Volume 2: Anyone Ever Hear of Business Continuity? (The Devastating Cost of Winging It)
There is a pivotal moment in the film where the characters realize that to restore the island's crumbling infrastructure, they must resort to the oldest trick in the IT playbook: turning it off and turning it back on again. Having just suffered a devastating malicious insider attack that completely crippled their primary production environment, the team pulls the plug. They reboot the system, and it comes back online. Sort of. In a manner of speaking, anyway.
While it makes for great cinema, it highlights a massive, glaring vulnerability in InGen's operations: a total, catastrophic lack of Business Continuity (BC) and Disaster Recovery (DR).
Flailing in the Wind
Business continuity is the foundational bedrock of any mature cybersecurity framework. It is the lighthouse in the dark designed to guide an organization back from the brink of disaster. After Nedry sabotages the network, Chief Systems Engineer John Arnold is left completely empty-handed. He tries everything, but because there are zero playbooks, recovery procedures, or documented incident response strategies, he is forced to wing it and hope a hard reset fixes everything.
Without a plan, organizations are left flailing, guessing their way back to an operational state. If InGen had maintained a proper BC/DR plan, the team would have had an explicit, step-by-step roadmap to contain the breach, isolate Nedry's malicious logic, and systematically recover the environment. To be fair, the park was still technically in its pre-production phase. It is highly likely they were planning to develop these protocols before the grand opening. But as the dinosaurs quickly proved, threat actors do not wait for your project deadline to strike.
Regulatory and Framework Alignment
Modern cybersecurity frameworks don't treat disaster recovery as an afterthought—they make it a strict, audited requirement:
ISO/IEC 27001: Business continuity is deeply embedded in this framework under Control A.5.29 and A.5.30 (Information security continuity). ISO 27001 mandates that an organization must plan, implement, maintain, and verify information security continuity during a crisis, ensuring security requirements are maintained during a restoration event.
NERC CIP: This critical infrastructure framework mandates strict compliance regarding Cybersecurity Incident Response Plans (CIP-008) and Recovery Plans (CIP-009). These standards force organizations to document and test recovery playbooks annually.
NIST SP 800-53: The CP (Contingency Planning) family requires organizations to not only document these recovery plans but to test them on a regular cadence to build operational muscle memory. Regular testing ensures that operational teams are intimately familiar with the exact steps required to respond when the alarms start sounding.
CISO KEY TAKEAWAYS — DISASTER RECOVERY & CONTINUITY
1. DO NOT WING IT: A disaster recovery plan is not a theoretical exercise. If your operational team is guessing their next step during an active breach, your organization is on the path to failure.
2. TEST YOUR COLD REBOOTS: Before pulling the plug on a production network, ensure you know what happens during a cold start. As Isla Nublar proved, a system reboot can have catastrophic, unforeseen physical impacts.
3. SECURITY FIRST DURING CRISIS: Business continuity playbooks must ensure security controls (like perimeter fences) remain active or fail-secure during a recovery event. Never disable security to restore operations.
