What is truly critical?
A power cut, an unavailable IT application, disrupted communication channels or an inoperable site can have very different impacts on an organisation. The decisive factor is therefore not merely which resource fails, but which services are affected.
This is precisely where a function-oriented understanding of resilience comes into play. A piece of equipment is critical because it is needed to provide a specific service. An IT system may be indispensable because, without its data, a key process would grind to a halt. A building takes on particular significance if essential tasks are managed from there.
The focus is thus first and foremost on the function. What matters is what consequences a failure would have, which other processes depend on it, and what alternatives are available. This shift in perspective fundamentally changes the priorities: from protecting individual assets to safeguarding critical functions.
A single critical point can be enough
Heavy investment in security does not automatically protect against failures. Even well-secured infrastructures can have individual vulnerabilities, the failure of which has far-reaching consequences.
The energy supply sector illustrates this point. If individual components fail, this does not necessarily lead to a widespread supply disruption. What matters is the architecture of the overall system, existing redundancies and the ability to absorb failures.
This presents companies with a key task: they must be aware of their critical dependencies. These include IT systems and technical infrastructure, as well as staff, skills, energy supply, communication channels, service providers and suppliers. Only this overall picture enables meaningful prioritisation. Special protective measures should be implemented where the failure of a resource would jeopardise a critical service.
There is no such thing as 100 per cent security
Organisations must mentally prepare themselves for the fact that not every disruption can be prevented. Modern resilience concepts therefore go beyond prevention. Four capabilities provide a suitable framework: robustness, redundancy, reserves and recoverability. Robust structures can withstand stress. Redundancies create alternatives, reserves provide additional resources for exceptional situations, and recoverability shortens the time taken to restore operations.
This is changing our understanding of security. Prevention remains important, but is supplemented by preparedness and recovery. Ultimately, what matters for organisations is not simply whether a disruption could be prevented. What is crucial is to limit its impact and resume key services as quickly as possible.
When function becomes more important than the object
This concept becomes particularly clear in organisations whose services not only have to continue during a crisis, but are needed more than ever. A power cut, for example, can increase the demand for police services: traffic must be managed, a police presence ensured and the deployment of various units coordinated. Accordingly, it is not enough to protect individual police buildings or technical systems. The necessary functions must remain available even under difficult conditions.
This requires, amongst other things, resilient IT and communications structures, as well as a secure supply of necessary resources. Fallback arrangements ensure that tasks can still be carried out even if the originally intended structures fail. This principle can be applied to businesses. It is not the individual piece of equipment that determines what is critical; what matters is its importance to the delivery of services.
Road traffic also illustrates this approach: not every component of a transport system needs to be available without restriction at all times. The primary priority is to maintain the basic function of road safety. Autonomous control options, clear lines of responsibility, as well as maintenance and rapid fault rectification, support this objective. Functional protection therefore does not mean securing everything equally; it means specifically safeguarding what is crucial.
BCM provides the framework
Business Continuity Management translates the concept of functional protection into a structured approach. The aim is to identify critical business processes and their interdependencies, assess the impact of potential failures, and define appropriate preventive and recovery measures. The Federal Office for Information Security also describes BCM as an approach to identifying time-critical business processes and ensuring their continuity or the fastest possible recovery.
An important foundation for this is the Business Impact Analysis (BIA). It helps to identify and prioritise critical business processes and to assess the impact of disruptions. On this basis, it is possible to determine which processes must be restored particularly quickly and what resources are required to achieve this.
The BSI Standard 200-4, amongst other things, provides guidance on setting up a Business Continuity Management System (BCMS). It is designed as a practical guide to setting up and establishing a BCMS and also takes into account interfaces with information security and crisis management.
This does not mean that traditional physical security loses its importance. Buildings, facilities and IT systems must continue to be adequately secured. However, functional security broadens the perspective: the focus is not merely on the component that might fail, but on the service that is to be delivered despite a disruption.
Plans must become routines
Even the best contingency plan only demonstrates its value when it works under realistic conditions. Regular drills are therefore an essential part of BCM. The Federal Office for Information Security also describes BCM as a continuous process that creates structures for preparing for and responding to unexpected events.
Exercises should not, however, focus solely on technical failure scenarios. The emphasis must be on the impact on critical functions: alert procedures, responsibilities, alternative processes and collaboration with internal and external partners should also be tested.
In this way, vulnerabilities become apparent before they become a problem in an emergency. At the same time, documented procedures give rise to established routines. This can be crucial, particularly when under time pressure.
Not everything has to work, but what matters
The shift from physical to functional protection ultimately also changes the prioritisation of investments. Not every piece of infrastructure requires the same level of protection, not every process needs to be restored to service at the same speed, and not every dependency can be fully safeguarded. Those who understand their own critical functions can deploy resources in a more targeted manner. Robustness, redundancies, reserves and recoverability are then determined by the contribution a system or resource makes to the actual delivery of services.
BCM provides a structured framework for this. However, the benchmark for resilience remains the ability to continue an organisation’s essential services even under difficult conditions. Not everything has to work all the time. But what is crucial must be able to continue functioning.
Outlook: From functional protection to situational awareness
Understanding critical functions and their interdependencies is a key prerequisite for greater resilience. In the event of an incident, a further challenge arises: information must be rapidly collated, analysed and translated into decisions.
This brings another building block of modern resilience into focus: the shared situational picture. In the next instalment of this series, we will examine why this requires more than simply as much data as possible, and what role networking plays in this process.
Further articles in the series
Part 1: What makes Germany more resilient
Part 2: From physical security to functional security: safeguarding critical processes
