Resilience “moving upstream” into strategy and business models

Taking part in the discussion were Steve Hill (strategic advisor at PwC UK), Anne Leslie (head of cloud risk for the EMEA region at IBM), Chris Medhurst-Cocksworth (head of Pool Re Solutions within the Pool Re organisation), Arthur Rabjohn (senior Group business resilience manager for Tesco) and Jari Stenius (vice-president of corporate safety and security at Fortum).

Businesses are currently operating in an environment affected by geopolitical tension, which is driving cyber threats, supply chain disruption, misinformation, insider threats and the potential for jurisdictional-imposed constraints on access to services. As such, operational sovereignty is an important strategic consideration.

Operational sovereignty means that organisations can continue operating at the very least to a minimum level when there’s disruption to critical dependencies caused by hostile acts or jurisdictional constraints. These may include restrictions on access to technology, cloud or Artificial Intelligence services, the deliberate disruption of supply chains or cyber and physical attacks affecting energy, digital and telecommunications infrastructure.

A key point raised during the discussion was that professionals need to adopt a more architectural and engineering-based approach to resilience. Having a clear picture of critical dependencies, being able to assess their vulnerability to nation-state actions, informing strategic choices and creating optionality are becoming essential capabilities.

In practice, this means designing resilience into systems and operating models through diversification, redundancy, offline capabilities, local control where appropriate and tested contingency plans.

Hybrid threats

The discussion served to highlight how hybrid threats are no longer solely a Government concern. Businesses of every size are now part of the front line, with cyber, supply chain, information and infrastructure risks becoming increasingly interconnected.

As a direct result, resilience can no longer be viewed simply as a matter of protection and recovery. It’s becoming a core strategic capability that helps to preserve operational freedom when disruption occurs.

Actions organisations can take to strengthen operational sovereignty include:

*identifying critical business services and the minimum requirements needed to sustain operating capability and establishing the organisation’s Minimum Viable Company and Minimum Viable Services

*understanding the dependencies that support those services

*assessing vulnerabilities to geopolitical, cyber, supply chain and technology-related disruption

*creating optionality and alternative pathways where critical dependencies exist

*developing Board-level understanding of resilience o that the focus extends beyond recovery and continuity planning to strategic choices, critical dependencies, operational sovereignty and long-term organisational viability

Emerging area

The growing adoption of AI across business operations was also identified as an emerging area of focus. As AI becomes embedded within organisations, it introduces new dependencies, vulnerabilities and geopolitical considerations alongside more traditional cyber security challenges. Understanding these dependencies and the risks they create will become increasingly important as organisations seek to maintain operational sovereignty.

Another challenge highlighted was visibility across supply chains. While many organisations have a reasonable understanding of their direct suppliers, insight into Tier 2 and Tier 3 dependencies often remains limited, creating hidden vulnerabilities that may only become apparent during disruption.

Businesses cannot rely on Government intervention alone. They’re responsible for building their own resilience to these threats. Equally, fostering cross-sector co-operation and nurturing trusted relationships is essential.

Above all, national resilience depends on everyone playing their part. Close collaboration between businesses, Government and critical infrastructure operators helps to build an understanding of their interdependencies and enables them to share insights, in turn strengthening collective resilience.

Resilience First concluded: “As we’ve written previously, we need to change both the language and the thinking around resilience. It must be a strategic imperative for organisations in what is now a world of persistent and increasingly significant disruption.”

*Further information is available online at www.resiliencefirst.org