The painful reality is that our power utilities aren’t as reliable as we want to believe, and their facilities are vulnerable to attack. It’s time for organizations to actively mitigate and plan for disruptions of electricity and natural gas.

Increasingly, you only can buy cyber insurance when you prove that you have implemented comprehensive strategies to reduce your risk and mitigate the cost of cyber-attacks. In fact, it is more valuable to implement those cyber security strategies than to have the insurance policy.

Luck and quick thinking are great in all aspects of life, but they aren’t business recovery strategies or risk mitigations. A near miss event should be treated very seriously, not as a success, and as a warning to bolster training, revise business recovery plans and implement additional risk mitigations.

After a disruption or emergency occurs, it’s tempting to suspend some routine protocols, procedures and standards to recover as quickly as possible. It is often prudent and effective to do so but recovery teams should be mindful that cutting the wrong corners can increase risk, worsen the situation and increase recovery time.

Organizations need to make BCM programs measurable to enable useful oversight and accountability. Too often, however, measuring BCM becomes unnecessarily complex, time-consuming and onerous, diverting resources and sapping engagement and commitment.

The success of a business continuity management program (BCM) in no small measure relies on executive engagement and support. Engagement is vital when initiating a BCM program or introducing an existing program to a new senior executive, and there are ways to achieve this strategic objective.

The most serious risk to your organization isn’t malware, supply chain disruption, pandemic or any other event. Ironically, your biggest risk is your inability to adequately recover from multiple simultaneous disruptions. In the past few years, business and society have adapted to various ‘new normals’, and one of those is disruptions layered one on another and another.

Your organization has a choice regarding supplier resilience. You may assume that suppliers have sufficient plans and recovery procedures that will reduce the risk and impacts of disruptions to their operations. Or, you may choose to actively verify supplier resilience.