Are we ready? 3 questions boards should be asking about resilience

The widespread blackout that recently affected parts of Spain, Portugal, and southern France serves as a stark reminder of how vulnerable critical infrastructure can be–even in well-developed regions. Power grid failures halted transport, disrupted services, and exposed the fragility of digital systems that most enterprises assume will “just work.”

These events aren’t rare though. Cyberattacks, extreme weather, supply chain failures, regional political instability and even sabotage all cause widespread disruption without warning. For corporate board directors, understanding their organization’s true resilience is no longer optional, especially given so many mission-critical applications now rely on cloud infrastructure. Here are three questions directors should be asking their IT and cybersecurity executives–and what robust answers should look like.

Is our IT infrastructure truly resilient–or just redundant?

Redundancy alone is not enough. Having backup systems that operate in the same region as your primary infrastructure may meet compliance standards, but it won’t prevent disruption when large-scale, localized failures occur.

True resilience means geographic diversity–not just across cities, but across regions or even national borders. It means working with cloud and data center providers that offer physically separated infrastructure with independent power sources, network carriers, and operational protocols. Organizations must also ensure that those providers maintain sufficient backup power capacity, including fuel contracts with guaranteed replenishment and priority access during crises.

To demonstrate resilience, companies must be able to withstand a regional outage without material impact on operations. Scenario planning for how outages of one hour, one day, and one week might affect operations in different locations will yield valuable information and may identify gaps to be addressed.

Are our continuity plans built to survive local failure–or only to satisfy compliance?

Too many business continuity plans are designed to pass audits, not to endure real-world disruptions. This becomes painfully obvious during major outages, when delays in detection, reliance on under-tested failovers, or assumptions about the speed of recovery turn inconvenience into crisis.

A resilient organization should be able to detect disruptions immediately, respond quickly, and operate–at worst–at a reduced, but functional capacity until full restoration is achieved. That requires integrated visibility across environments, not just for infrastructure teams, but also for executives who must have direct access to incident awareness and status.

Crucially, bringing systems back online is not instantaneous. After a sudden outage, bringing systems back online safely can be a drawn-out process, especially when hundreds or thousands of systems are involved.

To demonstrate real continuity readiness, management must show that critical services can continue functioning even when local infrastructure, providers, or applications become unavailable and that recovery plans have been proven under pressure, not just simulated on paper.

Do we know how our cloud providers will perform when everything goes wrong?

Enterprise IT resilience increasingly relies on third-party vendors and service providers, which means management must understand their resilience too. Resilience must be treated as a key selection criterion–not an afterthought. It should factor into vendor onboarding, procurement decisions, and ongoing risk assessment. SLAs alone are insufficient: they don’t tell you what happens when the power goes out and doesn’t come back for 24 hours.

Does the provider own all of their infrastructure? Does the provider have multiple locations over a wider geographic area? How long can the provider operate if they have a catastrophic event or power outage? What additional dependencies do they have to maintain service? Uptime statistics only tell part of the story.

Providers that have clearly prioritized reliability (and for that matter, security) over features are likely better positioned to weather a storm. And while resilience often comes with a higher price tag, it can be a price worth paying to avoid periods of disruption, lost business, and potential reputational damage.

The bottom line

The bottom line for boards is that resilience isn’t about bouncing back. It’s about taking strategic preemptive steps so the requirement to bounce back is minimized. Organizations must show they’ve planned, tested, and invested in surviving the unexpected because although we don’t know where, when, or how, we do know the next major outage is coming.

To learn more, visit us here.