MATHEMATICAL MODEL FOR PRIORITIZING INFORMATION SYSTEMS RECOVERY AFTER INFORMATION SECURITY INCIDENTS IN BUSINESS CONTINUITY MANAGEMENT PROCESSES
DOI:
https://doi.org/10.28925/2663-4023.2026.35.1453Keywords:
information security, information security incidents, business continuity, information systems recovery, IT project management, project scheduling, recovery prioritization, mathematical optimization, mixed-integer linear programming, RTO, resource constraints, security verification.Abstract
This article investigates and formalizes the optimal scheduling problem for information system recovery activities and associated security checks following information security incidents within business continuity management processes, taking into account technical dependencies, resource constraints, and recovery time objectives (RTOs). The study substantiates the applicability of mathematical optimization methods for determining recovery priorities based on system business criticality, time-related characteristics, and information security requirements. Existing approaches to recovery planning are analyzed, highlighting the need to jointly consider resource constraints, technological dependencies, and security verification procedures. A mathematical model based on Mixed-Integer Linear Programming (MILP) is proposed to minimize the weighted downtime of information systems and penalties for exceeding RTOs. A distinctive feature of the model is the representation of technical recovery and security verification as separate but interdependent operations that are jointly optimized to determine when systems can safely return to operation. An algorithm for generating an optimal recovery schedule is developed, taking into account resource availability and technological dependencies. A computational experiment is conducted using six interdependent information systems. The proposed model achieves a 1.14 % reduction in the objective function value compared with the RTO-first and Criticality-first heuristic strategies. An ablation study demonstrates a 42.89 % reduction in the objective function value compared with the implemented two-stage planning approach, while reducing the number of systems exceeding their RTOs from four to one. Sensitivity analysis confirms the significant impact of resource availability and security verification duration on recovery performance. The practical significance of the results lies in the potential application of the proposed model to justify information system recovery priorities, allocate limited resources efficiently, and support managerial decision-making in business continuity management processes.
Downloads
References
Järveläinen, J. (2013). IT incidents and business impacts: Validating a framework for continuity management in information systems. International Journal of Information Management, 33(3), 583–590. https://doi.org/10.1016/j.ijinfomgt.2013.03.001
Niemimaa, M., Järveläinen, J., Heikkilä, M., & Heikkilä, J. (2019). Business continuity of business models: Evaluating the resilience of business models for contingencies. International Journal of Information Management, 49, 208–216. https://doi.org/10.1016/j.ijinfomgt.2019.04.010
Järveläinen, J. (2012). Information security and business continuity management in interorganizational IT relationships. Information Management & Computer Security, 20(5), 332–349. https://doi.org/10.1108/09685221211286511
Stamenkov, G. (2022). Layered business continuity and disaster recovery model. Continuity & Resilience Review. https://doi.org/10.1108/crr-05-2022-0008
AlHidaifi, S. M., Asghar, M. R., & Ansari, I. S. (2024). Towards a cyber resilience quantification framework (CRQF) for IT infrastructure. Computer Networks, 110446. https://doi.org/10.1016/j.comnet.2024.110446
Dupont, B., Shearing, C., Bernier, M., & Leukfeldt, R. (2023). The tensions of cyber-resilience: from sensemaking to practice. Computers & Security, 103372. https://doi.org/10.1016/j.cose.2023.103372
Chiu, C. Y. (2026). From backup restoration to Minimum Viable Factory Recovery: A systematization of ransomware recovery in manufacturing systems. International Journal of Critical Infrastructure Protection, 54, 100882. https://doi.org/10.1016/j.ijcip.2026.100882
Liu, L., Sajid, Z., Kravaris, C., & Khan, F. (2025). RESPONSE- a Resilient Framework to Manage Cyber-attacks on Cyber-physical Process Systems. Digital Chemical Engineering, 100238. https://doi.org/10.1016/j.dche.2025.100238
Almoghathawi, Y., Barker, K., & Albert, L. A. (2019). Resilience-driven restoration model for interdependent infrastructure networks. Reliability Engineering & System Safety, 185, 12–23. https://doi.org/10.1016/j.ress.2018.12.006
Zhou, J., Coit, D. W., Felder, F. A., & Wang, D. (2021). Resiliency-based restoration optimization for dependent network systems against cascading failures. Reliability Engineering & System Safety, 207, 107383. https://doi.org/10.1016/j.ress.2020.107383
Almoghathawi, Y., Selim, S., & Barker, K. (2022). Community Structure Recovery Optimization for Partial Disruption, Functionality, and Restoration in Interdependent Networks. Reliability Engineering & System Safety, 108853. https://doi.org/10.1016/j.ress.2022.108853
Xu, M., Li, G., & Chen, A. (2023). Resilience-driven post-disaster restoration of interdependent infrastructure systems under different decision-making environments. Reliability Engineering & System Safety, 109599. https://doi.org/10.1016/j.ress.2023.109599
Rangrazjeddi, A., González, A. D., & Barker, K. (2024). Game‐theoretic algorithm for interdependent infrastructure network restoration in a decentralized environment. Risk Analysis. https://doi.org/10.1111/risa.14269
Garay-Sianca, A., & Nurre Pinkley, S. G. (2021). Interdependent integrated network design and scheduling problems with movement of machines. European Journal of Operational Research, 289(1), 297–327. https://doi.org/10.1016/j.ejor.2020.07.013
Li, Y.-l., Lin, J., Li, G.-j., Liu, B.-s., & Wang, C. (2020). Restoration of Interdependent Critical Infrastructure Network: A Model for Joint Optimization of Scheduling and Routing. In Construction Research Congress 2020. American Society of Civil Engineers. https://doi.org/10.1061/9780784482858.001
Hartmann, S., & Briskorn, D. (2021). An updated survey of variants and extensions of the resource-constrained project scheduling problem. European Journal of Operational Research. https://doi.org/10.1016/j.ejor.2021.05.004
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Admin Skladannyi
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
