The Myth of the Expert (and What I Had to Unlearn About Resilience)

Let’s cut to it: Workflow dependency mapping looks useful — until you realize no one uses it when it matters. You can chart every input, every output, and every branch of every process. But when something breaks, people don’t follow the map. They ask: “What’s down?” “How long can we live without it?” “What has to stay running no matter what?” That’s why smart resilience programs are ditching spaghetti maps and asking a better question: “What’s the minimum acceptable availability for this service over the course of a year?” What Is Percentage Availability? It’s not a gut check. It’s not a vague SLA. It’s a clear, numeric threshold : “This service must be available 99% of the time annually.” “This process can only be down for ~88 hours a year (1%).” “This function only needs 80% availability to be considered successful.” This gives you a tangible, outcome-based requirement for continuity — not just a list of dependencies that might or might not matter in a disruption. Why Workflow Dependency Mapping Misses the Mark It’s Static Processes and systems change constantly. Maps don’t. It’s Not Prioritized Everything looks connected, but it doesn’t tell you what’s vital vs. what’s just annoying to lose. It Doesn’t Translate to Exec Decisions No executive makes decisions off a diagram. They need to know: “What are we failing to deliver, and how long can we fail before it matters?” It’s a Maintenance Burden Who’s updating all those dependencies quarterly? No one. Let’s be real. Why Percentage Availability Works Better Aligns With Business Objectives You’re not asking “What does this connect to?” You’re asking: “How much uptime does this service need to meet customer expectations, compliance, and revenue targets?” Drives Response Planning If something has to be up 99.9% of the year, you don’t just plan a recovery, you build failovers, redundancy, rapid response. It tells you where to spend your effort. Simplifies Risk Conversations Availability gaps are easy to quantify and defend. You can say, “We’re currently only designed for 90% availability, but leadership expects 99.5%. Here’s the delta. Here’s the cost to fix it.” Scales Without Getting Lost in the Weeds You don’t need to map 400 steps. You need to know how often the thing can go down before your customers, your regulators, or your board notice. Realistic Resilience Isn’t About Mapping Everything It’s about setting clear expectations: What must stay running? How often? How fast do we recover when it doesn’t? Percentage availability gives you that answer. Stop glorifying documentation and start defining performance. Your org doesn’t need another diagram. It needs a standard for continuity . Need help defining percentage availability targets that actually make sense? That’s what we do. No fluff. Just clarity.

Let’s get something straight: The resilience software market is long overdue for a reckoning. For years, enterprise platforms like Fusion Risk, RSA Archer, and BC in the Cloud (BCIC) have positioned themselves as the gold standard for business continuity and crisis management. They promise flexibility and maturity—yet, in my experience, they often deliver bloated architectures, outdated templates, and UIs that feel like they were designed before the smartphone existed. And the pricing? These platforms can easily charge six figures just to get started. Then come the “extras”: implementation fees, integration costs, training packages, ongoing support, and endless consulting hours. Before you know it, you’re sinking budget into a system your team barely uses. Built for Consultants, Not for Crises These systems weren’t literally built by PwC or Deloitte—but they may as well have been. In my opinion, their architecture reflects a consulting-first mindset: checkbox-heavy, audit-centric, and painfully rigid. They’re optimized for reviews, not real-world response. The result? Endless dropdowns. Disjointed modules. Workflows that make sense on a flowchart but collapse in a crisis. What Real Users Are Saying This isn’t marketing spin—these are direct quotes from real-world users: RSA Archer “Complex, not user friendly, and bulky. The interface just looks old… like opening an old Nintendo system from 1990.” “There are way too many screens. A new user can get lost and would need a lot of help.” Fusion Framework “Implementation is complex. Customizations require help from Fusion support every time.” “It’s powerful, but so bloated. Every time we want to do something simple, we end up stuck in configuration hell.” BC in the Cloud (BCIC) While once known for flexibility and price, BCIC’s newer version tells a different story: “To get the most from the tool, one really needs to have HTML/Java-type knowledge… If you don't, you have to rely on their support team.” “The plan-building feature is a little archaic, but it gets the job done.” “Advanced reporting capabilities are limited… need separate test environment—adds overhead.” In my view, the low-code flexibility that BCIC was once praised for is largely gone. What’s left is a system where simple tasks feel over-engineered, overly technical, and support-dependent. Not exactly the agile solution today’s resilience teams need. What People Actually Want From years in the trenches, I’ve seen that resilience teams consistently are looking for: Fast onboarding – not six-month implementation timelines Intuitive UI – no screen mazes, no friction Component-based solutions – not massive, inflexible suites Templates that match how the business actually operates or the ability to create their own templates Process-driven workflows – built for continuity, not just compliance Start with Design, Not with a Demo One of the biggest mistakes organizations make is buying software before they’ve defined what their program should be. Before you take a single demo, design your program. Build your templates. Outline your workflows. Know what you need. Too often, organizations reverse that process: contorting their strategy to fit whatever tool they just purchased. That’s how you end up with rigid plans, awkward workarounds, and low adoption. Every organization is different. Culture, structure, and decision-making vary widely—and your resilience program should reflect that. Tools should support your model, not impose theirs. Executives Quit Before Your Implementation Does Another hard truth: many resilience program sponsors may not survive long enough to see the tools they buy actually implemented. Multi-year implementations don’t just waste time, they burn political capital. One landmark study found that one in six large-scale IT projects becomes a “Black Swan,” overrunning costs by 200% and timelines by nearly 70% . When that happens, the executives who sponsored the project are often replaced before the tool ever delivers value. In our direct experience, we’ve seen this play out: A BC/CM director champions a new system. Implementation stalls. Leadership changes. The program loses momentum or worse, gets shelved entirely. Projects fail not just from bad tools, but from fatigue . Executive support erodes with every missed milestone. In many cases, if you're still configuring when your sponsors have mentally moved on, you’re running uphill. This is why the process must be practitioner-led and designed up front . You need clarity before you spend. Otherwise, you’ll be rebuilding under new leadership anyway. The Practitioner-Built Difference This is exactly why we’ve built tools differently. At PAI Consulting, we don’t build for certifications, audits, or shelfware. We build for functionality, speed, and survival. We’ve led real response teams. We’ve seen legacy platforms fail under pressure. And we’ve used that frustration to build better tools. Our suite includes: Scenario TTX – A smarter, AI-powered tabletop engine that generates dynamic injects, adapts to real-time decisions, and produces actionable after-action reports—cutting prep time while raising engagement. Business Resilience Navigator – A maturity assessment and roadmap tool that delivers strategic clarity. It moves beyond compliance checklists and helps organizations build a resilience program grounded in actual capabilities. Resilience Planner Studio (coming Q3 2025) – A modern, modular planning engine for continuity, risk, and crisis workflows. Studio is our take on the now-defunct (and missed) Sustainable Planner platform, giving teams full control to build, assign, and manage their own planning templates, assessments, and logic—without being boxed in by vendor limitations. Resilience Planner 360 (coming late 2025) – Our full-scale, response-ready platform built on our Realistic Resilience framework. Unlike rigid platforms built for auditors, 360 helps teams plan, test, and respond in real time. It supports BIAs, AIAs, playbooks, CMT role assessments, and incident tracking—all tied together by a framework that reflects how organizations actually operate during disruption. Each tool is practitioner-tested, modular, and designed for the way real resilience work gets done—fast, focused, and grounded in operational truth. The Market Is Shifting Organizations are waking up. They’re tired of: Paying top dollar for slow, bloated systems Letting software vendors and consulting partners dictate workflows Spending six months to over three years on implementation only to realize no one’s using the tool The next wave of resilience software will be practitioner-led. Lean. Responsive. Built to serve actual needs, not theoretical frameworks or RFP checklists. Ready for Something Better? We’re not just pointing out problems, we’re working to solve them.  Resilience Planner Studio & Resilience Planner 360 are our answers to the overpriced, overbuilt legacy platforms that dominate the market. They are being built from the ground up by practitioners who understand a core truth that big vendors seem to ignore: Let’s be honest—these platforms are not used every day by most of your workforce. So why are you paying as if they are? In reality, the only regular users are your continuity, risk, and crisis teams. What they need isn’t bells and whistles—they need speed, clarity, and reliability. That’s why our planning tools will be: Fast to deploy and intuitive to use Modular and scalable—no “all-or-nothing” commitments Designed for planning, exercising, and response Built for actual users, not just the executive sponsor Most importantly: we’re not trying to drain your budget for a platform that collects dust between audits. We’re building tools that show up when they’re needed—and stay out of the way when they’re not.

Tabletop exercises are a cornerstone of any organization’s resilience program, bringing multiple stakeholders together to rehearse a hypothetical crisis, identify gaps, and refine processes before a real incident strikes. Yet, many teams still rely on handcrafted or semi-automated scenarios that quickly become repetitive, lack meaningful analytics, and require constant manual upkeep. Scenario TTX was built from the ground up to eliminate each of those limitations. By combining a curated set of scenario types/subtypes with an AI engine that (1) generates the narrative and injects on-the-fly, (2) adapts each inject based on live participant responses, and (3) provides instant, multi-dimensional scoring, Scenario TTX delivers dynamic, data-rich, and scalable tabletop exercises – every time. Below, we explore how Scenario TTX delivers far greater value than DIY or static alternatives (even those bolstered with generic AI prompts), highlighting features like true inject adaptivity, AI-driven evaluation, flexible exercise lengths, and built-in support for up to ten remote participants. 1. Adaptive Injects: Fresh Challenges Every Time 1.1 From Scenario Types/Subtypes to Tailored Playbooks Unlike a “static PDF library,” Scenario TTX lets you pick from scenario types (e.g., “Natural Threats,” “Cybersecurity,” “Reputational”) and then select a precise subtype (for instance, “Sustained Drought,” “Ransomware Attack”). At run-time, the AI engine builds the full scenario narrative , including background context, stakeholder roles, critical resources, and an initial inject, automatically. With a handcrafted or one-off AI-prompted scenario, every run ultimately feels nearly identical: participants anticipate the sequence of injects, and exercises lose their realism. Scenario TTX’s scenario-type + subtype approach guarantees a unique starting point each time you launch an exercise, ensuring even the first inject reflects the latest industry context, vendor lists, or organizational specifics that you’ve configured. 1.2 Inject Variations Based on Participant Responses The true power of Scenario TTX emerges once participants begin responding. Each answer is captured, analyzed, and used to generate the next inject in real time. For example: Proactive Communications Detected? If the team’s first response prioritizes stakeholder outreach, the AI might escalate to “Local regulatory body publicly questions financial stability,” testing whether they can pivot from outreach to regulatory engagement. Technical Focus Only? If IT immediately throws all resources at fixing systems without addressing client concerns, the AI could shift to “Major client threatens to withdraw funds unless formal recovery plan is presented,” forcing a new decision path. Because responses directly drive each subsequent inject, no two runs ever feel the same , even if you select the exact same scenario type/subtype days, weeks, or months apart. This continuous adaptivity uncovers fresh insights every time, whether you’re engaging the same group or rotating different teams through that scenario. 1.3 Remote, Multi-User Collaboration (Up to 10 Participants) Scenario TTX is built for modern, distributed teams. Up to ten participants can log in simultaneously, whether they’re in the same conference room or scattered across the globe. Each participant submits an independent response to every inject. The facilitator then has complete control over how to proceed: Use All Responses: Ideal for large-team consensus – present the aggregate sentiment, drive a discussion, and move forward based on the majority. Select Some Responses: Choose the most relevant answers from a subset of participants (e.g., senior leadership) to guide the next inject. Use a Single Response or None: If one expert’s viewpoint is critical (say, your Chief Risk Officer’s input), the facilitator can advance using just that response or override all answers to simulate a “rogue inject” from a threat actor. This flexibility makes it possible to run truly collaborative, multi-perspective exercises without anyone physically present. Compared to a DIY PDF (where remote participants must email their notes back to a single facilitator), Scenario TTX’s built-in collaboration saves time, reduces miscommunication, and keeps the exercise flowing naturally. 2. AI-Driven Evaluation: Rapid, Data-Rich Debriefs 2.1 Automated Scoring Across Four Key Dimensions When the exercise concludes, whether it’s a 1-inject micro-simulation or a 20-inject deep dive, Scenario TTX instantly produces a comprehensive After Action Report. On the dashboard, the user can select any of their completed tabletops to generate an AI-produced Scorecard that includes: Overall Exercise Rating: A star-based aggregate score (for example, 2 out of 5 stars) accompanied by a clear “Needs Improvement” or “Adequate” flag. Summary Assessment: A concise paragraph highlighting both strengths (e.g., “Team proactively recognized regulatory obligations”) and areas for improvement (e.g., “Delayed decision-making slowed response”) based on actual responses. The assessment scorecard includes: Scenario Outcome Rating: A judgment on whether the team “Contained with Gaps,” “Escalated,” or “Achieved Full Control,” paired with an AI-generated justification that cites specific responses. Team Behavior Breakdown: Individual scores (1–5 stars) for each dimension— Communication , Decision Making , Role Execution , and Flexibility —plus bullet-pointed Strengths and Areas for Improvement for each dimension. For instance: Communication (3/5): Strength: “Participants drafted an on-brand FAQ document.” Improvement: “Needed earlier sharing of situational updates to all stakeholders.” Decision Making (2/5): Strength: “Formed a dedicated task force within 10 minutes.” Improvement: “Took too long to escalate vendor negotiations.” Industry Benchmarking: A percentile ranking (e.g., “55th percentile in Financial Industry”) comparing your team’s performance to hundreds of peers who ran the same scenario type/subtype in the last 12 months. All of this is assembled within minutes , with no manual note-taking or biased interpretation. Even if you attempted to “DIY” that analysis in a spreadsheet or through a standalone AI tool, you’d struggle to replicate the depth and objectivity of Scenario TTX’s built-in model. 2.2 Consistent, Objective Feedback Over Time Human facilitators can inadvertently focus on the loudest voices or specific injects that resonate with them, skewing post-exercise feedback. Scenario TTX applies the same AI-driven rubric to every exercise, regardless of who’s in the room. Over time, you build an unbiased data history showing performances across multiple exercises. That consistency is invaluable when you want to: Track progress (e.g., “Finance’s Decision Making improved from 2.2 to 3.8 over four quarter-end drills”) Identify recurring gaps (e.g., “Branch Managers consistently underperform in Flexibility during sudden reputational injects”) Justify training budgets with hard data rather than anecdotes Trying to replicate that level of consistency manually, through patchy spreadsheets or ad-hoc notes, is both time-consuming and prone to blind spots. Scenario TTX’s automated evaluation ensures you always have a clear line of sight into your organization’s evolving strengths and weaknesses. 3. Unlimited Exercises & Flexible Lengths 3.1 Spin Up New Runs—No Rework Required With a DIY or handbook approach, every new run means manually updating Word documents, rewriting inject lists, and re-verifying that scenario details (vendor names, system configurations, contact information) remain current. Scenario TTX removes that overhead entirely. Once you enter just your organization name, industry, number of employees, and locations , the AI takes care of: Researching Your Company Context: Leveraging publicly available data and industry norms so injects align with your actual risk profile. Maintaining Up-to-Date Details: As the AI’s underlying dataset updates (new threat intelligence, evolving industry best practices), future runs automatically reflect those changes without any user action. From there, you can launch unlimited tabletop exercises with a few clicks – no reprinting PDFs or reworking inject lists for each new exercise. 3.2 Choose the Right Length for the Right Audience Scenario TTX’s flexible architecture lets you run: 1-Inject Micro-Simulations: A 10-minute “pulse check” —for instance, “Your primary cloud provider announces a major data breach. Outline your first course of action.” Within minutes, you receive a snapshot evaluation on Communication and Decision-Making. 5-Inject Focused Drills: A 30-minute department-level exercise —e.g., HR and Legal test a “Vendor Data Breach” scenario with injects that adapt to the team’s actual actions (employee notifications, regulatory reporting, media statements). 20-Inject Deep-Dive Tabletop: A multi-hour enterprise stress test that can be paused after any inject. Because Scenario TTX auto-scores each inject, you can pause at inject 7, reconvene days later, and pick up at inject 8 without having to rebuild or reconfigure anything. In a DIY environment where you cobble together inject lists or prompt an AI chatbot to “generate 20 injects” you must manually anticipate and sequence every inject, then keep track of which version each group is using. Scenario TTX centralizes that entire process, so you focus on learning outcomes instead of document prep. 4. Why Standalone AI or Handcrafted Scenarios Fall Short It’s true that free or open-source AI tools can help you brainstorm realistic injects. You might prompt ChatGPT (or a similar model) with: “Generate five injects for a drought scenario affecting a community bank’s loan portfolio.” You can coax a plausible text sequence. But attempting to replicate Scenario TTX’s integrated workflow creates four key challenges: Real-Time Adaptivity: A generic AI chatbot can’t “listen” to your team’s answers, pivot mid-exercise, and craft the next inject accordingly. Instead, you’d need to pause, copy the team’s responses, re-prompt the AI, manually insert a new inject, and resume, destroying immersion and adding latency. Scenario TTX’s AI engine does that pivot automatically, in real time. Automated Scoring & Analytics: To score Communication, Decision Making, Role Execution, and Flexibility across multiple injects, you’d need to define a custom rubric, capture every answer in separate documents, then manually quantify and summarize performance. That process is both time-consuming and subjective. Scenario TTX’s AI provides an instant, objective, multi-dimensional scorecard complete with narrative strengths and gaps. Industry Benchmarking: Free AI tools offer no built-in dataset to compare your results against peers. You’d have to collect data from dozens of other organizations, normalize it to a common scale, and build your own benchmark tables. Scenario TTX already maintains an ever-growing database of exercises letting you see where you rank among “Banking & Finance” teams running the same “Drought” scenario, for instance. Scaling to Multiple Teams & Remote Participants: Every time you want to run an exercise, you must repeat steps 1–3 manually and potentially rework inject sequences to keep them “fresh.” Additionally, facilitating remote, multi-user collaboration via email, video calls, or chat tools can be clunky, answers get lost in threads, and the facilitator must compile them manually. Scenario TTX’s built-in support for up to ten remote participants solves both issues: you scale effortlessly, and every remote user’s independent response feeds seamlessly into the adaptive inject logic. In short, while standalone AI can help you generate content, it cannot match Scenario TTX’s fully integrated approach: adaptive scenario generation, automated multi-dimensional scoring, real-time remote participation, and effortless scaling across multiple teams.  5. Key Benefits of Scenario TTX vs. DIY Approaches

Introduction: The Broken Promises of Business Continuity The resilience industry has a trust problem. Not because systems fail, that’s inevitable, but because the response to failure is wrapped in red tape, vanity metrics, and meaningless jargon. Clients/customers don’t need perfection; they want honesty, clarity, and a sense that someone is in control. Yet traditional business continuity planning clings to outdated concepts like RTOs and boilerplate SLAs while ignoring what really matters: how people feel when things go wrong.  At PAI Consulting, we call this out for what it is: resilience theater . That’s why we’ve built our Realistic Resilience methodology around the truth: systems fail, third parties falter, and clients/customers will forgive you, as long as you treat them like adults. Why RTOs Are Vanity Metrics The Recovery Time Objective (RTO) is one of the most widely used (and widely misunderstood) metrics in resilience planning. It represents the maximum amount of time a system or function can be down before significant impact occurs. But in practice? RTOs are often guessed, not calculated. They're set without real input from IT or third parties. They are rarely accurately or realistically tested or validated. And worst of all, they are virtually never communicated to clients/customers. This leads to absurd situations: a service outage occurs, and even if you're technically "within your RTO," clients/customers are furious because they had no idea what that meant. Or worse, they weaponize the RTO as a hard expectation, regardless of the root cause. Instead of relying on fictional timelines, we advocate for percentage-based availability and transparency-driven communication. SLAs: The Illusion of Control Service Level Agreements (SLAs) often promise 99.9% uptime, 24/7 support, and rapid response. But what they really offer is legal cover. Vendors treat SLAs as compliance documents, not living operational commitments. We’ve seen organizations get burned because their vendor hit the letter of the SLA while completely violating the spirit of trust and service. Even a 99.999% uptime guarantee still allows for ~5 minutes of downtime per month, but those minutes can matter if they occur during a critical transaction. And critically, SLAs typically do not differentiate the nature of the outage : A full system crash counts the same as a degraded system with latency issues. A partial availability problem, where some users are affected but not all, may not even register as an SLA violation. Intermittent errors, performance slowdowns, or localized failures are often invisible in standard SLA reports. This misalignment creates a dangerous blind spot. From the customer’s perspective, any degradation in performance feels like a failure . But under the SLA? Everything looks fine. Instead of worshipping at the altar of five nines, Realistic Resilience encourages organizations to: Track actual availability month over month Share real mean time to recovery (MTTR) stats Be proactive in customer comms when things break Acknowledge and address partial, latent, or non-total outages as real customer-impacting incidents Third-Party Risk: More Than Questionnaires Current third-party risk frameworks obsess over vendor questionnaires, due diligence checklists, and static scorecards. But when things go wrong, all that prep means nothing if there's no plan to communicate. Worse, many organizations treat third parties as magical black boxes: “They’ll handle it.” No. You’re accountable to your clients/customers even for things you don’t directly control. Realistic Resilience flips the script by embedding crisis communication and accountability into third-party relationships: We assume vendors will fail at some point. We require communications protocols , not just SLAs. We treat third-party disruptions as brand risks, not just ops risks. Crisis Management Isn't Just for Disasters One of the most dangerous misconceptions is that crisis management is only activated when there's a disaster, such as a cyberattack, natural catastrophe, or full-blown outage. But in the modern resilience environment, a 10-minute login issue at your SaaS provider could do more reputational damage than a day-long power outage. Realistic Resilience advocates for micro-activation of crisis comms : Any issue that affects customer experience = activate the plan. Fast, plain-language updates trump silence and delay. Train teams to respond to perception, not just impact. The difference between a crisis and an inconvenience is how you handle it. What Clients/Customers Really Want: Trust, Not Perfection Clients/customers are surprisingly forgiving, IF you're transparent. Tell them what's happening. Tell them what you're doing. Tell them when they’ll hear from you again. They don’t care about your RTO. They care that you show up. Realistic Resilience embraces this by aligning metrics with customer experience: Use uptime percentages , not recovery guesses Share real incident timelines , not idealized plans Replace "blame the vendor" responses with co-owned resolution strategies Case Study: A Realistic Resilience Response in Action A regional bank relying on a third-party SaaS provider experienced a partial service outage during peak hours. The vendor’s SLA technically allowed for up to 30 minutes of monthly downtime, and the system was restored in 22 minutes. But by the time the platform was live again, dozens of high-value clients had already submitted complaints. Using the Realistic Resilience framework, the bank’s crisis team activated their communications protocol within the first 5 minutes after confirming the outage: A banner message was posted to the login screen acknowledging the issue. Clients were emailed within 15 minutes with a clear, jargon-free explanation. A follow-up message provided recovery confirmation and a brief postmortem within 2 hours. Even though the SLA wasn’t violated, the team treated the event as a trust risk, not just a technical one. The result? Near-zero client churn and several clients/customers responded with praise for the transparency. Conclusion: Let’s Kill the Theater If resilience planning continues to rely on fake deadlines, obscure metrics, and silence during actual disruptions, it will continue to fail. RTOs should not be front-line commitments. SLAs should not be escape hatches. Third-party risk should not be checkbox compliance. At PAI Consulting, we don’t chase illusions. Realistic Resilience means planning for the messy, unpredictable, and very human reality of modern service delivery. And it means treating your clients/customers like people, not SLAs. Because in the end, resilience isn’t about uptime, it’s about trust recovery.

In the world of business continuity and operational resilience, certifications from DRI and BCI have long been seen as the standard. You take a course, pass an exam, and suddenly you’re a “certified” continuity professional. But for those of us who’ve actually worked through real disruptions, those credentials often fall flat. They focus on documentation, theory, and checklists - yet skip over the messy, unpredictable reality of actual crisis response. And here's the real problem: They’re failing the next generation of resilience professionals. The Current Certification Model Is Broken The goal of certification should be to build capability, not just credibility. It should prepare someone to walk into a chaotic situation, lead a team under pressure, and make time-critical decisions with incomplete information. But instead, we’re training newcomers to: Fill out outdated BIA templates Memorize lifecycle terminology Recite definitions for risks they’ve never seen in action We’re not equipping them, we’re encasing them in legacy thinking. Documentation Isn’t Leadership You can be certified without ever: Leading a response Running a live exercise Talking to executives in a crisis Making a time-critical recovery decision And that’s the gap. We’re credentialing people to write plans, not to lead responses. The Pay-to-Play Problem Honestly, these programs are designed to sustain themselves. You pay for training, pay for the test, and pay annual fees to keep your letters. But none of that guarantees you can actually do the job when it counts. For someone new to the field, it’s an expensive entry point that offers surprisingly little return unless they're propped up by real-world mentorship. I can remember a time when an employee of mine with 0 years of experience received a CBCP - right then, I knew the certification wasn't worth it. What Certification Should Actually Do If we care about building a stronger field, we need to rethink the model from the ground up, not just to validate the experts, but to train the next wave of professionals to be effective, adaptable leaders and here's what that could like like: 1. Real-World Scenario Testing - Don’t just pass a quiz. Respond to complex, evolving crisis scenarios—just like you’ll face in the real world. You don’t learn to lead from a workbook. 2. Portfolio-Based Certification - Bring proof. Show your actual work: plans, exercises, incident responses, risk analyses. Certify based on what you’ve done, not what you’ve heard in a class. 3. Mentored Pathways - Pair new professionals with real-world resilience leaders. Make experience part of the curriculum, not something they’re left to figure out on the job. 4. Cross-Skill Development - Train people across disciplines: cybersecurity, communications, executive briefings, time-based recovery, vendor risk. No more single-silo certs. 5. Focus on Response, Not Just Readiness - The best plan won’t save you if no one knows how to act on it. Certification should be about leading the response, not just writing the prep work. It's Time for More Than Letters DRI and BCI have long lived past their usefulness. We’re in a different era now. Threats are faster, systems are more complex, and leadership expectations are higher than ever - and yet, they are still teaching the same thing from decades ago. It’s time for a certification model that actually builds: Real capability Adaptive thinking Practical leadership Cross-functional resilience Let’s stop handing out gold stars for downloading templates and start training the kind of leaders this field actually needs.

In the world of resilience planning, the concept of Recovery Time Objectives (RTOs) has long been the standard for measuring how quickly systems or processes must be restored after a disruption. While RTOs have their place, I’ve increasingly found them to be too rigid, arbitrary, and often disconnected from the realities of modern business operations. This realization led me to adopt a new approach: using percentage availability metrics to measure and plan for resilience. Here’s why I’ve started focusing on percentage availability and how it can transform the way organizations think about operational reliability and resilience. The Problem with RTOs RTOs attempt to define the maximum acceptable downtime for a system or process, but they often fall short in practical application: Arbitrary Timeframes : RTOs are often set without a comprehensive understanding of business needs, making them either overly conservative or too lenient. Fragmented Focus : They tend to silo recovery efforts, focusing on individual systems rather than holistic organizational outcomes. Misaligned Expectations : RTOs don’t easily translate into metrics that executives, stakeholders, or customers can relate to, leaving gaps in understanding and prioritization. In today’s fast-paced and interconnected business environment, organizations need a more dynamic, relatable, and actionable metric. Why Percentage Availability Metrics Make Sense Percentage availability shifts the focus from “how fast can we recover?” to “how reliable is this system over time?” It measures the proportion of time a service or function is accessible and operational over a given period, typically a year. For example: 99.0% availability allows for approximately 87.6 hours of downtime annually. 99.9% availability limits downtime to 8.76 hours annually. 99.99% availability reduces downtime to just 52.56 minutes annually. Key Benefits Realistic Expectations Percentage availability aligns with the way vendors and IT teams measure performance through Service Level Agreements (SLAs), creating a familiar and easily understood standard. It provides a clear, measurable target that can guide both strategic planning and operational decision-making. Holistic Reliability Instead of focusing on isolated recovery times, percentage availability emphasizes sustained operational reliability over time, encouraging a proactive approach to resilience. Executive and Stakeholder Buy-In Availability metrics resonate with leadership and stakeholders by showing how downtime impacts overall performance, enabling better prioritization of resources. Integrating Percentage Availability into Resilience Planning Here’s how percentage availability can be woven into an organization’s resilience planning framework: 1. Setting Availability Targets During the Business Impact Analysis (BIA), identify critical outcomes and assign availability targets based on their importance to the business. For example, a customer-facing application might have a target of 99.9% availability , while an internal HR system might only require 95% availability . 2. Guiding Response Strategies Availability metrics inform recovery priorities by clarifying what needs to be restored first and why. For example: 99.9% targets : Immediate failover systems and round-the-clock monitoring. 95% targets : Lower-cost solutions with longer restoration windows. 3. Enhancing Playbooks Organizational Response Playbooks can be tailored with specific actions to maintain or restore availability, including: Activating backup systems. Engaging third-party vendors. Implementing load balancing to minimize service disruption. 4. Measuring and Refining Post-incident reviews compare actual availability against targets, highlighting areas for improvement. This continuous feedback loop ensures that resilience strategies evolve with the organization’s needs. Real-World Example: A Customer-Facing Application Imagine a company managing a high-traffic e-commerce platform. The application’s availability target is set at 99.9% , allowing for no more than 8.76 hours of downtime annually. Here’s how they planned and executed their resilience strategy: Dependency Mapping : Critical dependencies, including cloud hosting services and third-party payment systems, were identified. Proactive Measures : Load balancing and automated failover systems were implemented to ensure uptime during peak traffic. Response Playbook : Detailed actions included vendor engagement protocols, customer communication plans, and resource allocation for IT teams. Post-Incident Review : After a minor outage, the team discovered inefficiencies in vendor response times, leading to a renegotiation of SLAs and faster escalation processes. The result? The organization consistently met its availability target, maintaining customer trust and avoiding revenue loss. The Future of Resilience Metrics As organizations face increasingly complex disruptions, resilience planning must evolve. Percentage availability metrics offer a practical, forward-thinking alternative to traditional RTOs, emphasizing reliability and aligning resilience efforts with business goals. By shifting to this approach, we can: Set realistic, measurable targets that reflect operational priorities. Enhance stakeholder confidence with clear and relatable metrics. Foster a culture of proactive resilience rather than reactive recovery.  Let’s rethink how we measure resilience and embrace a future where availability isn’t just a goal, it’s a standard.

For years, the concept of Recovery Time Objective (RTO) has been a cornerstone of Business Continuity Planning. From applications to vendors, RTOs have been used as the primary measure of how quickly something must be restored following a disruption. However, I believe we’ve reached a point where RTOs are being overused and, in many cases, misunderstood. It's time to rethink their role and look for more practical alternatives. The Overuse of RTOs RTO is supposed to define the maximum acceptable downtime before a significant impact occurs. But when every aspect of an organization’s continuity plan has its own RTO — application RTOs, vendor RTOs, and even individual process RTOs — things get confusing. Instead of helping teams prioritize recovery efforts, this proliferation often muddies the waters. Additionally, RTO has become a checkbox exercise for many organizations. “What’s your RTO?” gets asked, a number is provided, and the conversation moves on. But do those numbers reflect realistic recovery capabilities? Often, they don’t. The disconnect between theoretical RTOs and operational reality undermines their value. Why RTOs Might Not Matter as Much Anymore Modern business environments have evolved. Today’s organizations rely on highly interconnected systems, third-party vendors, and cloud-based services. With these complexities, assigning a singular RTO often fails to capture the nuances of dependencies, data availability, and realistic recovery timelines. Moreover, the average workday has changed. In many industries, employees are productive for only a fraction of their day, and business operations often tolerate short delays better than expected. The rigid focus on RTO assumes a binary view: either systems are fully operational, or the organization is entirely incapacitated. Reality is far more nuanced. Shifting to “Needed Within” To address these challenges, I’ve shifted to using “Needed Within” for Business Impact Analysis (BIA) data collection. This approach asks a simple, practical question: When do you actually need this to continue operations? By reframing the question, it becomes easier to: Distinguish priorities: Identify what’s truly critical versus what’s merely convenient. Engage stakeholders: Provide language that resonates with business units, avoiding technical jargon like “RTO.” Focus on outcomes: Emphasize practical recovery efforts rather than arbitrary timeframes. Enhancing Application Recovery Metrics For applications, I’ve also started asking, “How often do you need the data backed up?” This shifts the focus to Recovery Point Objective (RPO), ensuring that the frequency of data backups aligns with operational needs. By prioritizing data integrity and availability, organizations can: Reduce the risk of data loss. Align IT and business priorities more effectively. Build recovery strategies that reflect real-world scenarios. The Benefits of Simplification Moving away from the overuse of RTO simplifies continuity planning. When teams focus on “Needed Within” and realistic RPOs, they: Reduce confusion: Clearer metrics help everyone understand priorities. Enhance collaboration: Business units and IT teams work together more effectively. Build confidence: Recovery strategies feel achievable and aligned with organizational capabilities. Final Thoughts RTO served an appropriate purpose in its time, but as organizations grow more complex, it’s becoming less relevant. By adopting practical alternatives like “Needed Within” and focusing on actionable metrics, Business Continuity Planning can evolve to meet modern challenges. It’s not about abandoning RTO entirely; it’s about using it where it makes sense and finding better tools for everything else.

Introduction As this series comes to an end, we’ve explored how business continuity (BC) must evolve to meet the challenges of today’s rapidly changing world. From shifting to a response-driven approach to building a culture of resilience, the insights shared have provided a roadmap for creating a future-focused BC program. But understanding the importance of resilience is only half the battle, executives now need to take action to implement these strategies effectively. In this final blog, we’ll summarize the key takeaways from the series and outline a step-by-step guide for executives to prioritize, implement, and sustain a modern BC strategy that adapts as the organization grows. Key Takeaways from the Series Reposition BC as a Strategic Advantage Business continuity is no longer a back-office function; it’s a strategic priority that safeguards revenue, reputation, and customer trust. Position BC as a key driver of business value, not just a compliance requirement. Shift to a Response-Driven Approach Move beyond recovery-focused planning to embrace a proactive strategy that minimizes disruption in real-time, maintaining operations and protecting stakeholder confidence during crises. Leverage Technology to Enhance Resilience Adopt tools like Microsoft’s Power Platform or third-party solutions to automate workflows, enable real-time insights, and streamline response efforts. Technology empowers organizations to act quickly and effectively in dynamic environments. Foster a Culture of Resilience Resilience must be a shared responsibility across the organization, supported by leadership and integrated into daily operations. Equip teams with training, resources, and opportunities to collaborate, ensuring everyone contributes to continuity efforts. Make Leadership Visible and Engaged Executive involvement is critical for embedding resilience into the organization’s core. Leaders who champion resilience inspire teams, allocate resources strategically, and break down silos for a unified approach. Step-by-Step Guide for Executives to Implement a Future-Focused BC Plan Step 1: Reassess and Realign Your BC Strategy Start by evaluating your current BC plan to identify gaps and areas for improvement. Ensure that it aligns with the organization’s strategic goals and reflects today’s most pressing risks. Conduct a Maturity Assessment: Use tools like the Business Resilience Navigator to evaluate the current state of your BC program across leadership, awareness, structure, and other critical areas. Use the results to develop a roadmap for improvement. Engage Stakeholders: Include input from key departments like IT, Operations, HR, and Communications to ensure the plan addresses cross-functional needs. Step 2: Define Your Priorities Focus on the areas that will deliver the most impact in building resilience. Prioritize initiatives based on their ability to minimize disruption, maintain customer trust, and safeguard critical operations. Key Questions to Consider Which risks pose the greatest threat to your organization’s strategic goals? Where are your current gaps in response capabilities? What resources are needed to address these gaps effectively? Step 3: Invest in Technology Leverage technology to streamline and strengthen your BC efforts without breaking the bank. Tools like Power Apps, Power Automate, and Power BI offer cost-effective, scalable solutions for enhancing operational agility and decision-making. Unlike traditional software solutions (i.e., BC in the Cloud, Everbridge, Fusion), these tools allow you to tailor functionality to your organization’s specific needs at a fraction of the cost and with dramatically quicker implementation. Examples of Technology in Action Use Power Apps to create custom mobile tools for incident reporting and manual data logging during outages, quickly and affordably. Automate communication workflows with Power Automate to ensure employees and stakeholders stay informed during crises, reducing the burden on teams. Monitor resilience metrics in real time using Power BI dashboards, helping leaders make data-driven decisions and adapt quickly during disruptions. The Power Platform’s low-code nature means organizations can deploy these solutions rapidly and affordably, making it an ideal investment for businesses seeking to modernize BC without overspending. Step 4: Build and Empower Cross-Functional Teams Resilience is not, and cannot be, a siloed effort, it requires collaboration across departments. Create cross-functional teams to oversee BC initiatives, ensuring representation from every critical area of the organization. Actionable Tip: Establish regular meetings or workshops where team members can align on their goals, share insights, and update response plans based on evolving risks. Step 5: Foster a Culture of Resilience Embed resilience into the organization’s core values and daily operations. Employees should understand their roles in continuity efforts and feel empowered to act during disruptions. Actionable Tip: Share success stories of how teams have managed past disruptions to reinforce the importance of resilience and inspire future efforts. Train and Engage: Conduct regular training sessions and tabletop exercises to keep teams prepared and confident. Step 6: Monitor, Measure, and Refine Building resilience is a dynamic, continuously developing process that requires continuous effort and adaptation. Continuously evaluate your BC program to ensure it remains effective and adaptable as risks evolve. Key Metrics to Track Response time to critical incidents. Employee engagement in resilience initiatives. Feedback from post-incident reviews and training exercises. Actionable Tip: Use insights from incidents and exercises to refine response protocols and update BC plans regularly. Practical Example: A Roadmap in Action Let’s look at how a mid-size regional bank can implement these steps: The bank begins by conducting a maturity assessment to evaluate its current BC strategy, identifying gaps in its ability to respond to cyber threats and branch-level disruptions. Based on these findings, the bank invests in Power Apps to develop an incident management system comprising a mobile app and a centralized incident management platform. The mobile app allows heads of Cash Services, Facilities, Security, Safety, HR, and regional branch presidents to report on branch-level incidents in real time. The data is instantly collated and displayed in the main incident management app, providing the incident manager with a real-time, comprehensive view of disruptions across the bank’s network. This streamlined system improves decision-making and ensures rapid response coordination. To foster collaboration, the bank forms a cross-functional resilience task force, including representatives from IT, Branch Operations, HR, and Customer Relations. This team meets regularly to align priorities, refine response protocols, and address emerging risks. Leadership integrates resilience into the bank’s core values, tying it to the mission of ensuring customer trust and financial stability, and shares success stories from branches that effectively managed past incidents. Additionally, the bank conducts quarterly tabletop exercises simulating large-scale scenarios like cybersecurity breaches or regional natural disasters. To ensure preparedness at all levels, they also incorporate micro-simulations during random team meetings, focusing on specific scenarios such as handling localized IT outages or effectively managing customer communications during disruptions. These short, targeted exercises help employees gain confidence and refine their roles in the response process. Feedback from the incident management system, tabletop exercises, and micro-simulations is used to improve response plans and update training. Over time, the bank sees reduced response times, increased employee engagement, and stronger customer trust, positioning it as a resilient and reliable financial partner during challenging times. Conclusion Building a modern BC strategy isn’t just about mitigating risks, it’s about creating an organization that can adapt, thrive, and seize opportunities in the face of disruption. By implementing the insights from this series, executives can lead their teams to build a program that not only safeguards continuity but also drives long-term growth and resilience. The path forward is clear – reassess your strategy, prioritize impactful initiatives, invest in the right tools, and cultivate a culture where resilience is second nature. With leadership at the helm and collaboration across teams, your organization will be ready to navigate whatever challenges the future holds. I hope you’ve enjoyed following this series and found the insights valuable for enhancing your business continuity and resilience strategies. If you have any questions, need additional information, or want to explore how these ideas can be tailored to your organization, please don’t hesitate to reach out. I’d love to connect and discuss how we can build a stronger, more resilient future together. Thank you for joining me and I look forward to continuing the conversation.

Building a resilient organization goes beyond having a business continuity plan—it’s about embedding adaptability, collaboration, and proactive thinking into every aspect of operations. In Blog 7 of our series, we explore how leaders can drive this transformation by making resilience a core value, equipping teams with the tools they need, and leading by example. Learn practical steps executives can take to create a culture where resilience becomes part of the organizational fabric, empowering teams to thrive in the face of disruption.