 | If a cyber incident made a critical application unavailable tomorrow, how would your organisation continue delivering the service that depends on it? Which activities could continue? |
In our first blog article, we explored how NIS2 brings cybersecurity into the boardroom and why leaders need to prepare for difficult decisions. Those decisions become concrete when an incident interrupts operations. Management must decide what to maintain, what to suspend and what to restore first. Preparing those choices before an incident is an essential part of operational resilience.
One lesson from our NIS2 assessment work is that technical recovery and business recovery need a much closer connection.
In an assessment involving a public-sector organisation, technical security and recovery responsibilities were largely carried by a central IT function and external providers. Business teams understood the services they delivered and the consequences of losing access to their applications. However, agreed recovery priorities, acceptable interruption periods and arrangements for continuing essential activities were not consistently defined.
This raised a practical question: if several services became unavailable at the same time, how would the technical teams know which business service needed to resume first? The answer required input from the people responsible for delivering those services, alongside an understanding of what IT and providers could realistically restore.
That is where operational resilience gives the conversation a clearer purpose. Resilience connects the impact of service disruption, the level of disruption an organisation can tolerate and the dependencies needed to deliver its services. This means examining the full chain of people, processes, information, technology and providers that keeps an activity running.
Consider a service that processes applications for financial support. Restoring its main application is one part of recovery. Staff may also need access to supporting documents, identity services, external data and payment systems. If one dependency remains unavailable, the application could be running while the service remains interrupted. A temporary manual process may help, but only if staff can access the necessary information, understand their responsibilities and handle the workload.
Our experience shows why assessment discussions need to reach these business questions. Asking whether backups exist establishes a technical capability. Asking how long a service can remain unavailable establishes a business need. Bringing those answers together helps reveal whether the recovery arrangements match the consequences of an interruption.
The same applies to responsibilities. A provider may restore the platform, but the business must confirm that records are usable, pending work can be processed and service delivery can resume. Agreeing who makes that decision avoids leaving it unresolved until teams are already under pressure.
NIS2 can turn these questions into a practical improvement agenda. Its requirements cover incident handling, business continuity, backup management, disaster recovery, crisis management and supply-chain security. Connecting these measures around an essential service gives them a shared objective: limiting the consequences of disruption for the organisation and the people who depend on it.
A useful starting point is to select one critical service. Bring its business owner, IT team and key providers together. Agree what must continue, how long an interruption can be tolerated and which dependencies could prevent recovery. Then exercise a scenario in which the main application is unavailable. Can staff use the proposed alternative? Can the provider meet the recovery needs? Who authorises the return to normal operations?
These exercises provide evidence for management decisions. They show where investment is needed, where responsibilities need clarification and where existing plans need revision.
The lesson we take from this work is that operational resilience develops when business needs shape recovery preparations. NIS2 assessments can make the gaps visible. The next step is to turn those findings into agreed priorities, workable alternatives and rehearsed decisions so that, when disruption occurs, the organisation has prepared how it will continue serving the people who rely on it.