Organizational resiliency is the new buzzword for protecting our nation’s most critical infrastructure and key resources.  So, what does organizational resiliency really mean? Prior to 9/11, the Clinton Administration issued an obscure directive establishing critical infrastructure protection (CIP) as a new concept in protecting our nation’s most critical assets. President Clinton expressed his intent that the United States would take all necessary measures to swiftly eliminate any significant vulnerability to both physical and cyber attacks. Nonetheless, at that time, critical infrastructure protection in this country was put on the back burner.

Once the horrific attacks on the World Trade Center and the Pentagon had occurred, critical infrastructure protection took on a new sense of importance. President George W. Bush established the Department of Homeland Security (DHS). The DHS created the National Infrastructure Protection Plan (NIPP) and identified 18 sector-specific areas (listed below) considered vital to the welfare of the United States.

Agriculture and food                 Banking and finance

Chemical                                Commercial

Critical manufacturing               Dams

Energy                                    Nuclear

National monuments, icons        Information technology

Healthcare and public health       Government services

Defense industry based              Postal and shipping

Emergency services                   Water

Telecommunications                  Transportation

Organizational resiliency can be defined as the ability to recover quickly from an event, whether it be a manmade incident or natural disaster.  Businesses and governmental units cannot rely totally on implemented security measures to protect their respective operations. However, it is necessary that businesses and governmental services be flexible to bear disruptions and develop the necessary reactive actions to recover or adapt to the adverse situation.

It is important to identify interdependencies that critical infrastructures depend on to stay operational.  As an example, over 90 percent of the iron ore used in this country passes through the Soo Locks in northern Michigan. If the Soo Locks were to become nonfunctional because of a catastrophic event, the U.S. steel industry would be shut down in a matter of days, which in turn, would then affect the critical manufacturing sector such as the auto industry or the defense industrial base. From there, the rippling effects would rapidly trickle down to other supporting businesses and the local economy.

Let’s bring organizational resiliency down to a more local level. Imagine you have a grocery store that depends on daily deliveries; obviously electricity is needed to run lights, refrigeration and your store’s computer system.  The interdependencies you are most dependent on to keep your grocery store operational would be the agriculture and food, energy and transportation sectors. If there is a major highway that is shut down, your deliveries from the ag/food sector will not get delivered in a timely manner.

It is important to identify and coordinate with key individuals with other interdependency sectors and identify common risks and threats. Once the common risks and threats have been identified, measures can be taken to address the appropriate responses to make your business more resilient.

A situation that can simultaneously affect multiple sectors would be a disruption of electrical power or a major shutdown of a telecommunications hub. This type of situation can be described as a shared point of failure.

Al Shenouda, a protective security adviser with the Department of Homeland Security for the Eastern District of Michigan, recently told a group of security professionals at Michigan State University that “a community subject to the loss of power, telecommunications and water [a shared point of failure] for a period of at least three and a half hours will begin to take on the characteristics of a Third World country.”

A good question to ask is, “How long can I afford to be out of business?’ By asking yourself this question, you can start the process of preparing accordingly in making your business more resilient.  You may wish to seek professional guidance in disaster recovery and business recovery methods by contacting your local county emergency manager, a business continuity specialist or a qualified security consultant. By taking these actions, you and your business will become better prepared and better protected.

		James R. Kus, CPP is the owner of Kus & Associates, LLC, Security Consulting Services, located in Grand Ledge since 1998. Kus is a retired Lansing Police Department detective and retired from the Michigan National Guard as the State Physical Security NCO.