What Is Operational Resilience?
The Importance of Operational Resilience
Disruption is inevitable in today’s business landscape. Between increasingly sophisticated threat actors, geopolitical instability, and a hyperconnected digital ecosystem, it’s not a question of if you’ll have to deal with a critical incident but a matter of when. How effectively you can predict and mitigate these incidents is often the difference between weathering the storm and suffering a devastating loss.
In addition to impacting your bottom line, failure to remain operational during a crisis can damage your reputation and your relationship with vendors and customers—in certain sectors, it may even be grounds for regulatory penalties.
Key Components of Operational Resilience
People
Ensure your organizational culture is resilience-focused, with a transparent chain of command during disruptive events and regular training. Ensure your people understand that everyone has a vital role in keeping critical business processes operational.
Processes
Establish clearly defined incident response plans alongside mechanisms for governance and accountability. This also means having a plan for communicating with staff and stakeholders during an incident—one which doesn’t rely on infrastructure that may be disrupted.
Technology
Maintain complete visibility into your organization’s entire ecosystem, including partners and suppliers. Proactive risk and threat management are essential, as is using the right cybersecurity tools and solutions.
Finances
Does your organization have the necessary operating capital to employ operational resilience effectively? Do you have measures to protect your bottom line, such as cyber risk insurance?
Regulatory Compliance
Are there any regulatory requirements around operational resilience within your industry? If so, ensure you know them inside and out and understand how to adhere to them.
Organizational Structure
Break down communication silos between departments and encourage collaboration between teams. A business where all departments work in isolation is not resilient.
Stages of Operational Resilience
Anticipate
What systems and assets are mission-critical for your organization, and what risks and threats will those likely face? Are there any vulnerabilities that need to be addressed? What is the worst-case scenario, and what can you do to address it?
Strategize
The old saying that an ounce of prevention is worth a pound of treatment very much applies to operational resilience. For every identified risk and threat, you should have a mitigation strategy that defines the most effective way for your business to survive unscathed.
Respond
Incident response plans are the bread-and-butter of operational resilience—but as they say, no plan survives first contact with the adversary. An effective operational resilience framework requires that you not only define your incident response process but also regularly practice, schedule, and test it.
Recover
Alongside incident response, business continuity and disaster recovery are both pillars of operational resilience. What preventative strategies can you use to keep the lights on during a crisis, and do you have a plan if those strategies fail?
Adapt
Operational resilience isn’t just about planning. It’s also about agility—your organization’s capacity to adjust quickly to rapidly changing circumstances. If a preventative strategy fails or your team encounters an incident they never planned for, they must adapt their approach.
Make sure they know how.
Assess
Operational resilience is not a singular project or initiative. It’s an ongoing process requiring constant testing, evaluation, and tweaking. No matter how effective an operational resilience strategy may appear, there is always room for improvement.
Operational Resilience Goals
The primary goal of operational resilience is simple: It seeks to minimize the impact of disruptive events on a organization through a combination of planning, strategy, and technology. Said impacts could include lost customers and revenue, reputational damage, or legal challenges.
An organization that has achieved operational resilience continues to serve its customers without interruption, even during disruption.
Benefits of Operational Resilience
The benefits of operational resilience include the following:
- Increased business agility. The proactive mindset embodied by operational resilience can be incredibly valuable for identifying new business opportunities and adapting to unexpected market shifts.
- More collaboration. Because operational resilience requires all departments within your organization to work together, it lays the groundwork for a more connected, collaborative, and innovative workplace.
- Improved reputation. Operationally resilient organizations may be seen as more reliable and trustworthy than their competitors.
- Reduced risk. Because an effective operational resilience framework requires risk management, this also means that incorporating operational resilience involves reducing your exposure to and lowering the impact of potential disruptions.
How to Achieve Operational Resilience
According to a document published by the Office of the Comptroller of the Currency, best practices for operational resilience include:
Governance
- Regularly review and revise the organization’s risk appetite and risk profile
- Ensure all stakeholders directly involved in operational resilience processes have the requisite knowledge and expertise
- Delineate and define the organizational and legal structure, including core business lines and critical processes Maintain a real-time overview of these factors
- Assess operational resilience practices on an ongoing basis
- Support the organization’s governance framework with independent reviews
Risk Management
- Identify and mitigate operational risk exposures per the organization’s risk and disruption tolerance
- Regularly review, test, and update critical internal controls
- Assess internal, technology, and operational risk
- Understand, manage, mitigate, and intelligently prioritize risks from third-party vendors
- Create formal agreements to serve as the foundation of vendor relationships
Business Continuity Management
- Incorporate business impact analysis, testing, training, and awareness programs
- Establish communication and crisis management policies
- Identify critical personnel in the organization’s incident response processes, and ensure no single points of failure
- Include contingencies for remote access
- Train all essential personnel involved in incident response
General
- Take a holistic approach that examines potential threats across all departments and lines of business
- Identify and prioritize critical points of failure in your assessments
- Maintain complete visibility into your attack surface and ecosystem, and leverage insights from that visibility in your risk management
- Ensure you can detect and address suspicious activity
Operational Resilience vs. Business Continuity
Business continuity and operational resilience are often conflated, and it’s not difficult to see why. Business continuity represents a foundation of operational resilience. It involves identifying and planning for disruptive events with a primarily internal focus.
Operational resilience expands the scope of business continuity planning, focusing on external elements alongside internal ones. It focuses on taking an organization’s business continuity plans and leveraging them preventatively and proactively. Moreover, while business continuity is predicated on the likelihood of a disruptive event, operational resilience assumes the event will happen and works backward from that assumption, considering the best way to apply business continuity measures during disruptive events.
Related Resources:
Data Loss Prevention (DLP)
Endpoint Security
Endpoint Protection Platforms (EPP)
Endpoint Detection and Response (EDR)
Extended Detection and Response (XDR)
Identity and Access Management (IAM)
Managed Detection and Response
Managed XDR
MITRE ATT&CK Framework
Mobile Threat Defense (MTD)
User and Entity Behavior Analytics (UEBA)
Zero Trust Architecture
Zero Trust Network Access (ZTNA)
Zero Trust Security
Security Information and Event Management (SIEM)
Secure Access Service Edge (SASE)