Resilience Requires Cross-Functional Leadership Responsibility

Look beyond the technical condition

A security dashboard can show which IT systems are available and which technical risks are being addressed. Assessing organizational resilience also requires clarity about the services the organization must maintain during disruption and their prerequisites outside IT.

These include personnel, buildings, suppliers, decision authority and cooperation with external actors. IT security contributes essential expertise. Its technical remit does not make it responsible for all these prerequisites.

Visible evidence can influence management attention

In my view, an organizational risk arises when readily available metrics and audit evidence also determine the scope of leadership discussions. Questions with clear indicators may then receive more attention than dependencies or decision routes that are harder to represent.

This is not a necessary consequence of cybersecurity. It concerns how its results are used: a favorable technical finding must not silently become a conclusion about the organization’s overall coping capability. Equally, difficulty in measuring a capability does not make it less relevant.

Separate specialist responsibility from overall accountability

Leadership must specify which services need to be maintained under which conditions. Specialist functions explain their prerequisites and limitations. Where demands conflict, a decision across functions is required, for example on scarce personnel or recovery priorities.

I recommend organizing resilience reporting around critical services and connecting the specialist contributions to them. Technical recovery remains a distinct part of the account. The report must also show which organizational prerequisites are met and which decision remains unresolved.

Establish a common basis for assessment

Our working paper “Bewertung von organisationaler Krisen-Resilienz anhand des Resilienzrisikoreifegrades” (Rico Kerstan and André Röhl, NBS Northern Business School, No. 1/2025) combines internal and external perspectives with resistance and coping capability. The title concerns assessing organizational crisis resilience through resilience risk maturity, a qualitative assessment tied to selected scenarios. This distinction helps extend a purely technical assessment without diminishing IT’s contribution.

Leadership therefore has a coordination task: the specialist assessments need to concern the same service and scenario before their combined contribution to preparedness can be discussed. Overall accountability extends beyond individual functional mandates while remaining dependent on their knowledge.

→ Resilience and leadership: Services → Working approach: Approach