structured to reinforce command discipline, transdisciplinary coordination, and recovery thinking. Their value lies not only in exposure to scenarios, but in the repetition they provide. Repeated practice helps convert plans into practiced behaviors, reduces hesitation, improves handoff quality, and strengthens the procedural reliability that becomes indispensable under stress. The scenarios themselves should vary across the year so that the organization exercises different combinations of technical, operational, business, legal, regulatory, and executive demands. One session may focus on a significant data loss event requiring close coordination among cybersecurity, privacy, legal, communications, and business leadership. Another may center on a product compromise or product security event in which engineering, product security, customer support, and executive stakeholders must work through disclosure, containment, and customer impact decisions. A third may simulate a large-scale ransomware attack requiring deep engagement from cybersecurity, information technology infrastructure, business continuity, communications, and executive leadership to address containment, restoration sequencing, and operational prioritization. Another may focus on a database compromise in which database administrators, cybersecurity responders, application owners, privacy stakeholders, and legal teams must coordinate evidentiary preservation, technical analysis, and business risk decisions. Other scenarios may include business email compromise, insider threat, phishing driven account takeover, supply chain compromise, or operational technology disruption. At least one annual session should also be designed specifically for the board and C suite. That exercise can focus on the governance and executive decision questions that arise during a major ransomware event, including whether a ransom demand should be considered, how such a decision intersects with legal and regulatory obligations, how law enforcement engagement should occur, and how business continuity, communications, and recovery priorities should be weighed at the highest level. Corporate calendars, business cycles, and executive schedules often constrain timing, because of this sessions may not replicate real world conditions perfectly in terms of spontaneity. Even with this constraint, they can still reproduce the essential operational demands of actual incidents, including escalation, containment decisions, reporting rhythms, executive engagement, communications coordination, evidence preservation, and restoration sequencing.

The value of these recurring exercises lies not only in repetition, but in normalization. When teams practice together on a regular basis, command structures become more familiar, terminology becomes more precise, and expectations become clearer. Participants begin to understand not only their own roles, but how their roles fit into a larger operational system. This reduces hesitation during actual incidents and strengthens the organization’s ability to act with confidence rather than improvisation. Repetition also reveals points of friction that may otherwise remain invisible until a live event has already created operational pressure. Between the larger annual sessions, readiness should be reinforced through smaller, component-level mini training. These sessions should not function as condensed replications of the larger scenario-based exercises; their purpose is different and more focused. They should concentrate on the specific role skills, workflows, and coordination habits that allow individuals and small teams to function more effectively within the broader CIRT structure. The lead scribe, the command team, the recovery workstream leaders, and other CIRT component leaders can use these sessions to strengthen the practical disciplines that make larger incident response efforts more effective, including status reporting, note taking, escalation timing, documentation quality, handoff precision, command update structure, dependency tracking, and the management of recurring operational rhythms.

An underestimated component of both mini training and broader CIRT readiness training is the disciplined compilation and maintenance of current contact information. Internal leaders, third party responders, outside counsel, crisis communications resources, cyber insurance contacts, federal partners, and other key stakeholders should all be maintained in a form that is accurate, readily accessible, and easy to use under pressure. This information should not be assumed to remain current simply because it was collected during prior exercise or maintained in a static directory. Mini training provides an effective opportunity to verify contact lists, validate escalation paths, confirm after hours reachability, and ensure that participants know exactly where this information resides and how to use it when an incident begins. In practice, outdated or difficult to access contact information can introduce avoidable delays at precisely the moment when speed, coordination, and clarity are most needed.

The objective of these training sessions is not to recreate the full incident. It is to improve the smaller elements of performance that determine whether the larger team operates with fluency, discipline, and cohesion when a serious event occurs. These mini training courses are especially valuable because they allow participants to refine their contribution to the whole while also giving newer volunteers an opportunity to build confidence in role specific responsibilities without the pressure of full-scale exercise. This flexible and adaptable mini training model is especially important in organizations where the CIRT is composed substantially of cross-functional participants who serve in a volunteer capacity in addition to their ordinary professional responsibilities. In such environments, one of the principal watch outs is that the training program must not become so time-consuming that it undermines participation, creates fatigue, or unintentionally discourages capable people from remaining involved. This is not an argument for shallow preparation, it is an argument for disciplined and sustainable preparation. A mature program respects the reality that many of its strongest contributors also have demanding day jobs. The most effective mini training courses are often those that are narrowly scoped, highly purposeful, and designed to improve one or two role-based skills at a time. Short virtual sessions can be especially effective when they are structured with clear objectives, limited participant groups, and practical outcomes. Good practice includes keeping the session length manageable, focusing on a single workflow or decision pattern, using realistic but tightly bounded examples, and ending with a short set of takeaways or improvements that participants can immediately apply. It is also beneficial to provide brief pre reads when needed, avoid unnecessary presentation material, and rely instead on active participation through role walkthroughs, sample handoffs, documentation drills, status update practice, or short command rhythm rehearsals. When designed well, these sessions remain impactful without becoming burdensome, and they help individuals and small teams improve in ways that measurably strengthen the performance of the larger CIRT.

The design of these training courses should begin not with broad incident simulation, but with role clarity and workflow intent. A useful starting point is to identify the specific actions within a role that tend to become difficult under pressure or that frequently affect the effectiveness of adjacent teams. For a scribe, this may include structured note capture, timeline accuracy, the organization of command decisions, and the ability to support the development of a clear, concise, and comprehensive situation report that informs leadership without becoming unnecessarily long or unfocused. For a command lead, it may include concise direction setting, operational prioritization, disciplined status review, and the ability to conduct a clear and defensible transfer of authority to the next commander. That transfer should not be informal or dependent upon memory alone. It should be practiced as a structured handoff in which the outgoing commander reviews status’, unresolved issues, active risks, pending decisions, priority actions, key dependencies, reporting timelines, and any executive or external commitments already made. It is also beneficial for the incoming commander to have the applicable standard operating procedures (SOPs) directly in front of them and to follow the prescribed steps in sequence so that essential actions, documentation requirements, and command expectations are not missed during the transition. When practiced well, this type of handoff improves continuity, reduces the likelihood of omission, and creates a documented transfer process that is disciplined, repeatable, and defensible if later subject to internal review, legal scrutiny, or executive questioning. For a recovery workstream leader, it may include dependency identification, blocker escalation, or the ability to report progress in a way that supports broader command awareness. Once such role specific objectives are defined, mini training sessions can be built around realistic tasks rather than broad scenarios. This keeps the session practical, repeatable, and closely tied to actual CIRT performance. In that sense, the value of these training courses lies in helping each participant and each small team work better as part of the larger system. They improve not only individual competence, but also the collective reliability of the command structure.

Effective design of the training course also requires clarity regarding participation. It should be determined in advance which functions must be present, what roles they will play, what command structure will be used, what assumptions will govern the simulation, what external partners should be included, and what documentation will be produced during the event. At the same time, mature training programs should remain adaptive enough to accommodate the operational realities of busy organizations. Not every team member must attend every training session, and not every training objective requires the same audience or level of live participation. Some modules can be delivered effectively in self-paced form, particularly when the goal is to reinforce role expectations, review updated procedures, validate contact paths, or refresh participants on established workflows. Other sessions may be limited to the specific leaders or functional groups most relevant to the objective being practiced. This kind of flexibility helps preserve participation, reduces unnecessary burden on volunteers with demanding day jobs, and allows the program to remain both disciplined and sustainable over time. When the organization has already established an aligned ICS command model for cyber incidents, the training should reinforce that model rather than inventing an alternate one for the purposes of convenience. The same is true for Zulu time usage, reporting cadence, handoff expectations, and command note discipline. The closer the exercise mirrors the actual command environment, the more operational value it will produce. Exercises should be facilitated in a way that preserves seriousness while still allowing participants to learn. The goal is not theatrical intensity for its own sake. The goal is disciplined rehearsal. Participants should understand the scenario, the expectations, and the operational rules under which the exercise will run. Commanders should command, scribes should document, workstream leaders should report, and executives should engage according to the roles they would hold in an actual incident. Reporting rhythms should be maintained, status updates should be given at defined intervals, injects should be used to test changes in the environment, new facts, dependencies, and emerging business consequences. At the same time, it is entirely appropriate for the facilitator to pause the exercise when a critical concept, role expectation, or workflow is being misunderstood or performed incorrectly. This should not be seen as disrupting the value of the exercise, but as part of its instructional purpose. In many respects, this resembles the work of an effective athletic coach, who stops flawed or confused execution, reinforces the correct technique, walks the team through the proper form, and then resumes practice so that the right habit is strengthened rather than the wrong one repeated. The same principle applies in CIRT training. Allowing errors to continue without correction may reinforce poor practice, whereas pausing briefly to clarify expectations, reviewing the proper procedure, and then continuing can improve both individual learning and collective team performance.

It is not enough for different functions simply to appear in the same exercise. Mature cybersecurity preparation requires those functions to operate through an increasingly shared framework for understanding the incident, prioritizing action, and protecting the enterprise. Technical teams, business leaders, communications professionals, continuity planners, and executive decision makers must learn how to reason together under pressure. That kind of conceptual integration is rarely produced through documentation alone. It emerges through repeated interaction, trusted relationships, and disciplined practice. The purpose of the training is therefore not only to validate procedures, but to build a common operational logic across the teams that will be expected to work together during real disruption. Third party partners, if possible, should also be included in this preparation if they are likely to play a meaningful role during an actual incident. This may include forensic firms, incident response retainers, cyber insurance response resources, outside counsel, crisis communications advisors, federal agencies and critical technology vendors. Organizations should not wait until a live incident is underway to discover how these partners communicate, what information they require, how they relate to the command structure, or where misunderstandings may arise. Their participation in selected exercises can materially reduce friction during actual operations and can accelerate integration when time is at a premium.

No training program is complete unless it is paired with a disciplined lessons learned process. Lessons learned sessions are structured reviews conducted after an incident, exercise, or focused training event to identify what occurred, what worked well, what broke down, what was misunderstood, and what must be improved before the next event. Their purpose is not merely retrospective description. It is organizational improvement. They are not merely informal conversations conducted after an incident or exercise. They are a structured part of the evaluation phase through which the organization analyzes the event, identifies lessons learned, documents observations and recommendations in an after-action report, and uses those findings to improve both the plan itself and the organization’s ability to execute it in practice (Grance et al., 2006). Lessons learned sessions also strengthen team effectiveness when they are conducted as structured after-action reviews rather than as loosely organized discussion. (Steinke et al. 2015) note that after action reviews and debriefings are learning opportunities through which teams examine recent performance events, identify where communication broke down, where coordination did not occur as it should have, and where actions were not properly aligned. The work conducted by Steinke and the team also highlights several practices that make such sessions more effective, including focusing on a limited number of critical performance issues, reducing the delay between the event and the review, providing both individual and team oriented feedback, emphasizing process improvement rather than outcome judgment, creating conditions in which participants feel comfortable speaking candidly, and preserving institutional memory through written notes and captured lessons learned. In the context of cyber incident response, these observations reinforce the importance of structured lessons learned sessions as a means not only of documenting improvement items, but of strengthening communication, coordination, and team learning across the broader incident response structure. They matter because even well-designed training and well executed response activities will expose gaps in assumptions, communication, coordination, documentation, role clarity, timing, and command execution. If those gaps are not captured and translated into corrective action, the organization risks repeating the same weaknesses in future incidents. For this reason, lessons learned should not be treated as informal commentary or as a loosely structured debrief conducted only when time permits. They should be understood as formal discipline within the cybersecurity program. A well-structured lesson learned session should include a clear scope, defined participants, a documented timeline or sequence of events, a review of key decisions and actions, identification of strengths and shortcomings, analysis of root issues, assignment of corrective actions, clear ownership, and a method for tracking those actions through completion. Whether the source is a live incident, a tabletop exercise, a command post exercise, or a smaller role specific training, the organization should have a consistent method for identifying observations, analyzing root issues, assigning corrective actions, tracking ownership, and validating improvement over time. This process becomes even more important when lessons learned are hosted across transdisciplinary teams. The purpose of these sessions is not to revisit events for the sake of fault finding, nor to create a setting in which participants defend decisions rather than analyze them. Such dynamic is dysfunctional and counterproductive. A facilitated lesson learned meeting should create conditions for candid, disciplined, and constructive reflection. Participants should be able to discuss what worked, what did not, what assumptions proved inaccurate, where communication failed, where decision authority was unclear, where dependencies were missed, and what must change before the next event occurs. The focus should remain on strengthening the institution rather than protecting the ego of any one function. In more complex incidents, one lesson learned session may not be sufficient. Large or prolonged events often require an initial session to capture immediate observations and a later session, or series of sessions, to validate facts, align stakeholders, and examine deeper operational, procedural, and governance issues once the organization has regained stability.

The value of lessons learned depends not only on discussion, but on disciplined follow-through. Findings should be documented in a structured manner, categorized by topic and impact, aligned to the appropriate owners, and translated into specific corrective actions with clear accountability and target dates. Those actions may include revisions to playbooks, escalation paths, communications plans, documentation templates, battle rhythms, command procedures, contact rosters, or training content. It is also important that the organization maintain visibility into this improvement work through a formal tracking mechanism so that items are not discussed once and then quietly forgotten. Mature programs review these actions over time, confirm when changes have been completed, and incorporate the resulting updates back into future exercises and mini trainings. In this way, lessons learned become more than reflective exercise. They become a governed improvement process through which experience is converted into stronger readiness.

Over time, this cycle of training, exercise, reflection, correction, and retesting becomes one of the clearest signs of cybersecurity maturity. It demonstrates that the organization does not merely endure disruption but learns from it in a disciplined and institutionalized manner. It also reflects respect for the people who serve within the CIRT structure, because their experience is not treated as expendable effort consumed in the moment and then forgotten. Instead, it is captured, examined, and translated into stronger preparation for the future. In that sense, the training program becomes more than a readiness mechanism. It becomes a living system of organizational learning. The deeper purpose of a cybersecurity exercise, training, and lessons learned program is not limited to procedural readiness alone. It is the cultivation of institutional confidence, operational discipline, and command reliability under pressure. When people have practiced together, documented together, handed off together, learned together, and improved together, the organization develops a markedly different posture toward crisis. It becomes less dependent on improvisation, less vulnerable to confusion, and better able to act with steadiness when time is compressed and uncertainty is high. This does not mean that ambiguity, stress, or disruption disappear. It means that the organization has built the habits, trust, and practiced competence necessary to respond responsibly. A mature cybersecurity program should not be judged solely by the controls it deploys or the attacks it prevents. It should also be judged by the seriousness with which it prepares its people, refines its command structures, strengthens transdisciplinary coordination, and converts experience into lasting improvement. Annual CIRT exercises, role based mini training courses, sustainable volunteer preparation, adaptive training methods, and governed lessons learned processes are not peripheral administrative activities; they are essential capabilities. In an environment where cyber disruption remains a persistent possibility, those organizations that trust each other, train regularly, exercise realistically, learn honestly, and improve systematically are the ones best positioned not only to respond with discipline and recover with confidence, but to lead with credibility, resilience, and institutional steadiness when it matters most.

References

Alothman, B., Alhajraf, A., Alajmi, R. A., Farraj, R. A., Alshareef, N., & Khan, M. (2022). Developing a cyber incident exercises model to educate security teams. Electronics, 11(10), 1575. https://doi.org/10.3390/electronics11101575

Beilock, S. L., & Carr, T. H. (2001). On the fragility of skilled performance: What governs choking under pressure? Journal of Experimental Psychology: General, 130(4), 701–725. https://doi.org/10.1037/0096-3445.130.4.701

Grance, T., Nolan, T., Burke, K., Dudley, R., White, G., & Good, T. (2006). Guide to test, training, and exercise programs for IT plans and capabilities (NIST Special Publication 800-84). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-84

Kesler, E., & Liebrock, L. (2025). A transdisciplinary approach to cybersecurity: A framework for encouraging transdisciplinary thinking. Digital Threats, 6(2), Article 9. https://doi.org/10.1145/3736653

Low, W. R., Sandercock, G. R. H., Freeman, P., Winter, M. E., Butt, J., & Maynard, I. W. (2021). Pressure training for performance domains: A meta-analysis. Sport, Exercise, and Performance Psychology, 10(1), 149–163. https://doi.org/10.1037/spy0000202

Nepal, S., Rajivan, P., Sulaiman, S., Mishra, S., Kumar, N., Liu, Y., Dinh, T., Chi, H., Wang, Y., & Garg, V. (2024). Burnout in cybersecurity incident responders: Exploring the factors that light the fire. Digital Threats. https://doi.org/10.1145/3637304

Prümmer, J., van Steen, T., & van den Berg, B. (2024). A systematic review of current cybersecurity training methods. Computers & Security, 136, 103585. https://doi.org/10.1016/j.cose.2023.103585

Robson, S., & Manacapilli, T. (2014). Enhancing performance under stress: Stress inoculation training for battlefield airmen. RAND Corporation. https://www.rand.org/pubs/research_reports/RR750.html

Steinke, J., Bolunmez, B., Fletcher, L., Wang, V., Tomassetti, A. J., Repchick, K. M., Zaccaro, S. J., Dalal, R. S., & Tetrick, L. E. (2015). Improving cybersecurity incident response team effectiveness using teams-based research. IEEE Security & Privacy, 13(4), 20–29. https://doi.org/10.1109/MSP.2015.71

Disclosure Statement

This article was authored by Kevin Lynn McLaughlin, PhD, with AI used as a drafting and editing support tool. All final content decisions, references, citations, and source selections are made and verified by the author.

Citation

EDPACS _ 2026 _ Kevin Lynn McLaughlin, PhD

From recovery to readiness: Building a cybersecurity exercise, training, and lessons learned program

To cite this article: Kevin Lynn McLaughlin, PhD (2026): From recovery to readiness: Building a cybersecurity exercise, training, and lessons learned program, EDPACS, 1–8, DOI: 10.1080/07366981.2026.2672047

To link to this article: https://doi.org/10.1080/07366981.2026.2672047

Published online: May 11, 2026

Read the full article in EDPACS: https://doi.org/10.1080/07366981.2026.2672047

https://orcid.org/0009-0009-8367-5292

Restoration and resiliency are not simply technical capabilities. They are visible expressions of leadership, preparation, and organizational discipline.

Published in EDPACS (Taylor & Francis), 2026.

Abstract

This article examines restoration and resiliency as indispensable components of a mature cybersecurity program. Although preventive and detective controls remain necessary, they are insufficient by themselves to ensure organizational continuity in the face of significant cyber disruption. A robust cybersecurity capability must also include rapid detection, disciplined response, courageous early containment, trusted backup and recovery mechanisms, and a centralized recovery command structure capable of coordinating cross functional action across the enterprise. Particular emphasis is placed on the role of cybersecurity leadership and cyber incident commanders in making timely decisions that reduce extended organizational harm, the importance of out of band communications when primary systems have been compromised, the operational value of immutable backup and recovery platforms, and the use of a sustained recovery command model informed by principles analogous to the Federal Government’s Incident Command System. This article is informed not only by established cybersecurity principles, but also by the author’s extensive firsthand experience in operational cyber leadership during incident response, containment, eradication, and restoration efforts across complex enterprise environments. Taken together, these capabilities constitute core indicators of cybersecurity maturity and organizational resilience.

“Restoration and resiliency are not simply technical capabilities. They are visible expressions of leadership, preparation, and organizational discipline. The true strength of a cybersecurity program is revealed not only in how it resists disruption, but in how it responds, restores, and recovers with confidence.” – Kevin Lynn McLaughlin, PhD

In the contemporary digital environment, cybersecurity can no longer be understood solely through the lens of prevention. Preventive investment remains essential, and every responsible organization should maintain strong protective and detective controls. Even so, the most capable programs must contend with an unavoidable reality: some attacks will penetrate defensive boundaries, and some disruptions will occur despite diligent preparation. In the most severe circumstances, an attack can wipe entire business systems clean, leaving unprepared teams without the usual tools, platforms, and devices upon which they would ordinarily depend to initiate containment or response. Electronic mail may be unavailable. Collaboration platforms may be nonfunctional. Mobile devices may be either untrusted or operationally unusable. Under such conditions, the quality of a cybersecurity program is measured not merely by the extent to which it attempted to prevent compromise, but by the effectiveness with which it detects the incident, responds to the disruption, and restores business capability. In these circumstances, trusted out of band communication methods become indispensable, since they enable teams to coordinate, escalate, and act quickly on containment when primary systems are no longer dependable. Restoration and resiliency must be regarded as central rather than peripheral concerns. They do not represent secondary technical functions that become relevant only after a failure has occurred. Rather, they constitute essential dimensions of cybersecurity maturity. They shape the organization’s capacity to withstand disruption, preserve institutional trust, and return to operational effectiveness through disciplined recovery. At its essence, cyber resiliency concerns the ability to recover from, adapt to, or continue operating through computing faults, networking failures, cyberattacks, and other unpredictable events (Mailloux & Grimaila, 2018). A program that lacks restoration capability may appear adequate during periods of relative stability yet reveals profound weakness during moments of actual crisis. By contrast, an organization that plans for restoration in advance demonstrates a more complete understanding of cyber risk, operational continuity, and executive accountability. A useful conceptual analogy may be drawn from the fire and police services of a large metropolitan area. The objective is always to prevent the emergency whenever possible, whether by reducing the likelihood of a fire or by deterring a dangerous escalation. Yet a city’s confidence does not derive solely from alarms, building codes, patrols, or deterrence. It derives also from the public understanding that, when an incident does occur, trained professionals will detect it quickly, respond rapidly, contain it courageously, coordinate their actions effectively, and restore safety and order through disciplined execution. A mature cybersecurity program must operate according to a similar logic. Prevention remains indispensable, but preparedness for response, containment, and restoration is equally essential.

Within that broader framework, rapid detection and rapid response remain among the most consequential determinants of incident impact. The speed with which an organization identifies abnormal activity often shapes whether an event remains manageable or becomes materially disruptive. Early visibility permits security teams to isolate affected systems, investigate adversary behavior, and constrain the spread of damage before core business functions are significantly impaired. Delay, by contrast, expands the attacker’s opportunity to persist, pivot, and inflict broader harm. The incident response lifecycle provides a structured framework through which incident responders and security operations centers manage the progression of a cyber event from initial identification through restoration. It defines the principal phases required to detect, contain, investigate, eradicate, and recover from a breach in a disciplined manner. Within that lifecycle, rapid containment is essential because it isolates compromised systems and affected network segments before active threats can propagate more broadly across the enterprise. At the same time, digital forensic practices preserve system state and related evidentiary artifacts needed to understand attacker behavior, support investigative integrity, and inform recovery decisions. Standardized information sharing also strengthens this process by enabling multiple teams and stakeholders to collaborate efficiently while still protecting sensitive or proprietary security data. This is particularly important in the case of advanced persistent threats, which frequently employ modular malware, layered command infrastructures, prolonged ingress and egress pathways, and blended delivery mechanisms that obscure the character and scope of the intrusion. Under such conditions, fragmented communications or isolated third-party coordination will delay shared understanding, underuse available expertise, and slow effective action. For that reason, organizations should not wait until an incident is underway to determine how they will work with both internal and external partners who are likely to support response and recovery. Third party forensic firms, incident response retainers, cyber insurance response resources, outside counsel, crisis communications advisors, and critical technology vendors should be incorporated into planning, training, and practical exercises in advance so that roles, escalation paths, information sharing expectations, documentation standards, and command relationships are already understood. Such preparation reduces friction during active operations and enables external expertise to be integrated into the broader response effort with far greater speed and discipline. By contrast, integrating detection capabilities across endpoint agents, network sensors, and centralized log aggregation improves unified threat analysis and supports more coordinated response activity (Basta et al., 2025).

This relationship between detection and recovery is not linear, but cyclical. As Anson (2020) explains, the incident response process contains two important cycles. The first cycle connects detection and analysis with containment, eradication, and recovery, such that information developed during detection and analysis informs response actions, while knowledge gained during containment, eradication, and recovery strengthens future detection and analysis capabilities. The second cycle connects post incident activity back to preparation, ensuring that lessons learned are not merely documented, but translated into stronger readiness for future events. This reinforces the importance of treating resiliency as a living capability that is continuously improved through experience, reflection, and disciplined operational learning. It also underscores the continuing value of strong foundational practices, including sound information technology hygiene, routine vulnerability assessments, and regular penetration testing to harden systems, validate patching, and identify visible security weaknesses before they can be exploited. Speed alone, however, is insufficient.

Effective response also requires clarity, discipline, and sound decision structures. Security teams must possess not only technical tools, but also an operational framework that allows them to act with coherence under pressure. In the opening phase of an incident, complete information is rarely available. Early evidence is often fragmentary, ambiguous, and evolving, even as executive pressure intensifies and operational stakes rise. Mature organizations recognize that excessive delay in pursuit of perfect certainty can yield greater damage than timely action taken based on credible indicators. Accordingly, disciplined decision making under uncertainty becomes a defining characteristic of effective cyber response. This reality foregrounds one of the most important, and often insufficiently examined, qualities in cyber incident management: courage during early containment. In the first hours of a serious event, cybersecurity leadership and cyber incident commanders must frequently make consequential decisions with great speed to prevent extended harm to the enterprise. These decisions are often made before every relevant fact is known and while leaders are balancing urgency, technical uncertainty, business impact, and strategic risk in real time. Systems may need to be isolated. Privileged access may need to be suspended. Network segments may need to be disconnected. Critical services may need to be paused temporarily to prevent damage from spreading further across the environment. Such decisions are rarely comfortable. They may generate temporary inconvenience, operational delays, and understandable frustration among stakeholders whose focus remains on continuity and service availability. Nevertheless, decisive containment remains one of the clearest manifestations of cybersecurity maturity. It requires courage on the part of cybersecurity leadership and cyber incident commanders to act early, knowing that short term disruption may be necessary to prevent far greater and more enduring organizational harm. It also requires judgment, because effective leaders must distinguish between reckless overreaction and principled intervention. In this respect, containment is not merely a technical maneuver. It is an act of stewardship and a visible expression of responsible cybersecurity leadership.

Even when containment is executed well, true resiliency depends upon the organization’s ability to restore. Recovery cannot rest on assumption. It cannot depend upon copies of data that may themselves be incomplete, corrupted, or subject to compromise. Rather, restoration requires assurance that backups are authentic, protected, accessible, and trustworthy. During a major incident, uncertainty regarding backup integrity produces a second crisis layered atop the first. Confidence in backup integrity, by contrast, creates an actionable path forward. For this reason, irrefutable backups occupy a position of considerable strategic importance. Platforms such as Rubrik can strengthen restoration capability by providing secure, resilient, and dependable recovery mechanisms that organizations may rely upon when core systems have been placed at risk. When backups are immutable, properly governed, and regularly validated, they become more than a technical safeguard. They become a source of institutional confidence. They enable leaders to move the organization from confusion toward order, from uncertainty toward informed action, and from containment toward restoration. There is, moreover, a psychological and organizational dimension to trusted backups that extends beyond technical recovery. During a major cyber event, people must believe that recovery remains possible. Teams function more effectively when they understand that a credible restoration path exists. Leaders make better decisions when they know that the organization has preserved the ability to recover critical data and resume essential services. In this sense, backup integrity supports not only infrastructure recovery, but also organizational steadiness, executive composure, and disciplined operational continuity.

Restoration is not the responsibility of a single technical unit. Cyber incidents affect far more than security operations alone. They influence technology services, business operations, legal judgment, communications strategy, executive oversight, risk management, continuity planning, and stakeholder trust. Effective recovery therefore requires a centralized command center through which cross functional teams can operate with shared situational awareness and coordinated purpose. At the highest level of maturity, however, this coordination is best understood not merely as cross functional participation, but as a transdisciplinary mode of action. Kesler and Liebrock (2025) distinguish transdisciplinary from multidisciplinary and interdisciplinary approaches by noting that multidisciplinary participants address a common problem largely from separate disciplinary perspectives, interdisciplinary participants collaborate while maintaining those distinct perspectives, and transdisciplinary participants work jointly through a shared conceptual framework that integrates discipline specific theories, concepts, and methods to address a common problem. In cyber incident command and response, this distinction is highly significant. Security leaders, infrastructure teams, legal counsel, communications professionals, business operators, continuity planners, and executive decision makers must do more than contribute adjacent expertise. They must increasingly operate through a unified logic for understanding risk, prioritizing action, sequencing restoration, preserving evidence, protecting the enterprise, and sustaining operational continuity. This transdisciplinary orientation is especially valuable during serious incidents because it reduces fragmentation, strengthens shared problem ownership, and enables more coherent decisions under conditions of uncertainty. Restoration decisions are rarely purely technical, and mature cyber command structures are more effective when they foster not only representation from multiple domains, but true conceptual integration across them. In this sense, a transdisciplinary approach strengthens cyber incident command because it is more likely to generate broader insight, more creative solutions, and more durable recovery outcomes than approaches in which disciplines continue to operate primarily in parallel (Kesler & Liebrock, 2025).

A centralized command center functions as the locus in which information is gathered, decisions are aligned, priorities are established, and actions are tracked. It imposes structure on circumstances that might otherwise become fragmented or chaotic. It enables technical teams to communicate clearly with executive leadership and ensures that legal, communications, operational, and business leaders remain aligned with evolving realities. It also accelerates decision making because the appropriate participants are present, relevant facts are visible, and priorities are continuously clarified. In important respects, this model parallels the way the Federal Government teaches and employs command and control during emergency events through the Incident Command System and the broader National Incident Management System. FEMA’s ICS 100 and 200 courses establish the underlying framework for incident organization and supervisory response, while ICS 300 and 400 extend that framework to more complex and large-scale incidents. Together, these teachings reinforce disciplined command, defined roles, shared situational awareness, and coordinated execution across multiple functions and institutions. For cybersecurity teams, training on these concepts can be highly beneficial because the underlying principles are directly relevant to cyber incident response and recovery. The emphasis on role clarity, unity of command, operational periods, escalation discipline, and structured handoffs maps closely to the demands of serious cyber events, particularly those that require sustained containment, coordinated restoration, and cross functional decision making over extended periods. In practice, both CIRT and recovery operations benefit significantly from the consistent use of one-time reference across all regions, teams, and documentation. The use of Zulu time is particularly effective because it eliminates ambiguity, reduces handoff errors across time zones, and ensures that all status updates, command notes, decisions, and recovery records can be interpreted with precision throughout the life of the incident.

One effective method for ensuring appropriate command structure during recovery is to extend the Cyber Incident Response Team structure already activated during containment and eradication. Rather than improvising an entirely new governance model during disruption, the organization can expand the existing response structure so that it continues to provide leadership, accountability, and coordination during recovery. This preserves continuity of command, reduces ambiguity, and prevents the loss of situational understanding that often accompanies organizational transition. Once the organization enters the recovery phase, the command group can often be reduced and simplified to those roles most essential for sustained restoration. In many cases, these roles consist principally of a commander, a scribe, and a logistics facilitator capable of coordinating support and communications across the recovery teams. At this stage, the commander need not always possess the same level of experience required of those who directed the earliest and most volatile stages of containment and eradication. Recovery, when conducted within a disciplined structure, may provide a valuable leadership opportunity for more junior cyber commanders to develop judgment, strengthen decision making maturity, and gain command experience while still operating within a proven framework. This development, however, must never come at the expense of rigor. The transition from one commander to another must be formal, detailed, and disciplined. Open issues, unresolved risks, pending decisions, team assignments, restoration priorities, business impacts, and time references must all be conveyed with precision. Without such rigor, essential items may be overlooked, delayed, or lost between shifts. The value of this disciplined approach extends beyond leadership continuity alone. It also ensures that recovery documentation is gathered systematically by the scribe and maintained on an ongoing basis so that no critical items are missed. This documentation discipline is especially effective when the command center establishes a clear operational rhythm, often described in emergency management and command practice as a battle rhythm. In this context, the rhythm is a deliberate cycle of work, reporting, and renewed work that helps synchronize recovery activity, maintain situational awareness, and preserve documentation discipline across the effort. In practice, that rhythm may be structured as work time, status update time, and then renewed work time. For example, a 50 10 50 model means fifty minutes of focused recovery work by the assigned teams, followed by a ten-minute reporting and synchronization period with the command center, and then another fifty minutes of execution. A 120 10 120 model follows the same logic, with two hours of focused work, a ten-minute interval for formal reporting, documentation updates, prioritization, and coordination, and then the next two-hour work block. A 240 10 240 model extends that cadence further for workstreams that require longer uninterrupted execution. The ten-minute reporting period can also be adjusted as needed and may easily be shortened to five minutes or expanded to fifteen or twenty minutes depending upon the pace, complexity, and coordination demands of the recovery effort. This reporting rhythm is especially valuable when multiple recovery workstreams are operating simultaneously across separate areas of effort. By requiring those groups to report back to the command center at regular intervals, the commander retains current situational awareness, the logistics facilitator can coordinate support and interdependencies, and the scribe can maintain a continuous and organized record of what each group has accomplished, what remains blocked, and what actions must occur next. In a prolonged recovery effort, that documented trail becomes essential because it reduces the risk that unresolved issues, pending decisions, or critical dependencies will disappear between shifts or fall through the cracks during handoffs. The command center thereby becomes not simply a coordination venue, but the formal operating structure through which recovery is directed, documented, managed, and sustained. Cross functional coordination also underscores a foundational truth about cybersecurity: incidents are not merely technological events; they are business events. They affect mission execution, service delivery, institutional reputation, and stakeholder confidence. Restoration must therefore be treated as an enterprise responsibility. Security leadership may guide important technical aspects, but successful recovery depends upon the combined effort of the broader organization. This point becomes especially significant when one recognizes that end-to-end recovery may require not merely days, but in some instances months. The recovery command structure must therefore be not only disciplined, but sustainable. A structure appropriate for the opening hours of containment may become impractical if applied without modification across an extended restoration timeline. One effective approach is to staff the recovery command team in shorter two-to-three-hour shifts, allowing personnel to support the command center in focused intervals while continuing to fulfill their ordinary organizational responsibilities outside those periods. This model helps preserve energy, sustain clarity, and reduce fatigue over the course of a prolonged restoration effort. In globally distributed organizations, the same model may be extended across regional teams. Responsibility after 0100 Zulu in the Americas, for example, may be formally handed off to teams in India operating within the same command structure and following the same short shift methodology. Such an approach enables continuous recovery progress across time zones without imposing unreasonable burden upon any single group. For this model to function effectively, each handoff between the outgoing commander and the incoming commander must be formal, detailed, documented, and time synchronized through a single standard such as Zulu time. Recovery status, unresolved blockers, critical dependencies, communications already issued, decisions still pending, and priorities for the next operational period must be reviewed with care. This level of formal transition discipline is essential if critical items are to remain actively tracked and managed rather than slipping through unnoticed gaps in continuity. Effective handoffs are therefore not administrative niceties; they are integral instruments of recovery governance. When rapid detection, disciplined response, courageous containment, trusted backups, and centralized coordination are combined, an organization develops genuine resiliency. It becomes capable not only of surviving disruption, but of recovering with greater confidence, coherence, and institutional steadiness. Resiliency is not accidental. It is designed, practiced, reinforced, and governed over time. It emerges from the convergence of leadership, operational preparation, sound governance, technical capability, and cross functional teamwork.

A mature cybersecurity program should not be evaluated solely according to the number of attacks it prevents. It should also be assessed according to the extent to which it enables the organization to endure adversity, detect threats quickly, respond with discipline, exercise courage during early containment, rely upon irrefutable backups, and restore operations through coordinated cross functional action. These capabilities, taken together, constitute some of the clearest indicators of true cybersecurity maturity. Equally important, however, is the organization’s capacity to move from immediate containment into a deliberate and technically sound recovery process rather than treating restoration as a simple return to service. In this regard, a phased approach to network recovery and system hardening provides an especially important marker of program maturity. Recovery should not be understood as a single event, but as a controlled progression in which systems are restored methodically, security controls are revalidated, configurations are hardened, and the environment is monitored closely for evidence of residual compromise or renewed adversary activity. Vigilant post attack monitoring is therefore not ancillary to recovery. It is part of recovery itself, because the premature restoration of systems without sustained observation may recreate the very conditions that enabled compromise in the first place. This perspective also reinforces the continued importance of Cyber Incident Response Team methodology during containment and eradication. Structured CIRT execution does more than stabilize the crisis in the moment. It also establishes the conditions necessary for trustworthy recovery by preserving clarity of roles, decision discipline, and evidence integrity. Network logs, disk artifacts, and related forensic records often provide the technical basis for identifying the original attack vector, understanding the sequence of compromise, and determining whether restoration efforts are addressing only visible damage or the full scope of intrusion. Cross referencing attack variants and related indicators can further accelerate attribution and improve defensive adaptation, thereby reducing the likelihood that recovery efforts will proceed on incomplete or misleading assumptions. These practices demonstrate that true cybersecurity maturity resides not merely in resisting attack, but in restoring the enterprise through a disciplined, evidence informed, and continuously monitored recovery model (Misty, 2024). At its core, restoration is far more than the reactivation of systems. It concerns the restoration of business operations, institutional trust, executive confidence, and the organization’s ability to fulfill its mission.

Resiliency is the enduring strength that makes such restoration possible. It is established before the crisis begins, tested during the crisis itself, and remembered long after the immediate disruption has passed. It is strengthened further when organizations adopt a transdisciplinary approach to cyber readiness and recovery, one in which technical, operational, communications, continuity, and executive perspectives are not merely present, but deliberately integrated into a shared framework for decision making and action. In this sense, transdisciplinary practice is not an abstract academic ideal, but a practical necessity in serious cyber events, where success depends upon the organization’s ability to unify diverse forms of expertise into a coherent operational model. Such a model requires more than structural inclusion. It requires trust. Transdisciplinary teams are not assembled so that participants can criticize one another for what may have been missed, second guess decisions in the middle of active operations, or search for fault in ways that weaken cohesion and slow action. That dynamic is dysfunctional and contrary to the purpose of incident command. The objective, rather, is to create trusted working relationships in which participants contribute their expertise in good faith, elevate concerns responsibly, and work together to protect and defend the organization. Personnel operating within the command structure should not have to worry that partner functions are participating primarily to assign fault or identify individual blame while the response is still underway. They should be confident that each participating discipline is committed to the shared mission of containment, recovery, and organizational protection.

Restoration decisions are rarely technical alone, as they require synchronized judgment regarding business priorities, communications timing, operational dependencies, evidentiary preservation, and acceptable risk. A mature cybersecurity program therefore depends not only on strong technical controls, but also on the essential capability to integrate these perspectives rapidly and effectively under pressure. This is precisely why a mature and well-practiced cybersecurity command structure is paramount. When that structure follows Incident Command System methodology, it provides the discipline, clarity, role definition, reporting cadence, and unity of command needed to guide the organization through uncertainty without losing coherence. ICS based methods establish a common operating language, define responsibilities, structured handoffs, operational periods, and sustained situational awareness, all of which are foundational enablers of confidence during prolonged incidents in which fragmented leadership or inconsistent coordination can magnify harm. For these reasons, restoration and resiliency must be understood as foundational components of any mature cybersecurity program. They are not optional enhancements appended to an otherwise complete security model. They are essential capabilities. In an environment where disruption remains a persistent possibility, those organizations that prepare to restore, operate through transdisciplinary command structures, and execute recovery through disciplined ICS aligned leadership are those best positioned to endure, recover, restore mission essential operations, and lead with confidence.

References

Anson, S. (2020). Incident readiness. In Applied incident response (pp. 21–43). Wiley. https://doi.org/10.1002/9781119560302.ch2

Basta, A., Basta, N., Anwar, W., & Essar, M. I. (2025). Security incident response. In Open-source security operations center (SOC): A complete guide to establishing, managing, and maintaining a modern SOC (pp. 39–65). Wiley. https://doi.org/10.1002/9781394201631.ch3

Kesler, E., & Liebrock, L. (2025). A transdisciplinary approach to cybersecurity: A framework for encouraging transdisciplinary thinking. Digital Threats, 6(2), Article 9. https://doi.org/10.1145/3736653

Mailloux, L. O., & Grimaila, M. (2018). Advancing cybersecurity: The growing need for a cyber resiliency workforce. IT Professional, 20(3), 23–30. https://doi.org/10.1109/MITP.2018.032501745

Misty, L. (2024). Combating the escalating threat of ransomware multi-pronged approach for secure organizations. In 2024 International Conference on Artificial Intelligence, Computer, Data Sciences and Applications (ACDSA) (pp. 1–5). IEEE. https://doi.org/10.1109/ACDSA59508.2024.10467453

Disclosure Statement

This article was authored by Kevin Lynn McLaughlin, PhD, with AI used as a drafting and editing support tool. All final content decisions, references, citations, and source selections are made and verified by the author.

Citation

EDPACS _ 2026 _ Kevin Lynn McLaughlin, PhD

From containment to recovery: Restoration and resiliency in mature cybersecurity programs

To cite this article: Kevin Lynn McLaughlin, PhD (2026): From containment to recovery: Restoration and resiliency in mature cybersecurity programs, EDPACS, 1–7, DOI: 10.1080/07366981.2026.2669965

To link to this article: https://doi.org/10.1080/07366981.2026.2669965

Published online: May 11, 2026

Read the full article in EDPACS: https://doi.org/10.1080/07366981.2026.2669965

https://orcid.org/0009-0009-8367-5292