Preparedness: defined by capability, not plans alone

Geopolitical uncertainty, cyber threats, supply-chain dependencies and a changing security environment are challenging the assumptions on which organisations have traditionally built their resilience.

In a grey-zone situation or other severe disruption, organisations may face several challenges simultaneously: cyber-attacks targeting critical systems, disrupted supply chains, physical sabotage, communication outages, reduced workforce availability and interruptions to critical third-party services.

Many organisations already have established frameworks for risk management, business continuity, crisis management and cyber resilience. They may also have well-developed plans for how to respond when disruption occurs. But preparedness requires organisations to think beyond the expected scenario: what happens if critical people, technology, suppliers or infrastructure are unavailable, and what alternative ways of maintaining critical operations are available?

Severe disruption can put several capabilities under pressure simultaneously, requiring organisations to prioritise, adapt and maintain critical operations with constrained resources and under conditions that existing plans may not fully anticipate. This means having credible fallback options, understanding when to activate them and ensuring that decision-makers can adapt as conditions change.

“The real test of preparedness is not simply whether plans and frameworks exist, but whether the organisation has considered credible alternatives, tested its assumptions and has the capability to prioritise and adapt when disruption does not unfold as expected.”– Sofie Cederquist, Internal Audit

Resilient organisations strengthen resilient societies

This year’s Swedish Preparedness Week continues the theme “You are part of Sweden’s Total Defence,” reinforcing the role that organisations and individuals play in strengthening Sweden’s collective preparedness.

The principle extends beyond public authorities and organisations traditionally considered critical infrastructure. A resilient society also depends on businesses being able to continue providing essential services, maintain supply chains, enable payments and financial services, support customers and employees, and contribute to a functioning economy. Preparedness is therefore both an organisational and a societal question.

For management and boards, this raises some fundamental questions:

• What must continue? Which services, processes and capabilities are critical?
• What do we depend on? Which people, technologies, suppliers and infrastructure are essential?
• Where are we most vulnerable? Which dependencies could prevent critical operations from continuing?
• What are our alternatives? How would we maintain critical operations if key people, systems, suppliers or infrastructure became unavailable?
• Can we make decisions under pressure? Are responsibilities, priorities and mandates sufficiently clear?
• Have we tested our assumptions? Have our plans, fallback arrangements and decision-making been exercised against severe but plausible scenarios?

Prioritising what matters most

Severe disruption may require organisations to operate with fewer people, reduced access to technology, disrupted suppliers or other constrained resources while at the same time facing new or changing demands.

Preparedness is therefore not about protecting everything equally. It requires a clear understanding of which operations and services must be maintained, what they depend on and where disruption would have the greatest consequences.

This allows management to make informed, risk-based decisions about what to prioritise, where additional capability is needed and which vulnerabilities should be addressed first.

Prioritisation also needs to translate into workable alternatives. If a critical system is unavailable, a key supplier fails or normal staffing levels cannot be maintained, organisations need to understand how critical operations can continue, how long alternative arrangements can be sustained and what trade-offs may be required.

For organisations with a role in critical societal functions, these decisions extend beyond their own operations. Maintaining essential services, financial flows, infrastructure and critical supply chains contributes to the resilience of the wider economy and society.

Resilience needs to work in practice

Expectations on organisational preparedness are also evolving. In Sweden, the forthcoming SS 22306 standard illustrates this direction. It is being developed to provide a structured approach for organisations to maintain critical operations during threat of war and war, prioritise activities when resources are constrained, respond to new operational demands, manage disruption and recovery, and strengthen long-term organisational resilience.

The standard is intended to complement established frameworks for risk management, business continuity, crisis and incident management, information security and cyber security, rather than replace them.

While SS 22306 is Swedish, the underlying challenge is broader. Across Europe, organisations face increasing expectations around operational resilience, cyber security, continuity, critical infrastructure and preparedness.

The objective should therefore not be another isolated framework. It should be to build resilience into existing governance, risk management, cyber security, third-party oversight, business continuity and crisis management before disruption occurs.

Plans and alternative arrangements also need to work in practice. Scenario-based exercises can test whether assumptions hold, responsibilities and decision-making are clear, and alternative ways of operating can be activated when normal arrangements are no longer available. They can expose dependencies, resource conflicts and unrealistic assumptions that documentation alone may not reveal.

Demonstrating readiness

Building preparedness means strengthening the capabilities an organisation needs to anticipate, withstand, adapt to and recover from severe disruption.

Readiness is the practical test: if disruption occurred tomorrow, would the organisation be able to maintain the operations that matter most – including when the expected course of action is no longer viable?

For management and boards, the challenge is therefore to move from understanding critical operations and dependencies to determining whether plans, alternative arrangements and decision-making capabilities will work in practice. This requires identifying gaps, setting clear priorities and exercising severe but plausible scenarios before those capabilities are needed.

A structured readiness assessment can help establish that baseline, identifying critical operations and dependencies, assessing vulnerabilities and existing capabilities, reviewing whether plans and fallback arrangements are sufficient and have been tested, and translating the findings into clear priorities for action.

At Advisense, we combine expertise across governance, risk, cyber resilience, third-party and supply-chain risk, business continuity, crisis and incident management and independent assurance to help organisations assess, strengthen and test their preparedness. We help clients understand what must continue, identify critical internal and external dependencies and vulnerabilities, assess whether credible alternatives exist, and strengthen the capabilities required to operate under adverse conditions.

If you are uncertain where your organisation stands today, a Readiness Assessment can provide a clear baseline for deciding what to prioritise, strengthen and test next.

Assess your organisation’s readiness

A Readiness Assessment provides a structured view of critical operations, dependencies, fallback arrangements and capability gaps  and clear priorities for what to strengthen and test next.