IT Resilience: What (and Why) Boards Need to Know About It

Contemporary businesses are highly dependent on technology for daily operations – keeping your company’s technology services ticking over smoothly is essential.

There are plenty of established tools that make that happen – think about disaster recovery and IT continuity, for example. Both are key practical methods that have been around for some time. However, disaster recovery and continuity evolved into something more advanced: IT resilience.

This article outlines what’s different about IT resilience and why it requires action at the board level.

The Roots of IT Resilience Management

To understand IT resilience, it’s worth reviewing a definition of the concepts that preceded it—namely, disaster recovery and continuity management.

• Disaster recovery planning. Businesses are vulnerable to mishaps – natural disasters, a cyberattack, or just technology going wrong. Planning for the worst facilitates a smooth recovery. It means resuming operations as fast as possible to limit the impact on the bottom line. That is the purpose of disaster recovery planning: facilitating a return to normal after an adverse event.
• IT continuity management. What if, instead of picking up the pieces, there are compensating measures? A regime that ensures that a business continues to operate without interruption even in the midst of a disaster? IT (or business) continuity management identifies potential threats, vulnerabilities, and risks. Continuity planning then puts in place steps to ensure that business operations continue with as little interruption as possible.
  For more on how to craft this plan, read our guide on making a business continuity plan.

Clearly, IT continuity management is a step forward from planning for rapid recovery from disaster. The difference lies in the level of preparedness and, of course, in improved outcomes.

IT resilience continues this theme.

IT Resilience Versus Business Continuity

At first glance, IT resilience – and indeed business resilience – may appear similar to IT and business continuity, but there are essential differences. Put in simple terms, continuity implies that operations carry on. There is no full stop, no disastrous break in the business. However, continuity does not mean that business stays the same or that it thrives. Instead, continuity means that business continues to function at some acceptable level.

Now, adverse events will always have an impact on business operations. And most likely a negative impact. However, a resilient business is a business that experiences minimal impact. It goes further by ensuring that the business is resilient against disaster and market changes, and competition.

So What is IT Resilience?

We could say that IT resilience adds to disaster recovery and continuity in three key ways:

• Resilience is overarching. Rather than focus merely on specific operational concerns or indeed just fixing a leaking roof, resilience takes a broader approach. IT resilience considers the overall organization and the context in which it operates too.
• Resilience focuses on prevention. Both disaster recovery and business continuity are frameworks that kick into place when a problem arises. However, IT resiliency emphasizes problem prevention – ensuring that nothing goes wrong in the first place.
• Resilience is about excellence. IT resilience goes beyond fixing and foreseeing technology problems – whether present or future. Resilience emphasizes top performance through thick and thin. It mandates day-to-day value add, improvement, and growth – no matter the environment.

In short, IT resilience is about the strategic positioning of your company and ensuring that your company can make the best of whatever circumstances, competitors, or the broader market throws at it. And yes, it also deals with the nitty-gritty. For example, business continuity and disaster recoveries are part and parcel of an overarching IT resilience program.

How to Establish IT Resilience

A full description of IT resilience strategies is beyond the scope of this article. Besides, each organization will have a unique IT resiliency program dependent on specific operational and environmental factors. However, we can suggest that such a program should include five key tenets:

1. Preparation and discovery aim to understand the operational environment, what technology tools a company is most reliant on, and where the real risks lie.
2. A strategy for endurance to reduce the odds that tough, adverse, unpredictable circumstances cause a major hiccup in business operations – or the bottom line.
3. Planning for response and recovery if a catastrophic event pushes your business operations above and beyond what it can realistically endure.
4. Looking for opportunities through resilience so that your organization can take advantage of difficult circumstances and market changes to move ahead of its competitors.
5. Taking a holistic approach by looking beyond technology systems and everyday operations to consider business reputation, growth opportunities, and risks to competitors.

The tools and measures that enable IT resilience can include the practical – adequate technology redundancy. IT resilience also requires strategy, such as the ability to adapt operations if needed rapidly. However, IT resiliency is not just about putting in place set-and-forget measures – it is an ongoing process that requires involvement at the most senior level.

Why IT Resilience Planning is a Board Matter

Boards typically don’t get too deeply involved in the day to day of disaster recovery or business continuity planning, aside from ensuring that these processes are in place in the first place. However, the overarching nature of resiliency implies board involvement at a much deeper level.

The leadership present on boards has broad and deep insights into the companies’ environment, operations, and strategic objectives. As a result, IT resilience addresses bigger issues than business continuity – board-level issues. It involves managing risk across the organization while accounting for the broader environment. That, after all, is a key board competency.

Boards should, therefore, be actively involved in working towards IT resilience to make sure that organizations are resilient against adverse events, uncertainty, and change. And, importantly, the organization that they govern is positioned to take advantage of shifting markets and emerge as a winner even under difficult circumstances.