Organizational Vs. Operational Resilience: What's The Difference?

• Home
• Disaster recovery facilities and operations

gosphotodesign - Fotolia

• Share this item with your network:

By

• Paul Kirvan

Published: 02 Oct 2019

Resilience has become a prominent element in the business continuity and disaster recovery professions, as well as in the cybersecurity space. Organizational and operational resilience are two areas of IT resilience that your organization will need to consider if it hopes to survive and prosper over time.

Organizational resilience (OR) generally embodies the entire organization, including technology, people, facilities, processes and everything needed to operate the business. If each of these elements is protected from disruptive events, and plans are in place to recover and restore them to normal operation, we could say that organizational resilience has been achieved.

Adaptability is also a part of most OR definitions. Ideally, a resilient organization can bend and flex during a disruptive event and return to normal operations once the event has passed.

What is operational resilience?

Now let's examine operational resilience (OpR), which has been in the shadows of OR and is now a term of growing interest. If you're not familiar with the term, several prominent organizations have described OpR and its role in business continuity and disaster recovery (BC/DR).

Gartner described OpR as "a set of techniques that allow people, processes and informational systems to adapt to changing patterns. It is the ability to alter operations in the face of changing business conditions."

In the standard BS 65000:2014, Guidance on organizational resilience, the British Standards Institution (BSI) refers to operational resilience as: "[the] ability of an organization to anticipate, prepare for, and respond and adapt to incremental change and sudden disruptions in order to survive and prosper."

The International Organization for Standardization also has a standard on organizational resilience, ISO 22316:2017, Security and resilience -- Organizational resilience -- Principles and attributes. This standard defines a framework for organizations to ensure that their business activities can be protected and maintained now and in the future. A key element of the standard is the focus on preparing organizations to better anticipate and respond to potential risks and threats, while also identifying and mitigating vulnerabilities.

How to establish OpR

Operational resilience examines what the business actually does and what it needs to continue performing those activities. This differs from organizational resilience in that OR looks at the entire organization, while OpR is more process-oriented, examining how the business functions and what the organization needs to protect those processes.

What do businesses need to operate today? As with any business initiative, the push for OpR must start at the top. Senior management must be aware of the importance of maintaining OpR and must support initiatives such as the creation of policies, frameworks and structures that support OpR. These then filter down to operational teams to implement programs, controls and procedures to produce products and services.

The BSI presents a model for OpR that makes good sense. It describes OpR as one of three contributors to overall OR. The other two are information resilience and supply chain resilience, as noted in the figure below.

Assuming that all components of an organization's operational structure are functioning properly and are protected from disruptive events, OpR has been established.

When information-related assets such as systems, data, intellectual property and networks are working properly, are secure and protected, and can be safely recovered and returned to service following an interruption, an organization has established information resilience.

Finally, the mechanisms that provide components the organization needs to produce and deliver its products and services to customers must be available and not compromised by internal or external events.

BC/DR, cybersecurity and supply chain initiatives are all essential building blocks for achieving organizational resilience as noted in the above figure. Ideally, each of these initiatives works with the others to minimize the likelihood of disruptive events occurring and maximize the security and survivability of each element.

Along with protecting your organization, achieving organizational and operational resilience can also benefit your company's image. A reputation for organizational resilience can greatly enhance an organization's survival over time, as the firm is more likely to weather disruptions. Organizations that are perceived as being able to stay operational despite disruptive events are likely to be more in-demand, well-positioned and highly competitive within their marketplaces.

Next Steps

Operational resilience frameworks hinge on breaking down silos

Dig Deeper on Disaster recovery facilities and operations

• business continuity

  By: Alexander Gillis

• What is BCDR? Business continuity and disaster recovery guide

  By: John Moore

• CIOs take on organizational adaptability, resilience

  By: John Moore

• 12 business continuity trends to keep an eye on

  By: Paul Kirvan

Part of: Establish operational resilience to avoid disaster

Article 2 of 4 Up Next Operational resilience frameworks hinge on breaking down silos

Resilience is more than just business continuity and disaster recovery. Operational resilience depends on communication among many different business functions at an organization.

Organizational vs. operational resilience: What's the difference?

Achieving both operational and organizational resilience is key to ensuring that a company can protect and adapt its processes and bounce back in the event of a disaster.

Bolster an operational resilience strategy with these tips

What's the first step to achieve operational resilience? Knowing which assets and activities are most critical to the business.

How to establish an operational resilience training program

Collaboration across departments is the new normal to protect business operations. Set up and promote an operational resilience training program with our included printable guide.

Sponsored News

• 4 Key Factors in Securing the Data-First Enterprise—From Edge to Cloud –HPE
• Protect Your Data and Recover From Cyber Attacks –Dell Technologies
• Best Practices: Preparing for the Inevitable Healthcare Cyberattack –Commvault + Microsoft
• See More

Related Content

• Organizational resilience questionnaire for recovery ... – Search Disaster Recovery
• Prepare for the unknown with an organizational ... – Search Disaster Recovery
• Business resilience vs. business continuity: Key ... – Search Disaster Recovery

Latest TechTarget resources

• Data Backup
• Storage
• Security
• CIO

Search Data Backup

• It's time to assess your data backup carbon footprint

  Backups are an unavoidable aspect of IT that can contribute to a larger carbon footprint. Learn more about the environmental ...

• Can Cohesity and Veritas define data protection's future?

  Moving forward, the combined firm's leadership will be under pressure to make good on its long-term vision.

• How to build and maintain a reliable backup infrastructure

  A backup infrastructure is critical to long-term data protection and rapid recoveries. As environments become more complex, ...

Search Storage

• 7 data storage interview questions, answers and tips

  Data storage administrators must be able to adapt and optimize storage for evolving workloads and business needs. Here are some ...

• Compare DIMM vs. SO-DIMM features, uses

  The question of DIMM vs. SO-DIMM yields some clear answers, especially as it relates to size. A proper comparison also considers ...

• HDDs to remain dominant storage footprint in 2025

  HDDs will retain their top storage spot in the new year despite advances in flash, analysts say.

Search Security

• The basics drive 2025 identity security investments

  New identity security tech might steal headlines, but Informa TechTarget's Enterprise Strategy Group analyst Todd Thiemann shows ...

• 2025 cloud-native cybersecurity predictions

  Join Informa TechTarget's Enterprise Strategy Group analyst Melinda Marks as she looks at what 2025 has in store for cloud-native...

• Dozens of Chrome extensions hacked in threat campaign

  Although data security vendor Cyberhaven disclosed that its Chrome extension was compromised on Dec. 24, additional research ...

Search CIO

• Key technical debt reduction strategies CTOs can use

  Suboptimal software fixes cost time and money as well as strain departments throughout the organization. Here's how to develop ...

• 8 factors reshaping the role of the CIO in 2025

  Bring us the money. Heading into 2025, CIOs face increasing pressure to drive revenue, savings and business value from their ...

• Top metaverse platforms in 2025, rise of spatial computing

  The metaverse is evolving, beginning with its rebranding as spatial computing and its expanding impact in the workplace. Here are...

Close