THE CEO VIEW | By David Harris, CEO, HAWK Network Defense
A business can restore its systems and still discover that its most important choices have disappeared.
The customer has moved on. A supplier has committed its remaining capacity elsewhere. The only person authorized to approve an alternative cannot be reached. Recovery eventually succeeds, but leadership spends the disruption accepting consequences it had no practical way to influence.
That is why I think resilience deserves a broader executive test: when conditions change, what can we still choose to do?
Recovery remains essential. Preserving options adds another responsibility. It asks whether the business can continue serving its priorities through more than one credible path, and whether someone has the authority to select that path while it still matters.
Start with the commitment you need to preserve
A resilience discussion should begin with a business commitment, such as fulfilling essential orders or maintaining access to a critical customer service. Starting with a list of systems can obscure the outcome those systems support.
For each commitment, I would ask management to describe what minimum acceptable service looks like during disruption. Which customers receive priority? How long can reduced operations continue? What obligations cannot be deferred? These are business judgments that technology teams should help make executable.
NIST's cyber resilience guidance describes capabilities to anticipate, withstand, recover from and adapt to adverse conditions.[1] My executive interpretation is that adaptation requires alternatives leadership can actually use, rather than alternatives that exist only in a presentation.
The objective is not to preserve every activity at full performance. It is to preserve enough freedom to protect the commitments that matter most.
Establish the business impact before choosing the fallback
I would have each business owner describe the consequences of losing the commitment over time. An interruption may initially create a manageable queue, then prevent a customer from meeting an important deadline. That progression should influence how much flexibility we buy and how quickly someone must activate it.
NIST IR 8286D connects business impact analysis with mission objectives, critical assets and enterprise risk direction.[3] My recommendation is to use that analysis to distinguish the service we need to preserve from the particular technology currently delivering it. Otherwise, we may fund a technically complete recovery while overlooking an essential business dependency.
The review should include the assumptions behind the impact. A reduced service might be acceptable during an ordinary period and inadequate during a contractual delivery window. Finance, customer operations and technology should examine the same scenario, rather than submit unrelated estimates. Where we cannot estimate an impact reliably, I would identify the uncertainty and the decision it could change. A documented unknown is something management can investigate; an invisible assumption cannot be challenged.
An alternative must survive the same disruption
Consider a hypothetical organization with two service providers. Procurement sees two contracts and reports that dependency risk has been addressed. Both providers, however, depend on the same identity service. If that service becomes unavailable, neither route can operate.
The second contract may still offer commercial value. It does not provide the independence management assumed for that scenario.
I would want the resilience review to expose those shared dependencies: identity, data, connectivity, payment services and key people. NIST CSF 2.0 explicitly includes understanding services the organization relies on and services others depend on it to provide.[2] Leadership must decide which dependencies justify deeper examination.
For a critical alternative, ask what must remain available for it to work. Then ask which of those prerequisites are shared with the primary route. That conversation can reveal why apparently redundant arrangements fail together.
I would extend that review to the transition itself. Having a second provider does not answer how work reaches it, which information moves with the work, or whether the people executing the transition have usable access. Those conditions need to be demonstrated for the scenario being evaluated.
For the hypothetical organization, an exercise could begin with the primary identity service unavailable. The operating team would attempt the alternate process using only the credentials, information and communication routes that would remain available. If the team needs an exception from the failed service to proceed, we have learned something important about the alternative's limits.
Supplier arrangements deserve the same practical questions. I would ask whether capacity is reserved or merely available on request, what information the supplier requires, and how competing customer demand affects our assumptions. The answer may justify a different contract or a smaller promise to customers. It may also show that a proposed second provider buys less independence than a more modest change to our own operating process.
Capacity makes an option credible
An alternative can be independent and still be inadequate. A manual process might support essential customers for a short period but overwhelm staff if the disruption continues. Another supplier might accept a small workload while lacking capacity for a full transition.
That does not make the alternative worthless. It means its limits belong in the operating decision.
For example, a hypothetical distributor could preserve a manual order route for priority shipments. Leadership would need to define which orders qualify, who approves exceptions, and how completed transactions are reconciled afterward. Calling the process a fallback without those limits would conceal the work required to use it.
Exercises should measure sustainable service, queue growth, error correction and staff demand under the assumed conditions. A successful demonstration with a handful of transactions does not answer whether an option will remain usable through an extended disruption.
Exercise the return to ordinary operations
The exercise should also continue beyond activating the fallback. I would want to see how the business reconciles work when the primary service returns. The manual order route in the distributor example needs a record of what was accepted, what was fulfilled and what remains outstanding. Otherwise, the transition back could create duplicate shipments or missed orders within that hypothetical scenario.
The business owner should define who validates those records and who authorizes normal processing to resume. A technology recovery declaration is useful evidence about the system. The operating team still needs evidence that its transactions and customer commitments can be handled correctly.
I would record the additional effort required to reconcile the backlog as part of the alternative's operating cost. A workaround that protects essential shipments but creates several days of cleanup may still be a sound investment. Leadership needs to understand both the protection purchased and the recovery obligation it creates. The exercise should end with funded corrective actions, owners and a date for retesting the assumptions that failed.
Decide who may choose before the choice becomes urgent
A business has little practical flexibility if every alternative requires a decision from an unavailable executive.
I would establish decision rights alongside the recovery plan. Who may reduce service? Who may move work to an alternate supplier? Who can authorize temporary spending? Which actions require escalation because they could create consequences beyond the operating team's mandate?
Delegation needs boundaries. A manager might be permitted to prioritize orders within an agreed customer group but require executive approval to suspend a contractual service. The distinction should be understandable before pressure rises.
Exercises should test executive absence and conflicting information. The question is whether an authorized person can make a defensible decision with the information realistically available, while leaving a record others can review.
Fund flexibility in proportion to consequence
Preserving options has a carrying cost. Additional providers, spare capacity, portable data and rehearsed manual processes require money and attention. More complexity can also introduce new failure paths.
I would not approve redundancy simply because it appears prudent. Management should explain the commitment protected, the scenario addressed, the alternative's tested limits and the cost of keeping it usable. Compare that investment with the consequence of having no workable alternative.
Some commitments justify a fully independent service. Others may be protected adequately by a limited fallback or a deliberately accepted interruption. The decision should reflect consequence and tolerance rather than a universal requirement to duplicate everything.
There is also a maintenance decision. An alternative that nobody exercises or updates can become an expensive assumption. Its owner needs an ongoing obligation to confirm that contracts, access, skills and capacity remain available.
Report the choices that remain available
I would ask for a short resilience review organized around critical commitments. For each one, management should identify the primary dependency, the credible alternative, its last exercise date, sustainable operating limits and the person authorized to activate it.
The report should also say when an option expires. A temporary process may remain safe for hours rather than days. A supplier's reserved capacity may depend on an agreement approaching renewal. Those limits affect when leadership must decide.
This is a management approach, not a claim that resilience can be reduced to one score. Exercise results are evidence about defined conditions, and the next disruption may be different.
Still, the questions improve the investment conversation. We can distinguish an untested assurance from a usable alternative and decide where another dollar will preserve meaningful freedom.
Review the option as a continuing investment
I would review a critical alternative when its prerequisites change: a supplier renewal, a major acquisition, a new identity platform or a material change in customer demand. The purpose is to determine whether the option still protects the commitment for which we are paying.
A useful management measure could compare the time needed to make and execute the switch with the point at which the fallback ceases to protect the commitment. I would report the actual exercise result beside the assumed limit, including how much operating capacity was available after the switch. That is a proposed decision aid, not a universal resilience formula.
The review should permit withdrawal of an alternative that no longer justifies its cost. It should also expose where apparent efficiency has removed a necessary operating choice. Leadership can then decide deliberately whether to restore flexibility, narrow a customer promise or accept the consequence. Preserving options is most useful when it produces an explicit investment decision and a service the business can credibly deliver.
The resilience question I want leadership to answer is straightforward: if our preferred path becomes unavailable, which business commitments can we still honor, through what alternative, and for how long?
Sources and references
[1] NIST SP 800-160 Volume 2 Revision 1
December 2021; abstract. Supports the anticipate, withstand, recover and adapt description. Preserving options and the proposed operating review are David's analysis, not a quoted NIST framework.
[2] NIST Cybersecurity Framework 2.0
February 26, 2024; Govern function, GV.OC-04 and GV.OC-05, GV.RR and GV.OV. Supports dependency understanding and governance/oversight categories. Does not mandate the article's particular board report or resilience review.
[3] NIST IR 8286D Using Business Impact Analysis to Inform Risk Prioritization and Response
February 2025 update; abstract. Verifies the connection among mission objectives, critical assets, business impact analysis and enterprise risk direction. The proposed exercise and investment measures are executive recommendations, not required NIST metrics.
