Someone once asked:
“What is cyber resilience to you?”
It was a question asked by a presenter at a meeting I attended.
I don't remember anyone answering it. Perhaps he wasn't actually waiting for an answer. It came right at the end of his presentation, and he had to wrap up.
But the question stayed with me.
I had already developed a definition for cyber resilience.
What I hadn't really thought about was that different people might define cyber resilience quite differently.
Some look at it primarily from a technology perspective. Others approach it through governance, leadership and organisational culture.
All these perspectives are valid.
But when I think about cyber resilience, I think about individuals and very small businesses, where the leader and the worker may be the same person.
Cyber resilience has to adapt to that reality.
For me, cyber resilience means being prepared for a cyber incident before it happens, being able to respond when it does, and being able to recover and continue afterwards.
Hence, cybersecurity controls are crucial for resilience.
Multi-factor authentication matters.
Backups matter.
Protecting accounts matters.
Keeping devices and software updated matters.
Knowing who has access to your information matters.
But having controls isn't enough if they don't actually work when you need them.
You may have backups. Can you restore from them?
You may have MFA. Is it protecting the accounts that really matter?
You may have an incident response plan. Does anyone know what to do when something happens?
You may trust your suppliers and vendors. Do you know which of them hold your information or have access to your systems?
This is why I don't see cyber resilience as purely a technology problem.
But I don't see it as purely a governance or leadership problem either.
Cyber resilience is where people, processes and technology come together.