AI-CRRQ™ FRAMEWORK v1.0 · METHODOLOGY

How AI-CRRQ™ Helps Assess Resilience Posture

A plain-language explanation of the three AI-CRRQ™ vectors, the Survival Index™ formula logic, and the framework's design intent. AI-CRRQ™ is directional and scenario-based — designed for decision support, not precise prediction.

Developed by Alim Abdul · Cyber Risk & Resilience Practice · AICRRQ.com (2026)

Framework Design Intent

AI-CRRQ™ is designed to support executive decision-making about cyber survivability. Understanding what the framework does — and what it does not claim to do — is essential for applying it correctly.

METHODOLOGY NOTE · AI-CRRQ™ v1.0

Directional and scenario-based. AI-CRRQ™ produces a scored output designed to orient leadership decision-making and identify survivability gaps — not to generate actuarially precise risk probabilities.

Designed for decision support, not precise prediction. The Survival Index™ is a comparative and diagnostic tool. It enables organizations to understand their relative survivability posture and prioritize improvement — it is not a prediction of specific incident outcomes.

TEI is intentionally influential. Threat Exposure Index serves as the denominator in the Survival Index™ formula. This is by design — threat pressure materially affects survivability regardless of organizational resilience investments. A highly resilient organization facing extreme threat exposure will still show survivability constraints. This reflects operational reality.

Complements, does not replace, existing frameworks. AI-CRRQ™ is designed to work alongside NIST CSF, ISO 27001, FAIR, and similar frameworks — adding the operational resilience posture layer that those frameworks are not designed to measure.

Public Framework · Proprietary Applied Methodology

The Survival Index™ formula and three-vector structure are published as a public conceptual framework. The applied scoring methodology, input weighting, scenario interpretation logic, and advisory facilitation model are proprietary to AICRRQ and are delivered exclusively through formal engagements.

TEI · ORCI · RVI — Deep Explanation

Each vector measures a distinct survivability dimension. Together, they produce the Survival Index™.

TEI
DENOMINATOR · TEI ↑ → SI ↓

Threat Exposure Index

The TEI measures the aggregate threat and financial pressure an organization faces. It is the denominator of the Survival Index™ formula — higher threat exposure reduces survivability, even when resilience and recovery capabilities are strong. This relationship is intentional: threat pressure is not neutral, and any survivability framework that treats it as such would misrepresent organizational risk.

WHAT TEI MEASURES
Financial ExposureEstimated breach cost range — direct losses, remediation, business interruption, third-party liability.
Breach ProbabilityLikelihood of a material cyber incident given the organization's industry, size, and existing controls.
Regulatory Penalty RiskExposure under applicable frameworks: HIPAA/HITECH, NYDFS 500, SEC Cyber Rules, DORA, NIS2, GDPR, PCI-DSS, FFIEC.
Attack Surface BreadthDensity of third-party vendors, cloud deployments, endpoints, and legacy systems creating exposure vectors.
Executive interpretation: Threat Pressure Score. "How much threat and financial pressure is our organization under?" Higher Threat Pressure reduces survivability directly — even excellent resilience cannot fully offset severe exposure.
ORCI
PRIMARY VARIABLE · ORCI ↑ → SI ↑↑

Operational Response Capability Index

The ORCI is the primary determinant of survivability in the AI-CRRQ™ model. Post-incident analysis across major cyber events consistently demonstrates that organizations fail to survive not because their defenses were breached — defenses are routinely breached — but because leadership could not sustain operations under crisis conditions. ORCI measures the capability that determines whether the organization keeps running when it matters most.

WHAT ORCI MEASURES
Crisis Command ClarityDefined decision authority, escalation paths, and role accountability under active cyber disruption.
Leadership Decision SpeedTime-to-decision under adversarial pressure — the ability to act decisively without full information.
Incident Response MaturityPlaybook depth, tabletop exercise frequency, and the gap between documented procedures and practiced capability.
Cross-Functional CoordinationAlignment across legal, communications, IT, operations, finance, and board — the functions that must move together in a crisis.
Executive interpretation: Operational Resilience Score. "How prepared is our leadership to keep the organization running during a cyber attack?" This is the most influential variable — improving ORCI produces the greatest improvement in Survival Index™.
RVI
RECOVERY VELOCITY · RVI ↑ → SI ↑

Recovery Velocity Index

The RVI measures the speed and reliability with which an organization can restore critical operations after a cyber incident. RVI recognizes that recovery is not binary — organizations do not simply "recover" or "fail to recover." They recover at different speeds, with different scope, and with different levels of data integrity. Faster, more complete recovery materially improves operational resilience posture.

WHAT RVI MEASURES
RTO/RPO AttainmentAbility to meet Recovery Time Objectives and Recovery Point Objectives under real incident conditions — not just documented targets.
Failover CapabilityAvailability of tested, operational failover systems for critical business functions during primary system disruption.
Backup IntegrityTested, air-gapped or immutable backups — the last line of defense against ransomware and destructive attacks.
BCP MaturityBusiness Continuity Plan depth, testing frequency, and integration with incident response protocols across the organization.
Executive interpretation: Recovery Speed Score. "How quickly can our organization restore normal operations after an attack?" Measured through recovery objectives, failover capability, backup integrity, and continuity plan maturity.

Why the Formula Works This Way

The Survival Index™ formula encodes a specific operational logic about how survivability actually works — not how we wish it would work.

OFFICIAL FORMULA · AI-CRRQ™ FRAMEWORK v1.0
SI = min(100, (ORCI × RVI) / TEI)
"Survivability = (Resilience × Recovery Speed) / Threat Pressure"
WHY ORCI × RVI

Leadership readiness and recovery speed are multiplicative, not additive. A high-capability leadership team paired with slow recovery produces diminishing survivability — and vice versa. Both must be strong for survivability to be strong.

WHY TEI IS THE DENOMINATOR

Threat pressure is not a variable that organizational resilience "cancels out" — it compounds survivability risk regardless of how capable the organization is. Placing TEI in the denominator reflects this operational reality: higher threat exposure reduces your Survival Index™ even if resilience and recovery are strong.

WHY ORCI IS PRIMARY

In the Quantitative Risk Model, ORCI is raised to the power of 1.2 — an accelerating penalty for leadership gaps. This reflects how leadership capability compounds under real adversarial pressure: a team at 50% capability does not perform at "half" the level of an elite team during a crisis. The performance gap is significantly larger.

Framework in Action: Ransomware at a Regional Hospital

A concrete illustration of how AI-CRRQ™ interprets a real cyber disruption scenario — and what the Survival Index™ reveals.

SCENARIO · RANSOMWARE · HEALTHCARE SECTOR

Regional Hospital — Ransomware Attack During Peak Operating Hours

A ransomware group encrypts EHR systems, medical devices, and scheduling infrastructure simultaneously. The hospital has moderate security controls (regular patching, endpoint protection), but leadership has never run a cyber crisis drill. Backup systems exist but have not been tested against a full-facility scenario. The hospital is subject to HIPAA, state health department regulations, and its cyber insurer has a 72-hour notification requirement.

TEI · THREAT PRESSURE
72
High Exposure — regulated healthcare data, active ransomware, broad attack surface including medical devices and third-party vendors
ORCI · RESILIENCE
41
Developing — leadership unprepared for crisis command, no tested incident response protocol, IR team understaffed and undertrained
RVI · RECOVERY
55
Moderate — backups exist but untested; RTO objectives undefined for patient-critical systems; no cyber-specific BCP tested
SURVIVAL INDEX™ RESULT
~31 / 100 · Critical Tier

What this reveals: SI = min(100, (41 × 55) / 72) ≈ 31. Despite moderate security controls, this hospital scores in the Critical tier. The Survival Index™ is suppressed by three converging factors: high threat pressure (TEI 72), weak leadership readiness (ORCI 41), and untested recovery capability (RVI 55).

Survivability Takeaway: The critical investment is not more security tools. It is crisis command capability (ORCI) and tested recovery procedures (RVI). Improving ORCI from 41 to 65 and RVI from 55 to 70, while holding TEI constant, would move this hospital from Critical to Vulnerable — a materially different operational posture.

FORMULA CALCULATION
SI = (41 × 55) / 72 × 100 = 2,255 / 72 × 100 ≈ 31.3

Stress Test Your Survivability Posture

The Survivability Stress Test is a structured facilitated exercise that pressure-tests an organization's Survival Index™ against realistic cyber disruption scenarios.

SURVIVABILITY STRESS TEST™ · AICRRQ

What the Stress Test Reveals

The Survival Index™ calculator provides a directional score. The Survivability Stress Test probes whether that score holds under real crisis pressure — exposing gaps that theoretical inputs cannot surface.

STEP 01

Baseline Scoring

Establish the organization's TEI, ORCI, and RVI baseline using the AI-CRRQ™ calculator and structured input interviews.

STEP 02

Scenario Injection

Apply one of three scenario archetypes — ransomware, supply chain compromise, or destructive attack — to the baseline. Each scenario shifts TEI, ORCI, and RVI based on the scenario's specific pressure profile.

STEP 03

Leadership Crisis Simulation

A structured tabletop exercise that tests whether ORCI assumptions hold under real-time decision pressure — validating or challenging the baseline score.

STEP 04

Survivability Gap Report

Produce a scored Survival Index™ output under the stress scenario, with specific gap analysis and remediation prioritization focused on ORCI improvement first.

Request a Stress Test → View All Services