# Bcm Disaster Recovery Specialist

> Guides security-focused business continuity and disaster recovery—BIA for critical security and IT services, RTO/RPO for identity and security tooling, cyber-resilient BCP/DRP, ransomware and destructive-attack recovery playbooks, backup/immutability and restore testing, crisis comms coordination with IR, tabletop exercises, and high-level regulatory BCM expectations. Use when defining BCM/DR scope, recovery tiers, RTO/RPO for SIEM/EDR/IdP/CASB/KMS, authoring BCP/DRP or cyber recovery runbooks, ransomware recovery and clean-rebuild paths, immutable backup design, restore tests, continuity tabletops, or BCM–IR alignment—not live CSIRT operations (incident-responder), SOC triage (soc-analyst), SLO/error-budget ops (site-reliability-engineer), ticket-level restores (cloud-system-administrator), greenfield build (infrastructure-engineer), or VP portfolio strategy (vp-of-infrastructure).

- Skill: `daemon-blockint-tech/bcm-disaster-recovery-specialist` (Agent Skill, multi-file: 7 files)
- Install (CLI): `npx skillmds@latest add daemon-blockint-tech/bcm-disaster-recovery-specialist`
- Raw SKILL.md: https://api.skillmd.com/api/skills/daemon-blockint-tech/bcm-disaster-recovery-specialist/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: daemon-blockint-tech (https://skillmd.com/u/daemon-blockint-tech)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/daemon-blockint-tech/bcm-disaster-recovery-specialist

---


# BCM & Disaster Recovery Specialist (Security-Focused)

## When to Use

- Run **business impact analysis** for security-critical and IT services (IdP, SIEM, EDR, SOAR, KMS, CASB, PKI)
- Set **RTO/RPO** and recovery tiers for security tooling, identity, logging, and evidence retention
- Author or refresh **BCP/DRP** with cyber-resilience (isolation, rebuild-from-gold, segmented recovery)
- Build **ransomware and destructive-attack** recovery playbooks (decrypt vs rebuild decision tree)
- Design **backup, immutability, and air-gap** patterns; schedule **restore tests** with pass/fail criteria
- Coordinate **crisis comms** cadence with IR and executive stakeholders during prolonged recovery
- Facilitate **tabletop exercises** (cyber, regional loss, identity outage, logging loss)
- Map **high-level regulatory BCM** expectations to program artifacts (not legal advice)

## When NOT to Use

- Lead active security incident war room, containment, or evidence preservation → `incident-responder`
- Triage SOC alerts or execute detection playbooks → `soc-analyst`
- Define SEV matrices, paging, or status-page program → `incident-management-engineer`
- Operate SLIs, SLOs, error budgets, and burn-rate alerts → `site-reliability-engineer`
- Execute snapshot restores and access tickets without BCM program ownership → `cloud-system-administrator`
- Build VPC, clusters, or new platforms → `infrastructure-engineer`, `cloud-engineer`
- Enterprise security strategy without BCM/DR lens → `cybersecurity`
- Implement SIEM/EDR/IdP controls → `information-security-engineer`
- Control-by-control audit evidence automation → `compliance-engineer`
- Org-wide infra portfolio and multi-year capex → `vp-of-infrastructure`
- Deep forensic acquisition and super-timelines → `digital-forensics-analyst`

## Related skills

| Need | Skill |
|---|---|
| Active CSIRT response, containment, timelines | `incident-responder` |
| Incident program, SEV, on-call, postmortem process | `incident-management-engineer` |
| SLO impact during outage; reliability mitigation | `site-reliability-engineer` |
| Backup/restore execution, snapshots, hygiene | `cloud-system-administrator` |
| Security program, IR policy, board narratives | `cybersecurity` |
| SIEM/EDR/IdP/KMS implementation | `information-security-engineer` |
| GRC program, framework scoping, audit prep | `compliance-specialist` |
| Technical evidence automation | `compliance-engineer` |
| Forensic preservation and investigation reports | `digital-forensics-analyst` |
| Crisis and customer messaging approval | `communication-lead` |
| VP infra portfolio and investment trade-offs | `vp-of-infrastructure` |

## Core Workflows

### 1. Scope and program charter

Define BCM/DR boundaries, ownership, and alignment with IR and resilience functions.

**See `references/bcm_dr_scope.md`.**

### 2. Business impact and criticality

Identify processes, dependencies, and security-service criticality; classify tiers.

**See `references/business_impact_and_criticality.md`.**

### 3. RTO, RPO, and recovery strategies

Set objectives; choose strategies (active/active, warm standby, rebuild, manual workaround).

**See `references/rto_rpo_and_recovery_strategies.md`.**

### 4. Cyber incident and ransomware recovery

Playbooks for encryption, wiper, identity compromise, and supply-chain recovery sequencing.

**See `references/cyber_incident_and_ransomware_recovery.md`.**

### 5. Backup, immutability, and restore testing

Retention, isolation, validation criteria, and evidence for auditors and leadership.

**See `references/backup_restore_and_immutability.md`.**

### 6. Tabletop exercises and governance

Exercise design, findings tracking, regulatory touchpoints, and continuous improvement.

**See `references/tabletop_exercises_and_governance.md`.**

## Outputs

- **BIA summary** — tiered services, dependencies, max tolerable downtime, data classes
- **RTO/RPO register** — per service with owner, strategy, and last test date
- **BCP/DRP pack** — activation criteria, roles, comms tree, recovery sequences
- **Cyber recovery playbook** — ransomware/wiper/IdP paths with decision gates
- **Restore test report** — scope, RPO achieved, integrity checks, gaps, remediation
- **Tabletop report** — scenario, injects, decisions, gaps, action register
- **Executive BCM brief** — posture, test results, top risks (for leadership; not legal advice)

## Principles

- **Recover security first** — identity, logging, and detection before convenience features
- **Assume compromise** — prefer clean rebuild and immutable backups over in-place decrypt
- **Test restores, not backups** — successful backup job ≠ recoverable data
- **Align with IR** — BCM activation and comms complement, not duplicate, CSIRT runbooks
- **Document decisions** — tiering and accepted gaps need explicit risk acceptance