What is a Minimum Viable Company (MVC) in the context of cyber recovery?

MVC is a recovery strategy that identifies and restores only the core business functions and systems absolutely necessary to keep operations running after a cyber attack. Rather than attempting full restoration, it focuses on getting critical systems like ERP, customer-facing websites, and essential integrations back online quickly while investigation continues.

How does Commvault support organizations implementing an MVC strategy?

Commvault provides both technology tools and consulting services to help organizations define their minimum viable requirements, test recovery scenarios, and execute MVC plans. They bring their partner network into the process and offer tools designed to make iterative testing practical, recognizing that organizations typically need multiple attempts to correctly identify their true minimum requirements.

What to do (at a minimum) to recover after a cyber attack

Name: What to do (at a minimum) to recover after a cyber attack
Uploaded: 2026-02-28T12:27:54-05:00
Duration: 2 min 33 s
Description: TL;DR Minimum Viable Company (MVC) strategy focuses on rapidly restoring only the core business functions needed to operate immediately after a cyber attack, rather than attempting full system recovery. Organizations should deploy specialized tiger tea...

Commvault

02/28/2026

0 (0%)

Report Like Favorite

Transcript

So what I like about MVC is minimum viable company is what are the minimum number of things that I need? What are those very specific things to run the business? Right. I need my ERP to be up and running. What does that mean? Our website needs to be up and running. What does that mean? It needs to interact with our ERP so we can check constantly check inventory. What does that actually mean to us? Right. How do we reconcile lost transactions? How do we reconcile lost time? How do we manage the identity system that may have been compromised six months before the encryption occurred, before the security event was noticed? Right. And and thus those accounts may still exist. And then you start the investigation. At the same time you're trying to do some sort of triage. What's down? What's broken? How bad is this? Is this currently? Right. What do we think this is? The reason investigation is important is you're trying to figure out how long have they been in your environment. It's a critical piece of information to recovery. And immediately you start kicking off. What are we what is our fail over if any? And how do we get back up and running? So you actually have a separate tiger team developed to get MVC back up. Once that's up and running then that team moves right back over to incident response and you continue the incident response. All the investigative integrity is maintained. All the evidentiary integrity is maintained. All of that stuff can still continue and is part of the feedback loop that you use for the long-term repairs. While the business, the minimum viable business, however you define that, is up and running. And the neat part is it also doesn't have to be one thing. Right. You could have an MVC for the company, but you could also have an MVC for a particular piece of operations or a particular business unit. Commvault has staffed around this. They've staffed to help be your kind of consultant as they go through this and they're bringing their partner network along with them. Right. So you don't have to feel like you're all alone here. It's really critical that you have tools that make testing easy because you're effectively testing the theory of is this my minimum viable company? And I guarantee the first few times you do it, you're going to be wrong. There's a ton of configuration here. Is the juice worth the squeeze? And that's really kind of what Commvault has taken on.

TL;DR

Minimum Viable Company (MVC) strategy focuses on rapidly restoring only the core business functions needed to operate immediately after a cyber attack, rather than attempting full system recovery.
Organizations should deploy specialized tiger teams to execute MVC recovery while maintaining parallel incident investigation with full evidentiary integrity for long-term remediation.
Commvault provides both technology tools and consulting services through its partner network to help organizations define, test, and implement MVC recovery plans at enterprise or business unit levels.

Summary

Howard Holton, CTO of GigaOm, introduces the concept of Minimum Viable Company (MVC) as a cyber recovery strategy that prioritizes restoring core business functions immediately following a security incident. Rather than attempting full system restoration, the MVC approach identifies the essential subset of operations needed to keep the business running while incident investigation continues in parallel. Holton explains how organizations can define their critical systems—such as ERP platforms, customer-facing websites, and inventory management—and develop specialized tiger teams to execute rapid failover and recovery. The strategy emphasizes maintaining investigative and evidentiary integrity while simultaneously bringing minimum viable operations online. Commvault positions itself as both a technology provider and consulting partner in this process, offering tools that simplify testing and validation of MVC plans. The framework is flexible enough to apply at the enterprise level or to specific business units, with iterative testing recognized as essential to refining what truly constitutes minimum viability for each organization.

Chapters

0:00 - Defining Minimum Viable Company
0:51 - Parallel Investigation and Triage
1:20 - Tiger Team Recovery Execution
2:01 - Commvault Support and Testing

Key Quotes

0:10 "So what I like about MVC is minimum viable company is what are the minimum number of things that I need? ..."
1:20 "So you actually have a separate tiger team developed to get MVC back up."
2:20 "And I guarantee the first few times you do it, you're going to be wrong."

Categories:

Tags:

Show more Show less

Browse videos

Upcoming Webinar Calendar

10/13/2026

01:00 PM

10/13/2026

Transitioning from CJIS to FERPA: Essential Audit Evidence for Compliance

https://www.truthinit.com/index.php/channel/2159/transitioning-from-cjis-to-ferpa-essential-audit-evidence-for-compliance/
10/15/2026

11:00 AM

10/15/2026

Risk in Real Time Demo Series: Virtual Patching: Protection at the Speed of Exploitation

https://www.truthinit.com/index.php/channel/1372/risk-in-real-time-demo-series-the-autonomous-era-orchestrating-a-resilient-enterprise/
10/20/2026

11:00 AM

10/20/2026

Harnessing Data Governance for AI with Cyera and Snowflake

https://www.truthinit.com/index.php/channel/2137/harnessing-data-governance-for-ai-with-cyera-and-snowflake/
10/27/2026

11:00 AM

10/27/2026

Maximize Your Microsoft Investment for Security and Growth

https://www.truthinit.com/index.php/channel/2178/maximize-your-microsoft-investment-for-security-and-growth/
10/27/2026

01:00 PM

10/27/2026

The HUMAN Experience: Real-Time Insights into Page Intelligence

https://www.truthinit.com/index.php/channel/2139/the-human-experience-real-time-insights-into-page-intelligence/
10/28/2026

01:00 AM

10/28/2026

[APAC:] Secure AI Everywhere: Visibility, governance and protection for the agentic era

https://www.truthinit.com/index.php/channel/2125/apac-ensuring-comprehensive-security-for-ai-applications/
10/28/2026

06:00 AM

10/28/2026

[EMEA:] Secure AI Everywhere: Visibility, governance and protection for the agentic era

https://www.truthinit.com/index.php/channel/2127/emea-ensuring-ai-security-across-all-platforms/
10/28/2026

01:00 PM

10/28/2026

[AMERICAS:] Secure AI Everywhere: Visibility, governance and protection for the agentic era

https://www.truthinit.com/index.php/channel/2126/securing-ai-across-the-americas-strategies-and-insights/
10/28/2026

01:00 PM

10/28/2026

EnvZero: Near-Zero Time to Resolution--Live Agentic Remediation for Failed and Drifted Infrastructure

https://www.truthinit.com/index.php/channel/2179/envzero-near-zero-time-to-resolution-live-agentic-remediation-for-failed-and-drifted-infrastructure/
11/04/2026

11:00 AM

11/04/2026

Leveraging CISA’s Zero Trust Maturity Model in an AI-Driven Landscape

https://www.truthinit.com/index.php/channel/2149/leveraging-cisas-zero-trust-maturity-model-in-an-ai-driven-landscape/
11/04/2026

11:00 AM

11/04/2026

Aligning Agentic Intent: Understanding Your Agents' Purpose vs. Their Actions

https://www.truthinit.com/index.php/channel/2158/aligning-agentic-intent-understanding-your-agents-purpose-vs-their-actions/
11/05/2026

02:00 PM

11/05/2026

HUMAN Dialogue: Embracing the Rise of the Agentic Consumer in AI

https://www.truthinit.com/index.php/channel/2160/human-dialogue-embracing-the-rise-of-the-agentic-consumer-in-ai/
11/05/2026

02:00 PM

11/05/2026

Reclaim Your Evenings: Leverage Data Intelligence to Minimize Risk and Boost AI Adoption

https://www.truthinit.com/index.php/channel/2172/reclaim-your-evenings-leverage-data-intelligence-to-minimize-risk-and-boost-ai-adoption/
11/19/2026

01:00 PM

11/19/2026

360View: Govern, Secure & Recover Your Microsoft 365 Environment

https://www.truthinit.com/index.php/channel/2076/360view-govern-secure-recover-your-microsoft-365-environment/
11/19/2026

01:00 PM

11/19/2026

Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents

https://www.truthinit.com/index.php/channel/2181/zendesk-deep-dive-get-the-work-done-faster-with-employee-service-ai-agents/