Critical service outage
Availability as a security property: zone failures, bad deployments, DDoS and expired certificates against a 24/7 platform.
5 threats 16 barriers 3 consequences safety-critical barriers marked
Use this template free. Copy “Critical service outage” into your own workspace and adapt every barrier — no credit card.
Start free with this template →Threats & preventive barriers
Each threat is a credible pathway to the top event; its barriers interrupt that pathway before control is lost.
Cloud provider zone or region failure
-
Multi-AZ redundancy with auto-failover (A.8.14) ★ critical
Passive (hardware) · 90% effective · Owner: Head of Infrastructure
-
Regional DR with tested runbooks (A.5.30)
Socio-technical · 75% effective · Owner: Head of Infrastructure
Runbooks drift from the live architecture
📅 Regional failover drill · semiannual keep-alive task
Faulty change or deployment
-
Change management with CAB (A.8.32)
Socio-technical · 72% effective · Owner: Change Manager
-
CI pipeline: tests, canary, auto-rollback (A.8.31) ★ critical
Active hardware · 85% effective · Owner: DevOps Lead
DDoS attack
-
Edge DDoS protection (A.8.20) ★ critical
Active hardware · 88% effective · Owner: Head of Infrastructure
Application-layer attacks under volumetric thresholds
-
Auto-scaling capacity headroom
Active hardware · 75% effective · Owner: Cloud Platform Lead
Expired certificate or leaked secret
-
Automated certificate lifecycle (A.8.9)
Continuous · 85% effective · Owner: DevOps Lead
📅 Certificate expiry scan · weekly keep-alive task
-
Central secrets vault with rotation (A.8.24)
Active hardware · 80% effective · Owner: Security Engineering Lead
Capacity exhaustion under growth
-
Capacity management & forecasting (A.8.6)
Socio-technical · 70% effective · Owner: Cloud Platform Lead
-
Monitoring & alerting with SLOs (A.8.16)
Continuous · 82% effective · Owner: SRE Lead
Consequences & recovery barriers
Once the top event happens, recovery barriers limit each consequence.
SLA breaches and service credits
-
Incident command & escalation process (A.5.24)
Socio-technical · 80% effective · Owner: SRE Lead
-
Public status page & customer comms
Behavioural (human) · 75% effective · Owner: Support Lead
Data loss for in-flight transactions
-
Durable queues & cross-region replication (A.8.14) ★ critical
Passive (hardware) · 85% effective · Owner: Head of Infrastructure
-
Point-in-time recovery backups (A.8.13)
Passive (hardware) · 88% effective · Owner: Backup Administrator
📅 PITR restore validation · quarterly keep-alive task
Customer churn after repeat outages
-
Blameless post-incident reviews (A.5.27)
Socio-technical · 78% effective · Owner: SRE Lead
-
Problem management of repeat causes (A.5.27)
Socio-technical · 70% effective · Owner: Engineering Director
Copying this template gives you a fully editable bowtie: barrier owners arrive as role suggestions, escalation factors sit on their barriers, and keep-alive activities are scheduled from the moment you copy. New to the notation? Read what the bowtie method is or browse the practical guides.
Use this template free. Copy “Critical service outage” into your own workspace and adapt every barrier — no credit card.
Start free with this template →