The board’s role in establishing effective digital resilience

The inevitability of cyberattacks and information technology outages has reframed organizational resiliency discussions—shifting them from prevention to mitigation of financial, operational and reputational impact, with a focus on business continuity and rapid recovery. These are key components of enterprise risk management and resilience.

However, digital risk represents only one of many types of risk that enterprises must address to achieve resilience.  Governance through an enterprise-as-a-system (EAS) approach can not only help your organization deal with digital risk—which can be less than intuitive—but also help contextualize other enterprise risks to drive your organization’s resilience strategy.

In previous articles we emphasized the importance of boards and management teams arriving at a shared holistic understanding of their business as an EAS. This is essential to governing and managing digital opportunities and risks to your business, both of which are expanding exponentially with the advent of artificial intelligence.

The EAS consists of interconnected elements (applications, servers, databases, hosted solutions) and networks, including the people who operate them, that support every organization. It defines your business from a cybersecurity perspective. Embracing the educational, organizational and cultural elements of EAS provides boards and senior executives with a holistic view of cyber risk and digital opportunity, a perspective essential to keep pace with the rapidly evolving digital landscape, strengthen business systems and minimize potential damage. Building resilience is foundational for your enterprise, but resilience to cyberattacks cannot be easily bolted onto weak or misunderstood business systems.

Rethinking digital risk: From defense to resilience

For years, organizations approached digital risk and cybersecurity with a fortress mentality: Build thicker walls and tighter perimeters and hope intruders stay out. That model is no longer sufficient. As AI accelerates the pace and sophistication of threats, businesses must shift from prevention to preparation and recovery. Cyber resilience is about minimizing damage, maintaining operational continuity and recovering quickly.

Compare your business to a warship. Business enterprises have evolved over the past several decades by converting manual processes into digital ones on top of internet technology designed without security in mind. On the other hand, warships are designed and built from the ground up to be resilient to threats, whether internal or external. In addition to having strong hulls, warships are compartmentalized to isolate damage. Critical assets are segmented and accessed on a need-to-know basis only. Crews envision threats and develop and practice procedures to recover from potential damage.

How does your EAS compare?

Because early cyberthreats were primarily from external actors, EAS protections were developed based on a perimeter/bastion mentality designed to protect vulnerable systems against intruders. This is like building a thicker hull on a warship while paying little attention to the potential spread of damage to compartments within. Critical assets remain unidentified and EAS choke points for business continuity are often misunderstood. Business continuity procedures (if written) do not support enterprise risk activities or coordinate with other risk disciplines, do not reflect the current business and technology environments, and are insufficiently practiced. Strong EAS “hulls” are an essential element of EAS protection and support business resilience, but alone are insufficient to mitigate damage from inevitable cyberattacks.

Fortunately, business leaders are signaling a new cybersecurity approach under the heading of resilience, one which recognizes the inevitability of damage and the impracticability of redesigning and overhauling the EAS given its complexity and the disruption it would involve.

Resilience from cyber incidents is a paradigm shift from perimeter protection thinking. It assumes cyberthreats can come from anywhere, inside or outside the EAS. However, resilience against cyberthreats or any other disruptions is not a capability easily bolted onto today’s enterprises. Instead, “warship-like” resilience requires board and executive support and governance, planning for all hazards (not just cyber), and program-level ownership.

Business leaders are encouraged to begin this journey today to begin to address the rapidly evolving threat landscape.

Zero trust: The foundation of digital resilience

The linchpin of digital risk resilience is “zero trust,” a security model based on the principles of "never trusting, always verifying," limiting access, and frequently practicing incident responses. Unlike traditional models that assume users and devices inside the EAS are trustworthy, zero trust assumes that no access or interaction, whether inside or outside the organization, is trusted. This approach encompasses all security layers, including identity, data, end points, applications and the network.

Zero-trust principles include:

1. Granting EAS access strictly on a “need-to-access, least privileged” basis, coupled with strong, continuous user authentication (not just at the perimeter)
2. Leveraging monitoring tools to detect anomalous activity and user behavior
3. Segmenting networks into small (even micro) elements that can be isolated to prevent the spread of cyber incidents
4. Ensuring data, applications and all devices (end points) accessing the EAS are secure and trustworthy
5. Implementing ongoing security improvements to the EAS, particularly as it changes with the addition of new digital systems and removal of existing ones
6. Developing and practicing business continuity and incident response policies and procedures with clear lines of authority and responsibilities

Implementing zero trust is a long-term process that should proceed at a pace the board and management team can manage with minimum disruption. Legacy systems and communication networks will have to be modified with new systems and controls. In addition, employees will be burdened with extra steps to access the EAS and have limited access to data and workflows. All EAS stakeholders will need to be trained to understand the importance of zero trust to EAS protection and resilience. Boards should establish measurable milestones for achieving digital risk resilience—such as full zero-trust implementation within three to five years—while ensuring iterative improvements are made along the way.

Board and management actions to create a resilient EAS

Transforming leadership for a resilient digital future

Just as boards have developed fluency in financial oversight, they must now do the same with digital risk. Building business resilience requires more than strong defenses—it demands proactive leadership, strategic investment and cultural change.

By embedding digital risk into your enterprise resilience strategy, you not only protect your business and increase agility amid evolving threats but also position it to thrive in an era when cyberthreats are persistent and the only constant is change.