A resilient company does not duplicate everything. It knows what cannot fail, how long it can operate without it, and what it will do next.
Start with the service you must keep delivering
“We need more resilience” is a reasonable ambition and a poor spending brief. Without a defined problem, a business can accumulate extra software, unused suppliers, and complicated procedures without becoming more capable under pressure.
Begin with a customer outcome. What must the company continue to do during a disruption? Which activities can pause for a day, and which create serious consequences if they stop for an hour?
The answer should come from the people responsible for customers, operations, technology, and finances together. A system may be technically important without being the first thing the business needs to restore.
Find the hidden single points of failure
Map the dependencies behind each critical outcome. Include people, credentials, data, premises, suppliers, and decisions. A backup platform is of limited use if only one unavailable person knows how to access it.
For each dependency, record four things: the owner, the tolerable interruption, the workaround, and the evidence that the workaround works. Treat “we could probably do it manually” as an untested assumption.
NIST’s small-business guidance recommends preparing response and recovery plans, maintaining and testing backups, and learning from incidents (NIST). The broader operating lesson is to distinguish having an alternative from being able to use it.
Pay for the resilience you need
Not every risk justifies a fully duplicated operation. A business might choose a tested manual process for one service, a second supplier for another, and a clear customer communication plan where immediate continuity is not feasible.
Evaluate the alternatives against an explicit scenario. How much time would the fallback buy? What errors would become more likely? Who would approve using it? When would the company stop taking new commitments?
This makes the investment decision more honest. The choice is not between perfect resilience and negligence. It is between different levels of exposure, cost, and recovery capability.
Practise while the stakes are low
Run a short exercise around one realistic disruption. Remove a key person from the scenario, make a supplier unavailable, or assume a critical system cannot be used. Ask the team to work through the first hour and the first day.
Record where the exercise stalls. Missing contact details, unclear authority, and inaccessible documentation are useful findings precisely because they can be corrected before a real incident.
After the exercise, make a small number of specific changes and test them. A long action list that no one owns creates less confidence than a few completed improvements.
Resilience should give a business more freedom to act, not trap it behind expensive layers of precaution. The most useful starting point is simple: choose one essential customer promise and prove that the company has a workable plan for keeping it, or communicating clearly when it cannot.