Scenario-Based Disaster Recovery Training for Improving Incident-Response and RTO/RPO Decision-Making Among Enterprise Cloud Engineers
Keywords:
recovery point objective, recovery time objective, incident response, disaster recoveryAbstract
Enterprise cloud disaster recovery depends not only on resilient architectures but also on engineers who can recognize incident scope, translate business impact into recovery objectives, select appropriate recovery strategies, and execute restoration under time pressure. Conventional policy review and lecture-based instruction provide limited opportunities to practice these coupled technical and judgment-intensive tasks. This review synthesizes evidence on scenario-based cybersecurity and disaster-recovery training and develops a competency-oriented framework for improving incident-response performance and recovery time objective (RTO)/recovery point objective (RPO) decision-making among enterprise cloud engineers. A structured review was conducted across peer-reviewed literature on cyber ranges, incident-response tabletop exercises, serious games, experiential cybersecurity training, and disaster-recovery evaluation, supplemented by authoritative contingency-planning and cloud-resilience guidance. Eligible evidence addressed realistic or simulated incident scenarios, measurable learning or performance outcomes, exercise design, or RTO/RPO-based recovery decisions, with findings synthesized across individual, team, and technical decision domains. The evidence consistently favors authentic, scenario-driven practice over passive knowledge transfer for developing incident-response awareness, procedural fluency, communication, and applied decision-making. Cyber-range studies indicate that realistic environments can support measurable acquisition of incident-response knowledge and skills, while tabletop and serious-game studies demonstrate benefits for preparedness, role clarity, strategic reasoning, and security self-efficacy. In disaster-recovery contexts, the principal contribution of training is not to alter the technical limits of replication or restore mechanisms, but to improve the selection and execution of recovery actions under explicit business constraints. Effective exercises therefore require workload-specific RTO and RPO targets, progressive incident injects, dependency failures, observable performance metrics, and structured debriefing. Scenario-based disaster-recovery training is therefore a credible approach for strengthening the socio-technical competencies required of enterprise cloud engineers. Programs are most defensible when they assess objective decision quality and operational performance rather than satisfaction alone, and when scenarios compel engineers to reconcile business impact, data-loss tolerance, recovery architecture, security containment, and service restoration.
References
Swanson M, Bowen P, Phillips A, Gallup D, Lynes D. Contingency Planning Guide for Federal Information Systems. NIST Special Publication 800-34 Rev. 1. Gaithersburg (MD): National Institute of Standards and Technology; 2010. doi:10.6028/NIST.SP.800-34r1.
Amazon Web Services. REL13-BP01: Define recovery objectives for downtime and data loss. AWS Well-Architected Framework, Reliability Pillar. Seattle: Amazon Web Services; 2023.
Mendonça J, Lima R, Andrade E. Evaluating and modelling solutions for disaster recovery. Int J Grid Util Comput. 2020;11(5):683-704. doi:10.1504/IJGUC.2020.110055.
Cichonski P, Millar T, Grance T, Scarfone K. Computer Security Incident Handling Guide. NIST Special Publication 800-61 Rev. 2. Gaithersburg (MD): National Institute of Standards and Technology; 2012. doi:10.6028/NIST.SP.800-61r2.
Petersen R, Santos D, Wetzel K, Smith M, Witte G. Workforce Framework for Cybersecurity (NICE Framework). NIST Special Publication 800-181 Rev. 1. Gaithersburg (MD): National Institute of Standards and Technology; 2020. doi:10.6028/NIST.SP.800-181r1.
Angafor GN. Game-based learning: a review of tabletop exercises for cybersecurity incident response training. Security and Privacy. 2020;3:e126. doi:10.1002/spy2.126.
O'Connor S, Hasshu S, Bielby J, Colreavy-Donnelly S, Kuhn S, Caraffini F, et al. SCIPS: a serious game using a guidance mechanic to scaffold effective training for cyber security. Inf Sci. 2021;580:524-540. doi:10.1016/j.ins.2021.08.098.
van Steen T, Deeleman JRA. Successful gamification of cybersecurity training. Cyberpsychol Behav Soc Netw. 2021;24(9):593-598. doi:10.1089/cyber.2020.0526.
Angafor GN, Yevseyeva I, Maglaras L. Scenario-based incident response training: lessons learnt from conducting an experiential learning virtual incident response tabletop exercise. Inf Comput Secur. 2023;31(4):404-426. doi:10.1108/ICS-05-2022-0085.
Glas M, Vielberth M, Pernul G. Train as you Fight: Evaluating Authentic Cybersecurity Training in Cyber Ranges. In: Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems. New York: ACM; 2023. p. 1-19. doi:10.1145/3544548.3581046.
Katsantonis MN, Manikas A, Mavridis I, Gritzalis D. Cyber range design framework for cyber security education and training. Int J Inf Secur. 2023;22(4):1005-1027. doi:10.1007/s10207-023-00680-4.
Karagiannis S, Magkos E, Karavaras E, Karnavas A, Nikiforos MN, Ntantogian C. Towards NICE-by-Design Cybersecurity Learning Environments: A Cyber Range for SOC Teams. J Netw Syst Manage. 2024;32:42. doi:10.1007/s10922-024-09816-w.
Glas M, Messmann G, Pernul G. Complex yet attainable? An interdisciplinary approach to designing better cyber range exercises. Comput Secur. 2024;144:103965. doi:10.1016/j.cose.2024.103965.
Angafor GN, Yevseyeva I, Maglaras L. MalAware: a tabletop exercise for malware security awareness education and incident response training. Internet Things Cyber-Phys Syst. 2024;4:280-292. doi:10.1016/j.iotcps.2024.02.003.
Zhao T, Gasiba TE, Lechner U, Pinto-Albuquerque M. Thriving in the era of hybrid work: raising cybersecurity awareness using serious games in industry trainings. J Syst Softw. 2024;210:111946. doi:10.1016/j.jss.2023.111946.
Shin Y, Kwon H, Jeong J, Shin D. A study on designing cyber training and cyber range to effectively respond to cyber threats. Electronics. 2024;13(19):3867. doi:10.3390/electronics13193867.
Google Cloud. Architecting disaster recovery for cloud infrastructure outages. Cloud Architecture Center. Mountain View (CA): Google; 2024.
Amazon Web Services. Disaster Recovery of Workloads on AWS: Recovery in the Cloud. AWS Well-Architected Framework. Seattle: Amazon Web Services; 2022.
