CPS 230 is written in the language of operational risk management, and it is delivered by engineers. That gap is where programs lose time — the policy work completes, produces a register of critical operations and tolerance levels, and then nobody is quite sure what to build.
What actually changes for engineering
Three obligations carry most of the technical weight: identifying critical operations and their tolerance levels, testing that those tolerances can be met, and managing material service provider risk. Everything else is important and largely process.
The important shift is from documented to demonstrated. A recovery procedure that exists on paper no longer satisfies the intent; the expectation is evidence that it has been executed and the tolerance met.
The distance between a documented recovery plan and a tested one is where most of the engineering work lives.
Critical operations are not applications
The most common early mistake is mapping critical operations onto application names, because that is the inventory people already have. A critical operation is a business outcome — 'process a member payment', 'issue a policy' — and it typically spans several applications, at least one third party and a manual step somebody forgot to mention.
Map it from the outcome backwards. The dependencies that surface that way are the ones that break recovery exercises.
People. Nearly every recovery plan we have tested contained a step that only one named individual could perform, usually involving a credential or certificate held outside the secrets store.
Translating the obligations into AWS controls
| Obligation | Engineering control | Evidence artefact |
|---|---|---|
| Critical operation identification | Resource tagging linking every workload to a critical operation | Tag compliance report from AWS Config |
| Tolerance levels | Documented RTO/RPO enforced by backup and replication configuration | AWS Backup plan configuration and restore-test results |
| Scenario testing | Automated failover exercises via Route 53 ARC and runbook automation | Exercise logs with measured restoration times |
| Service provider management | Dependency register with tested workarounds per material provider | Documented workaround exercise results |
| Incident management | Detection, escalation and post-incident review as pipeline-integrated process | Incident timeline exported from your observability platform |
The evidence column is the point: each control produces its artefact as a by-product of running.
Evidence should be a build artefact
If producing your quarterly evidence pack requires a person to take screenshots, the control and the evidence for the control are two different things — and they will drift.
The alternative is to generate evidence from the same infrastructure code and pipeline runs that provision the environment. Config rules, Backup restore-test results, exercise logs and Terraform state all serialise cleanly. On one engagement this reduced quarterly preparation from roughly two weeks of senior engineering time to a pipeline run.
Run the exercise before you are ready
The strongest recommendation we make on CPS 230 programs is to run a full failover exercise early, while it is still expected to fail. The first exercise is where the wrong assumptions surface, and they are always assumptions nobody thought to write down.
- A certificate held by an individual rather than in Secrets Manager
- A DNS record with a TTL long enough to make the measured RTO unachievable
- A downstream system that requires manual re-enablement after a failover
- A runbook step referencing a tool that was decommissioned last year
None of those appear in a design review. All of them appear in the first exercise.
A sensible sequence
- Weeks 1–3: Map critical operations from business outcomes backwards, including third parties and manual steps
- Weeks 4–6: Agree tolerance levels with the business, not with technology
- Weeks 7–10: Run the first exercise and expect it to fail; remediate what it exposes
- Weeks 11–16: Automate evidence generation and establish the exercise cadence
You can answer 'show me that this works' in an afternoon rather than a fortnight — and the answer is a generated artefact, not a document somebody wrote.
CPS 230 program stalled at the engineering handover?
We run the translation workshop with your risk and engineering teams in the same room, which is usually the fastest way to unblock it.