Sustainability: The Forgotten Dimension of Cyber Recovery Planning

Sammanfattning

Organizations increasingly depend on digital infrastructures to sustain critical operations, making cyber recovery planning a fundamental organizational capability. Yet despite growing attention to both cyber resilience and organizational sustainability, the intersection between them remains empirically underexplored — particularly from a socio-technical perspective. This study addresses that gap by examining how organizations design and manage cyber recovery planning structures, and how environmental, economic and social sustainability considerations are reflected within those structures. A qualitative exploratory research design was adopted, drawing on nine semi-structured interviews with participants across strategic, tactical and operational roles in an IT consultancy firm, complemented by cross-sector perspectives from the banking and e-commerce sectors. An internal Security Incident Response Team (SIRT) framework document was analyzed alongside the interview data to enable triangulation. Findings were analyzed thematically following Braun and Clarke (2006) and interpreted through two theoretical lenses — Socio-Technical Systems (STS) theory as the primary analytical framework and the Triple Bottom Line (TBL) model as a complementary lens for examining sustainability dimensions. The findings reveal that the primary organization has a formally documented and standards-aligned planning structure, yet a consistent gap exists between what is formally documented and what is known and practiced at the operational level. Recovery knowledge is concentrated in only certain individuals, plans remain untested, and internal preparedness work is structurally deprioritized due to commercial billing pressures. Regarding sustainability, economic considerations receive the most attention but are applied narrowly. Social sustainability is managed informally and reactively, while environmental sustainability is entirely absent from recovery planning across all organizational contexts examined but present only at the infrastructure setup stage. This study contributes original empirical evidence of how socio-technical misalignment and Triple Bottom Line sustainability gaps manifest simultaneously in organizational cyber recovery planning, demonstrating that technical planning sophistication does not equate to operational resilience. The findings are relevant to IT organizations, framework developers and policymakers working toward more integrated approaches to sustainable cyber resilience.