Executing your business resilience agenda

Treating resilience as a strategic priority changes how it must be organised. It can no longer be built through isolated, one‑off initiatives. Instead, it depends on coordinated initiatives across operational areas and requires strategic commitment from the executive team, with senior leaders actively championing and anchoring resilience efforts across the organisation.

A resilience programme consists of four phases

To succeed with this shift, organisations need a structured, programme‑based approach that turns ambition into coordinated action across functions and geographies. A resilience programme provides the governance and execution discipline required to close gaps systematically and build resilience that lasts.

The four phases of a resilience programme:

1. Current state & ambition: Establish a clear resilience ambition grounded in your organisation’s risk appetite and form a credible ‘to be’ state that guides your efforts. Ensure that you have made some strategic choices about your scope and ambition that can guide prioritisation.

Tip: Identify and assess which assets and/or services are most critical. This will guide your efforts in balancing compliance requirements with a fit-for-business desired resilience level to further support operational risk reduction.

2. Gap assessment: Translate ambition into actionable gap insights by comparing your current state resilience level against regulations, your desired state resilience, and aligning this to your risk appetite to prioritise where action is required.

Tip: Based on our experience, key stakeholders are best positioned to provide informed assessments within their domains. Avoid extensive upfront legislative mapping but integrate requirements mapping into implementation to shorten the time from analysis to execution.

3. Remediation development & implementation: Mobilise remediation initiatives across functions and countries, backed by strong governance and cross-functional transparency.

Tip: Ensure roles and responsibilities between the programme and remediation initiatives are crystal clear. Spend sufficient time scoping each initiative, including dependencies within the programme and across other business initiatives.

4. Post-programme governance & monitoring: Make resilience stick by creating lasting ownership, monitoring performance, and integrating resilience into operations and decision-making.

Tip: For most companies, legislative requirements and geopolitical uncertainty mean setting up resilience and security governance structures that are not in place today. The governance design should cater for the degree of centralisation/decentralisation that fits your business needs and current structure. No matter the model, it should provide structure, enable monitoring and standardisation, and ensure that accountability lies with the areas of the business that are accountable when a situation occurs.

The first two phases require a strong core programme team to set the ambition, design the approach, and secure buy-in. In phase three, the programme becomes a portfolio of initiatives across the organisation to close the gaps and reach the desired resilience level. In phase four, development and implementation are complete, and new processes and procedures are operational across the organisation. Across all four phases, success depends on the right governance model, clear accountability, and transparent reporting to maintain alignment with the resilience ambition.

Unfolding our resilience programme approach

Our experience with setting up, and running, resilience programmes across industries shows that success is enabled by three equally important dimensions:

1. Steering the transformation

Resilience programmes require clear ambition, explicit priorities, and well‑structured scope grounded in the risk appetite. This breaks down complexity and ensures that the benefit owners, those ultimately accountable for the solution, are empowered to make the right decisions from the outset.

Tip: Your steering committee should be comprised of executives that are the ultimate benefit owners of the programme. This may not be the same executives accountable for developing the solutions to close the resilience gap.

2. Directing execution

As resilience efforts move from analysis into remediation, complexity grows. A single integrated overview of progress, risks, and dependencies is essential to create transparency, reduce fragmentation, and enable leaders to make informed trade-offs while staying anchored in the original resilience ambition.

Tip: Consider setting up a reporting tool so leaders can track portfolio‑wide progress, risks, and mitigations. This enables a transparent overview which is particularly important in the third phase.

3. Engaging the organisation to change

Embedding resilience demands more than communication. It requires new roles, shifted accountabilities, and leadership behaviours so the resilience way of working becomes part of everyday operations. This is what makes resilience ‘stick’ long after the programme ends.

Tip: In phases 1 and 2, focus on broad communication about resilience, the programme ambition, and the approach. Use a company‑wide internal site to share materials. Pair this with sharp stakeholder management of the vital stakeholders to build engagement and buy‑in. Because CER and NIS2 require training and awareness, plan to deliver these early. In phase 3, as more of the organisation gets involved, include training on new processes and procedures in the plan. In phase 4, continue this training and awareness as the programme transitions to operations.

Building business resilience is everyone’s job

Resilience is no longer owned by a single function; it depends on coordinated action across teams and leadership levels. As one business leader put it, “This is only the first step. In today’s world, resilience and security can’t be treated as a one‑off programme. Increased resilience means it becomes part of everyone’s job.” This statement highlights that lasting resilience requires a cultural shift, continuous capability building, and clear alignment between benefit owners, business units, and governance structures. To deliver on this agenda, organisations need a structured approach to closing the gap between their current and target resilience states, translating ambition into effective execution.