A Holistic Approach: Integrating Operational Resilience 

Operational resilience refers to an organization's ability to anticipate, prepare for, respond to, and adapt to sudden disruptions and changing environments. It enables organizations to not only survive but also to thrive in the aftermath. By embedding resilience into their operations, organizations protect their reputation and maintain stakeholder trust. 

Therefore, operational resilience requires a holistic approach that integrates business resilience, technology resilience, and cyber resilience to ensure that all aspects of the organization are aligned. This, however, presents a challenge in many organizations, as these resilience capabilities often follow a siloed approach from a governance perspective and leadership structure. 

Phases of Recovery: From Disruption to Normalcy 

Significant disruptions, such as cyber attacks or severe supply chain disruptions, can immediately disable an entire organization. Prioritization during these events is essential, as the recovery to business as usual could take months—a timeframe that organizations cannot afford if they are to survive. 

Therefore, it is key that an organization determines its essential “life support” system—the minimum elements needed to survive a disruption. A robust resiliency and recovery program would then use the period following the disruption to help the organization progress through phases of "crawling," "standing," "walking," and "running," to achieve normal business operations. 

During the "crawl" phase, the organization dedicates significant efforts towards business resilience, inventing and implementing temporary, often manual and very inefficient, solutions (workarounds) to maintain minimal operations. As the organization transitions to the "stand" phase, it begins to build in more efficiencies, improving functionality compared to the crawl phase but still operating far from normalcy. In the "walk" phase, the organization starts to replicate and isolate affected systems, enabling limited operational capacity within siloed environments that are typically not connected to other systems. This gradual scaling of operations continues to increase efficiency as the organization progresses towards the "run" phase, although full integration of systems might not yet be achieved. Ultimately, the goal is to reach the "business as usual" phase, where the organization returns to its pre-disrupted operational state, or even better, with fully integrated and more secure technology systems and robust business processes. 

Focus on the Core: Why the Concept of the Minimum Viable Organization is Key on the Core: Why the Concept of the Minimum Viable Organization is Key 

At the heart of an effective operational resilience strategy is the concept of the Minimal Viable Organization (MVO). The concept involves identifying the core business services, functions and processes that are essential to keep the organization running during a disruption, thereby ensuring its survival.

By concentrating on these essential areas, organizations can allocate their resources efficiently to prioritize restoring and safeguarding the foundational IT infrastructure (foundation). This is necessary to ensure the operational minimum (core) is maintained, thereby preserving continuity and mitigating the impact of any crisis. 

It is important to note that not every crisis necessitates the recovery of the foundation, as this mainly applies to disruptive events affecting the technology environment (such as cyber attacks, IT failures, or natural disasters). 

Starting the Journey: Defining the Minimum Viable Organization 

To begin defining the MVO, the following initial activities are essential: 

Involving stakeholders from different departments, including operations, IT, cyber, and risk management, is crucial to ensure a holistic understanding of the landscape and the core dependencies. This collaborative effort ensures that all perspectives are considered, leading to a more accurate identification of the essential elements that comprise the MVO. 

Conclusion: Building a Resilient Future

As organizations continue to evolve and adapt to the dynamic threat environment, operational resilience should be a critical component of their strategic planning. By integrating business, technology, and cyber resilience into a cohesive framework, organizations can ensure that they are prepared for and capable of recovering from any disruption. The concept of the Minimum Viable Organization is central to this strategy, enabling organizations to focus on core functions and maintain continuity even in the face of severe crises.

Sources:  

Markham, I. (2025, May 6). From cyber event to business as usual: First steps may not be what you expect. Wall Street Journal. Retrieved from https://deloitte.wsj.com/riskandcompliance/from-cyber-event-to-business-as-usual-first-steps-may-not-be-what-you-expect-3e930229