Lesson 2: Security Strategy for Business Resiliency Goals

Before you start

This course follows Microsoft's Study guide for Exam SC-100: Microsoft Cybersecurity Architect. The guide is free on Microsoft Learn and is not reproduced here. Check the official exam page for the exam's length, price and languages. This course is independent of Microsoft and not endorsed by Microsoft, and it cannot guarantee that you will pass.

This level covers the first bullet in the skills measured as of October 21, 2026, which sits in Design a resiliency strategy for ransomware and other attacks based on Microsoft Security Best Practices:

Design a security strategy to support business resiliency goals, including identifying and prioritizing threats to business-critical assets.

That skill group belongs to the domain Design solutions that align with security best practices and priorities (20–25%).

The mindset: resilience, not perfection

As an engineer, you have mostly asked how to stop an attack. As an architect, you also ask how the business keeps running when an attack succeeds. Microsoft's guidance is direct about this: an organization can never have perfect security, but it can become resilient to attacks. Resilience means taking a pragmatic view that assumes breach.

Assume breach is one of the three Zero Trust principles, alongside verify explicitly and use least privileged access. It replaces the old belief that a safe network perimeter could protect all valuable activity. Microsoft describes resilience as a cycle:

1. Before an incident: keep improving your security posture and your ability to respond. The aim is to make attackers' known techniques stop working.
2. During an incident: keep the business running, even if it is degraded or limited to critical systems. There are two priorities:
   • Protect critical operations above all other functions.
   • Prevent further damage by finding the full extent of the attacker's access and evicting them quickly.
3. After an incident: start repairs immediately, even if that means restoring operations without data that was lost.
4. Feedback loop: attackers repeat what works, so learn from each attack so you can block, detect, respond to and recover from it next time.

Microsoft's resilience goals are to enable the business (find safe ways to say yes to innovation) and to limit the impact and likelihood of disruption before, during and after attacks.

Case study: Contoso Freight

Contoso Freight is a logistics company. Its leadership states two goals:

• G1: Trucks must keep moving even during a cyberattack.
• G2: No more than 15 minutes of customer orders may ever be lost.

Use this case study for each task below.

Task 1: Identify business-critical assets

DO: Work with business stakeholders, not only IT. Sort the candidate systems into Microsoft's five priority categories:

• Identity systems: Active Directory, Microsoft Entra Connect and domain controllers. Users need these to reach every other system.
• Human life systems: medical systems, safety systems, controls for large machinery, and chemical or biological systems.
• Financial systems: payment processing and financial reporting.
• Product or service enablement: factory control, delivery infrastructure and dispatch.
• Security systems (minimum): the monitoring needed to make sure the current attacker cannot immediately get back into restored systems.

Also list any AI systems the business relies on, such as Contoso's AI route optimizer.

Task 2: Map dependencies

DO: For each critical asset, trace what it needs in order to work. At Contoso, dispatch depends on its order database, on the route optimizer, and on AD DS for sign-in. That means AD DS is effectively as critical as dispatch. If you protect the application but not the identity system it relies on, the strategy has a hole in it. For AI services, write down which business operations fail when the service is unavailable, and define a fallback procedure.

Task 3: Classify criticality

DO: Give each asset a criticality level. Microsoft Security Exposure Management uses four:

• Very High: essential to the survival and continuity of the business; compromise could be catastrophic.
• High: crucial to core operations; compromise could cause significant disruption.
• Medium: moderate impact on certain functions or processes.
• Low: minimal impact on operations and security.

At Contoso, dispatch, its database and AD DS are Very High. The marketing site is Low.

Task 4: Assess and rank threats by business impact

DO: For each critical asset, list the likely threats. These include ransomware and extortion, DDoS, data breach and exfiltration, insider threats, supply chain compromise, AI-specific threats (model poisoning, prompt injection, training data exfiltration), and natural disasters or infrastructure failures. Then rank each threat by:

1. Likelihood of occurrence.
2. Business impact: financial, operational, reputational and regulatory.
3. Time to recover.
4. Complexity of mitigation.

At Contoso, ransomware against dispatch and AD DS ranks first. It is likely, it would stop the trucks, and recovery would be slow.

Task 5: Turn goals into traceable requirements

DO: Write each requirement so it points back to a business goal. For every threat you have prioritized, specify four kinds of response:

• Preventive controls, to reduce likelihood.
• Detective controls, for early warning.
• Response procedures, to contain damage.
• Recovery capabilities, to restore operations.

Then set a Recovery Time Objective (RTO) and a Recovery Point Objective (RPO) for each critical asset. Base them on business requirements, not on what is technically convenient. RTO is how quickly a system must be restored. RPO is how much data loss is acceptable, measured in time.

Example:

• REQ-04 (traces to G2): the order database has an RPO of 15 minutes.
• REQ-05 (traces to G1): dispatch and its identity dependencies have an RTO of 4 hours.

Later design decisions, such as backup and ransomware controls, must each cite one of these requirement IDs. The tools that meet these requirements are covered in later levels.

What the exam asks about this

• In case studies, look for the asset the business cannot run without, then look for what that asset depends on. Identity is the usual hidden dependency.
• Choose answers that rank by business impact, not by technical severity or how easy the fix is.
• Watch for distractors that imply perfect prevention or rely on the perimeter alone. The correct answer assumes breach and plans for recovery.
• Know the difference between RTO and RPO, and know that both come from the business.
• During an incident, the correct priority is to protect critical operations first, then evict the attacker to prevent further damage.

Key takeaways

• Resilience assumes breach and covers the whole cycle: before, during and after an incident, plus the feedback loop.
• Identify critical assets with the business, using five categories: identity, human life, financial, product or service enablement, and minimum security.
• Map dependencies, because an asset is only as resilient as what it relies on.
• Rank threats by likelihood, business impact, time to recover and complexity of mitigation.
• Write requirements, including RTO and RPO, that trace back to stated business goals.