Pillar 11 · Operate
Under NYDFS Part 500, a ransom payment must be reported within 24 hours and justified within 30 days. A playbook for the decision rights and evidence trail you need before the incident, not during it.
Configure S3 Object Lock in compliance mode, separate the write credential from any delete power, and end with backups nothing on the network can erase.
A minute-by-minute cutover runbook template with named owners, a point-of-no-return gate, curl and psql smoke tests, and a rollback you rehearse rather than hope for.
The most credible way to prove an impact tolerance is to break the service on purpose and measure whether you stay inside it. A practitioner’s reading of chaos engineering for CPS 230 resilience.
CPS 230 expects credible, repeatable scenario testing of critical operations. A maintained severe-but-plausible disruption library with recorded outcomes is what separates demonstrated resilience from asserted resilience.
Turn the 3-2-1 slogan into a working build for one Linux host: a local restic repo, an immutable Backblaze B2 offsite copy with Object Lock, and checks for all three.
CPS 230 requires regulated entities to identify critical operations, set tolerance levels and demonstrate they operate within them. A practical playbook for building the evidence APRA now expects.
Since 31 March 2025, UK firms must operate within impact tolerances for important business services. A policy that asserts resilience proves nothing; the build task is a scenario harness that tests it.
A Celery task that sent two emails traces back to how brokers redeliver messages. Here is the root cause and the real fix: make the task idempotent.
Reliable webhook delivery is a queue problem: retry with exponential backoff, dead-letter what will not send, and dedupe on event ID so retries are safe.