1 Building the business case for operational resiliency Real Time Resilience Series 2 Introduction Today, organizations face an ever- expanding universe of risks that can lead to business disruption. Cyberattacks are increasing in frequency and sophistication, putting customer and company data in the crosshairs of malicious actors. Ransomware is a particular problem, often bringing business operations to a grinding halt. Climate change is resulting in environmental catastrophes—everything from wildfires to hurricanes and floods. Regional conflicts are threatening supply chains. The list goes on. At the same time, regulators are turning up the heat, especially when it comes to protecting critical national infrastructure. Much of this regulation is focused on digital assets. As an example, the EU’s Digital Operational Resiliency Act (DORA) requires financial firms to ensure that they can withstand, respond to, and recover from digital threats. Similarly, NIS2 imposes strict cybersecurity obligations on organizations operating in critical sectors in the EU. NERC CIP is another example, providing a comprehensive, mandatory cybersecurity framework for North American electricity suppliers and utilities. And these regulations have teeth. For instance, NIS2 carries maximum fines of up to €10 million or 2% of global revenue, whichever is greater. Faced with the dual realities of an increasingly hostile risk landscape and stringent regulation, CIOs need to ensure operational resiliency— the ability to protect critical infrastructure, applications, and processes from disruption, and recover quickly and easily when a disruption event occurs. While this operational resiliency must encompass an organization’s digital infrastructure, it goes beyond that. CIOs also need to support broader resiliency efforts, providing systems that allow other business functions to identify, mitigate, and respond to disruption scenarios. Systems to manage third-party risk are a good example, as are business continuity planning tools. 3 Building the business case for operational resiliency investment Operational resiliency requires significant investment in enabling technology. Given the magnitude of the risk landscape and the speed with which risks evolve, more traditional approaches to managing risk, such as spreadsheets and emails, just don’t scale. They’re too slow, and they don’t provide the visibility and control needed to build operational resiliency. And even if they did, the sheer cost of manual operational resiliency processes is likely to be prohibitive. Existing point systems are also a problem. 4 Operational resiliency isn’t built by working in silos—it requires a connected, organization-wide approach using a unified platform that aligns multiple business functions to create visibility and coordinate execution. Given the investment required, how does a CIO justify this investment to the CFO? Yes, pointing to major regulatory penalties is a potent argument, but it is ultimately flawed if it is the only argument. If the only goal is to avoid fines and other sanctions, then the obvious question is, “What is the minimum investment we have to make to comply?” This ignores the broader picture—what do we need to invest to bring the potential impact of business disruptions to an optimal level? Cost reduction is another angle of attack (and we’ll talk about cost reduction potential later on), but it leaves operational resiliency competing with other cost-reduction initiatives rather than looking at the broader spectrum of business benefits. 5 What does the CFO care about? Ultimately, CFOs care about delivering shareholder value. Many components feed into this, including driving growth and managing risk. In fact, a 2023 McKinsey survey showed that the top two areas where CFOs focus most are managing financial risk and identifying growth opportunities, which together account for 67% of their time. Cost cutting is also a significant activity, accounting for 27%.