Most organisations in the UAE and wider Middle East already invest in backup capability, but when ransomware strikes, backup alone is not enough to ensure business resilience. This problem is compounded by policies based on traditional disaster recovery and attempting to restore everything at once rather than cyber incident recovery which requires identification and prioritisation of the systems that matter most to ensure a company can return to business operation as quickly as possible. The pressure to do so is only intensifying on digital infrastructure in the UAE as the cyberattacks tripled from 200,000 to 600,000 following the onset of regional conflict, according to UAE Cyber Security Council chairman Mohamed Al Kuwaiti, encompassing ransomware, targeted data breaches and infrastructure defacement.
In the aftermath of a major cyber incident, the instinct is to bring every system back online as quickly as possible. It feels like the fastest path back to normality. In reality, this approach often slows recovery down, reintroduces cyber risk and undermines trust just when the organisation needs it most. From our research, ‘Risk Ready or Risk-Exposed: The Cyber Resilience Divide’, we found that 98% of organisations in the UAE and Saudi Arabia took more than 24 hours to restore data after a major cyberattack, with recovery taking just over four days on average.
In fact, those that recover fastest start from a different premise. They assume large parts of their organisation will be unavailable or untrusted, and they plan accordingly. This mindset leads to a much clearer goal: restore what matters most, quickly, and in a state you can trust.
What is critical to survival?
Focusing on the critical areas of an organisation is the idea behind the Minimum Viable Company (MVC) concept, sometimes referred to as the Minimum Viable Organisation. It is a definition of what must exist for the organisation to survive in challenging conditions such as a cyber incident.
It’s a business definition of survival: the minimum combination of people, processes, technology, documentation, facilities, and third-party dependencies required to keep a business functioning and creating value. The UAE’s regulatory framework already applies similar thinking at a national level. The Critical Information Infrastructure Protection Policyfocuses on identifying and protecting the information assets, functions and services that are essential to the country’s society and economy. The MVC extends this principle to the organisational level, helping businesses determine what they must protect and restore first, whether they operate in a regulated sector or not.
In a similar fashion, the MVC concept extends that same logic to every private-sector organisation, regulated or not. In PwC Middle East’s most recent CEO Survey, 32 per cent of regional executives said they were already reassessing technology dependencies, choosing trusted suppliers and regional alternatives to strengthen operational autonomy.
The MVC is what that reassessment looks like in operational practice.
Where to start getting an MVC up and running?
In my experience working through recovery exercises with organisations across the region, the same five capabilities surface time and again when it comes to operationalising an MVC in the UAE context.
First step, is to focus on undertaking a structured assessment, aligning across business and technology stakeholders, and going through a realistic simulation of how recovery will unfold under pressure. This will uncover the key areas needed to provide just enough capability to keep the organisation functioning safely during a crisis and guide recovery. In practice, this means defining what must function in the first 24 hours, the first 72 hours, and the first week after a disruption.
The second element is a trusted control foundation or what we call Tier 0, which operates independently of potentially compromised systems. In the event of a cyberattack, many organisations miss the critical foundational layer that allows them to establish identity and access control independently of compromised systems. It includes identity and access management, networking and DNS, privileged access controls, core security tooling, physical access systems, and secure communication channels. It also covers non-technical dependencies that are easy to overlook until they’re urgently needed such as incident response playbooks, contact lists and escalation paths, and contracts with external responders. These are the foundations underpinning the critical systems that need to be restored after a cyber incident. Without this layer, a trusted recovery is not possible.
Alongside this, organisations must establish control of their most critical systems. This requires recovering data separately from clean snapshots and investigating in parallel, not sequentially, to ensure the recovered systems are not infected by malicious software. As part of this process, backups, configurations, and recovery tooling must be protected from the same blast radius as production.
To set up an isolated environment to rebuild systems without reintroducing compromise, organisations need to set up what we call a ‘Digital Jump Bag’. This is a secure, isolated repository containing everything required to establish a trusted recovery starting point to rebuild systems without reintroducing compromise.
As a final step, organisations need to validate the ability of the MVC to operate through realistic crisis scenarios. Practice is important here because an untested plan remains theoretical. Rehearsals will help to answer the Board’s most direct question in the event of a cyberattack – how long will it take to restore critical services to a trusted state?
Recovering faster by restoring what matters most
For UAE companies today, digital infrastructure underpins business continuity and the country’s wider digital-economy agenda. Under the UAE Digital Economy Strategy, the UAE aims to nearly double the digital economy’s contribution to GDP within ten years, making secure and resilient operations increasingly important. The organisations best prepared will be those that identify what must be restored first and address potential risks before a crisis occurs.
The MVC is not static. As an organisation evolves, its definition must evolve too. But the principle stays the same: recovery improves when organisations stop trying to restore everything and start restoring what matters.
