When the Going Gets Tough, the Tough Get Resilient

Related on BCMMETRICS: Double Trouble: How to Handle Multiple Business Disruptions

When I first began working in business continuity 25 years ago, it was normal to suppose that events with the ability to impact an organization’s mission-critical operations would come along relatively rarely and, most likely, one at a time. 

For the past few years, such events have been happening 24/7/365.  

There’s the pandemic, the staffing shortage, the supply chain crunch, the rise in extreme weather as a result of climate change, and the increase in cyberattacks, to name the biggest threats. 

Stretched to the Breaking Point

I don’t know how it is with your organization, but a lot of the ones I work with tell me they’re stretched to the breaking point. They’ve done everything they can in terms of securing their supply chains and mitigating the loss of human resources, but they’re still scrambling to obtain the goods and services they need to keep production going, transport their products, or deliver good customer service.  

Many organizations are using their business continuity plans every day as a matter of routine. Measures that were conceived as emergency steps are now being used day in and day out. 

The situation is driving changes all the way down. It’s altering how companies manage their day-to-day operations and shrinking safety stocks. It’s impacting customer service, operating efficiencies, and the bottom line. It’s also putting immense stress on our people. 

Pressure Makes Diamonds

The news isn’t all bad. It takes pressure to create diamonds and something like that might be going on here. 

One thing I’ve noticed is that workers in every industry have been coming up with amazing solutions and workarounds to the challenges they have been facing. I’ve seen people figure out how to keep production going at a high level with a skeleton crew and manage for weeks without technology systems they formerly believed themselves dependent on.  

A lot of the solutions people have implemented have the potential to be of lasting value even if or when the current crises ease up. These innovations should be documented with an eye toward keeping the best of them even when they are no longer necessary as workarounds. 

I’ve also noticed an increasing openness toward a certain tough reality: it’s no longer enough to think in terms of having a business continuity plan; organizations need to commit to the more ambitious (and expensive) goal of becoming truly resilient. 

Successfully navigating the current environment requires nothing less. 

Business Continuity vs. Resilience

Business continuity in its classic form is about having a plan to recover the business in the event of a disruption. The mantra is: respond, restore, and resume. This was enough when disruptions were relatively few and far between. It’s insufficient when disruptions are ongoing and simultaneous.  

Resiliency is a more robust and proactive posture. It’s more expensive but the current conditions necessitate it. Our collective neighborhood is becoming more dangerous. No one is saying it’s pleasant to spend more on protecting your operations. We’re just saying it’s advisable given the current state of the world.  

I think that moving forward, the organizations that will win will be those that implement resiliency across the four levels of people, processes, technology, and facilities. 

Learning From the Terminator

The best illustration of resiliency I know is the villain in the movie Terminator 2. He takes hit after hit but is able to heal and keep pursuing his objective. As Arnold Schwarzenegger found out, it’s very bad when your opponent has this quality. It’s excellent when your organization has it. 

A resilient organization can take hits and keep going, even if it’s at a degraded level. 

Being resilient requires new strategies and capabilities. It requires having sufficient and tested personnel resilience, physical resilience, telecom resilience, data and cyber resilience, and a resilient supply chain. 

Welcome to the Fusion Center

I’ll get into the specifics of building a resilient organization another time. However, I would like to mention one point now: every resilient organization I know of has some version of a fusion center.  

Currently, at most organizations, the information, and functions pertaining to managing events is divided among many departments, such as security, IT, operations, and so on. In a fusion center, all of this is brought together in one place. Consolidating intelligence enables a more complete and accurate view of what’s going on. Coordinating the response permits a more effective, unified effort.  

I encourage any organization that is ready to start adapting to the new reality to look into setting up a fusion center.

Becoming More Resilient

Our current situation of nonstop crises has pushed many organizations to the brink. When the going gets tough, the tough need to get resilient.  

In the current environment, it’s not enough to have a business continuity plan that focuses on restoration and recovery. Companies need to be able to take hits and keep on going, even at a reduced level of performance. A good place to start in developing this capability is by setting up a fusion center.