Shifting your cultural mindset to drive resiliency and efficiency

By Simon Cox, Chief Transformation Officer, ServiceNow

Abstract: As organizations look to get more value from their operations in an environment of on-going uncertainty, the question of efficiency vs. resilience continues to plague leaders. This article will explore the changes that need to occur in culture, communication, and how everyone approaches resilience within an organization.    

As organizations look to get more value from their operations in an environment of ongoing uncertainty, the question of efficiency vs. resilience continues to plague leaders. How do you manage enterprise resiliency when budgets are being slashed?  How do you continue to deliver value? 

I believe you can do both: improve operational efficiency and the customer and employee experience as part of your resiliency effort.  It’s not an either/or choice.  It requires an organization to examine their resiliency program in three areas: data-driven action, cultural DNA, and expected outcomes. 

Changing views of resiliency

Traditionally, organizations have thought of security and resiliency as being cost centers rather than areas that can deliver a return on investment. 

Resiliency decisions were thought of in terms of costs. Do we need a full-scale disaster recovery site? What is a cost-effective solution for business continuity? Where can we compromise to meet budgets? The pandemic was a wake-up call about the importance of resiliency. Many businesses found that when a major incident occurred, their business continuity site didn’t always deliver as expected.  

Lately, expectations are shifting again as regulators, organizations, and board of directors recognize that erecting an impenetrable shell of security just isn’t realistic. Organizations are acknowledging that incidents do happen, whether it is a hardware failure or cyberattack, and the focus should be on maintaining a great customer experience when that occurs. 

This new perspective requires a different approach: writing playbooks to mitigate the impact on customer service, including instructing employees how to continue to deliver services. 

With playbooks, every team knows what to expect and how to respond. The team organizes an incident scenario, tests the fallback providers and network backup, then drafts what they learned into an action plan. It’s no longer about passing a penetration test once a year or solving issues on the go.

Taking it one step further, organizations are seeing resiliency plans to keep the customer front and center when an incident occurs and using resiliency tests as opportunities to improve efficiency, and, in some cases, increase profitability. Customers are often more loyal to businesses that acknowledge the incident and try their best to deliver a great experience. 

Here’s the secret. There is a big difference between viewing incidents as security failures to be avoided or as incidents that a resiliency plan can help an organization recover and move on. You may still need to abide by regulatory requirements and file paperwork, but operations don’t need to stop. In the ideal scenario, customers don’t even know there was an incident. 

Data-driven action

The most resilient organizations are those that rely on data to gain an objective view of what playbook scenarios they need to develop.  Data can drive this prioritization and help the team understand the impact of events and how often they occur. Organizations that are data driven become objective as opposed to subjective about resiliency investments.  For example, Danske Bank consolidated security data and processes in one environment and linked security processes to operation processes to enable a better cross-organizational collaboration.

Technology exists to help orgs analyze and correlate data from a central source and provide insights into next actions. Data can be shared broadly to provide real-time insights daily, weekly, monthly, quarterly. When people throughout an org access a central source for risk data, they begin to trust it.  Data becomes the heartbeat of an organization. 

Data sharing is not without its challenges. Trying to find the signal within the noise of the data points is important. Take the time to learn and address false alerts that may drive off-the-cuff decisions. When an org can use data to make decisions, major incidents move from being a technical problem to an opportunity for increasing efficiency and improving the customer experience. 

Here’s an example. A risk management officer prepares a risk presentation for the board. By the time the data is analyzed and presented, it’s lagging data. Too much time has passed since the event occurred for it to be meaningful for decision-making. The opportunities to drive real change have passed. Near real-time, trusted data gives the board and risk teams confidence to make more informed decisions about the future.  When data becomes the centerpiece of decision-making, an org will see a cultural shift. 

Organizational DNA

Getting all your stakeholders–from audit to IT to the board–to recognize that resiliency can drive an even better return on investment is not something that happens overnight. 

Once data becomes the heartbeat of an organization, stakeholders across the enterprise recognize the power of data to drive more informed decisions.  Now the org is on its way to making resiliency core to the organizational DNA. It’s no longer a separate tower, work stream, or investment column. One team can’t invest in a solution in response to vulnerabilities they see because they are no longer siloed. The board can’t make a knee-jerk response based on an incident with a competitor.

When a resilient mindset is holistically built into an organization from the top-down and bottom-up, the org is in control, proactively managing an incident response to a predefined outcome that improves its operations for the future. 

With the power of social media to burnish or hurt brands, the importance of resiliency planning increases. Customer expectations and tolerance of failure and resilience have dramatically decreased. So, organizations that deal with incidents quickly and transparently gain customer loyalty and retention. When an incident is dealt with badly, an org will often lose customers. Having a backup plan is critical so that the customer doesn’t want to move to a competitor.  

Embracing risk as opportunity

Resiliency is most successful when it’s woven into an organization’s DNA. Resiliency planning based on data is the key to understanding what risks are most prevalent and how to deliver a predefined outcome to your customers, employees, and shareholders. You don’t need a failover for everything. Instead, scope your resiliency investment to an outcome that the culture of your org can embrace. Then grow the program from there.

Any org can be efficient and resilient.  You can say yes to both at the same time.