Cyber Resilience Is A Business Operating Model, Not An IT Recovery Plan

Michael Campbell, CEO at Fusion Risk Management.

gettyWhether a cyberattack or other disruption, such as a supplier factory fire or any number of other kinds of events, originates within your enterprise or your partner ecosystem, its impact can spread rapidly. A single incident can expose hidden dependencies, disrupt critical services and force leaders to make high-stakes decisions in real time.

• An attack on a medical device company’s Microsoft platform brings operations to a standstill.

• A data breach prompts an edtech business to take its portal out of service, leaving 15,000 schools unable to handle assignments, courses and tests.

• Cyberattacks take out a service on which thousands of car dealerships rely, stalling their businesses and exposing confidential customer information.

• The Korean Leaks exploit allowed access to multiple financial services companies through a managed service provider, creating havoc.

And now, enterprise adoption of AI has the potential to dramatically increase the frequency and scale of cyberattacks, while AI model drift and explainability gaps further expand enterprise risk.

A growing number of organizations are taking a broader view beyond only threat monitoring, narrow testing and recovery plans by considering everything that can create vulnerabilities and shifting the focus from recovering IT systems to minimizing business loss.

Meanwhile, enterprises are pushing CISOs to take on responsibility for business continuity management and disaster recovery. But a Gartner analyst cautions that CISOs with this new remit “should lead through influence” and “center on cyber resilience, reset board expectations, and coordinate with the CIO, CRO and CDAO to scale sustainably.”

Despite emerging organizational mandates, shifting roles and good analyst advice, organizations lack living models of their critical business services and dependencies that create vulnerabilities. They still need visibility into how those risks could impact their finances and long-term success. And although they may have plans on paper, most haven’t established the operating capabilities they need to build true enterprise resilience and protect their businesses.​

CISOs should convene the leaders who own security, IT disaster recovery, business continuity, operations, finance and the affected business services. Together, they should document who can authorize recovery, set service priorities, accept temporary workarounds and escalate conflicts. A short decision-rights matrix is more useful than a broad mandate because it tells teams who decides when recovery conditions change.

CEOs and boards should assign one executive sponsor for cross-functional recovery governance, require regular reviews of the organization’s most critical services and dependencies, and ask leaders to test plausible but severe disruption scenarios specific to their business. Their role isn’t to direct technical recovery. It’s to ensure the enterprise has the authority, investment and accountability to make trade-offs when normal operations can’t immediately resume.

This executive-level ownership is critical. Many of the preparations made today are still highly siloed. The need to get them to work together prior to a crisis is a big surprise to many. It needs to be tackled up front.

For each critical service, identify its dependencies, tolerance for disruption and the minimum conditions for safe recovery. Use a tabletop exercise to test whether leaders have the information and authority to set recovery priorities as conditions change. Gaps in the exercise reveal the information, governance or plans that need work before a real event.

Cyberattacks and AI-related risks get a lot of attention, but even a relatively unremarkable incident can have notable downstream consequences. Here’s an example: Two manufacturers relied on the same supplier, whose factory caught fire.

One had already mapped its supply chain dependencies. Within days, it identified an alternate source, re-sequenced its production lines and contained what could have been a $250 million revenue hit to $15 million.

The other was still working out which products touched that supplier a month later. By the time it found an alternative, the damage led to significant lost revenue and customer defections so severe the company was eventually acquired.

Both organizations had the same supplier exposure. Their outcomes reflected the decision model each had established before the fire.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?