Day 5

Culture, exercises, system recovery and lessons learned

Participants can prove that recovery is safe, monitored, approved by the business owner, and turned into measurable improvement actions.

Where this day sits in the chain

Sequence: culture, exercises, recovery, report, lessons.

Rule of the day

A restored backup ≠ a restored service. A lesson ≠ a closed action.

Schedule

How the day runs

Time	Topic	Format	Output
09:00–09:45	Security culture; learning and awareness strategies	Theory	Behaviour and competence evidence
10:00–10:45	System recovery and lessons learned	Theory	Recovery gates and metrics
10:45–12:00	Recovery tabletop exercise	Practical P1	Recovery plan and GO / NO-GO
13:00–13:45	Business recovery and technical reporting	Theory	One fact base, two audiences
13:45–15:00	Technical recovery report	Practical P2	Report, summary and lessons
15:15–15:45	Knowledge check	Test	Kahoot
15:45–16:00	Lessons and reflection	Discussion	Personal transfer action

Breaks: 09:45–10:00, 12:00–13:00 (lunch) and 15:00–15:15. Sessions run online.

Learning outcomes

D5.1Separate declared culture from observed safe behaviour and choose a behaviour metric.
D5.2Define a safe exercise objective, an inject, an observation criterion and a STOP condition.
D5.3Tell containment, eradication, recovery and return to production apart.
D5.4Sequence recovery by service dependencies, RTO / RPO and risk.
D5.5Justify GO / NO-GO with evidence, approvals, monitoring and rollback.
D5.6Write a technical report and an executive summary from one fact base.
D5.7Turn a lesson into an action with an owner, a deadline and verifiable evidence of success.

Practice

Every stage has a duration, a deliverable artefact and an acceptance criterion. Work is done on template copies; original evidence is never modified.

Extra labs

The extra 90-minute or two-academic-hour labs are not automatically added to a full day; the instructor sets their schedule and submission time.

LAB 3D5-BALTNET-REC-002
RTO / RPO and financial transaction reconciliation
Choose a recovery point, calculate the critical path and RTO margin, reconcile restored transactions against a reference and justify GO / NO-GO.
LAB 4D5-BALTNET-LEARN-003
Behaviour change and closing lesson actions
Separate attendance, improved behaviour and proven completion of an action; design a 20-minute blameless re-run of the tabletop.

Carry on in your environment

Previous day

Full programme