Regulation as a strategic lever for resilience

Resilience is currently in high demand everywhere and is emerging as a new trend, not just in the field of cyber security. Whilst resilience describes the ability to be robust, withstand disruptions and recover quickly, BCM is the systematic approach to achieving this. It protects organisations from falling into the infamous ‘headless chicken mode’ – that is, reacting to crises in an uncoordinated and haphazard manner.

To promote resilience within organisations, we have developed the RHINO principle. It symbolises resilience; it is robust and resilient, and therefore offers little opportunity for attack.

The principle is based on five pillars (R-H-I-N-O):

• R – Regulation & Compliance
• H – Human Firewall
• I – Intrusion Prevention
• N – Contingency Plans & Crisis Management
• O – Optimisation & Continuous Improvement

The first letter of the Nashorn Principle stands for a key success factor: regulation and compliance. They establish binding guidelines, promote clear structures and make resilience measurable and manageable. Anyone wishing to build a strategic BCM framework cannot ignore them.

Business Continuity Management operates within the complex interplay of numerous standards and legal requirements – at both national and international levels. Organisations, particularly in the public sector or in the field of critical infrastructure, must navigate a complex regulatory framework. This interplay includes, amongst other things:

International standards

• ISO 22301 is the key international standard for Business Continuity Management. It defines the requirements for an effective management system to ensure business continuity. The aim is to ensure that the organisation remains operational even in the event of a crisis – through resilient processes, structures and contingency plans.
• ISO/IEC 27001 complements this focus by setting out requirements for an information security management system (ISMS). After all, without a secure IT infrastructure, true continuity is not possible – IT risks and BCM are closely interlinked.

National standards

• BSI Standard 200-4 from the Federal Office for Information Security is a BCM guide specifically tailored to Germany. It describes a three-stage maturity model for BCM and takes into account both small public authorities and large corporations. Particularly valuable: implementation can be carried out in a modular manner – ideal for the public sector.
• KRITIS requirements (e.g. under Section 8a of the BSIG) apply to operators of critical infrastructure (e.g. energy, healthcare, water, IT, etc.). They are obliged to take appropriate organisational and technical measures to ensure the availability of their services – this requires a BCM as a foundation. Implementation is regularly audited.

Important to note:

Although the national transposition law has not yet come into force, the NIS2 Directive remains binding at EU level. Companies should therefore take a proactive approach and prepare for the upcoming requirements. This includes, in particular:

• Assessing whether the organisation is affected: Determining whether the organisation falls within the scope of the extended NIS2 regulations.
• Implementing security measures: Introducing or adapting information security management systems (ISMS) in accordance with the requirements of NIS2.
• Training and awareness-raising: Staff, particularly those in management positions, should be informed about the new obligations and trained accordingly.

Regulations as a guide

These regulatory frameworks provide the basis for the development and implementation of business continuity management. Anyone who takes resilience seriously cannot ignore regulatory requirements. However, rather than viewing them as a burden, they should be used as a guide and an opportunity. When combined with a clear strategy and genuine leadership responsibility, they result in a resilient organisation – vigilant, robust and capable of taking action. Just like our symbol: the rhinoceros.

In the next article, you’ll read about the role employees play in building and maintaining a resilient organisation.