What failing systems really look like
The EU Omnibus3 also brings greater clarity on how modern systems actually fail. Disruption rarely remains contained. It cascades across platforms, suppliers, data flows and decision‑making structures. Resilience, therefore, cannot sit alongside compliance. It has to be embedded into the system itself.
The implications and the urgency are now being felt inside organisations. Many remain highly capable of managing cybersecurity risk and meeting regulatory obligations. Far fewer can confidently demonstrate that their systems can endure prolonged or compounding disruption.
Resilience does not automatically follow from controls, policies or audit outcomes. It becomes visible in how architectures degrade, how operating models absorb shock, and how decision‑making continues when information is incomplete.
Never assume resilience
Engineering for resilience means testing it. When failure means consequences, infrastructure has to stress-tested before it is commissioned. In business, financial models are stress-tested and safety systems are exercised long in advance of threats. Digital and operational resilience now have to meet the same high standards.
For cyber services, protection remains essential, but it is not sufficient on its own. Organisations must test critical systems, simulate failure scenarios, validate recovery paths and observe system behaviour under pressure. Leadership teams need evidence that they can rely on their systems as conditions deteriorate. While assets must always be defended, the overriding priority is increasingly clear: operations must be sustained.
Defining the minimum viable company
If resilience must be engineered, tested and proven in practice, it also has to be clearly defined. As resilience becomes both an engineering discipline and a governance responsibility, boards are increasingly being judged against a more fundamental question: what is the minimum version of this organisation that must continue to function under sustained disruption?
The concept of a “minimum viable company” diverts the focus away from abstract assurance and towards operational reality. It requires leaders to identify the services, capabilities, decision‑making structures and controls that are essential to maintaining trust, legal standing and strategic control when conditions deteriorate. Rather than assuming resilience exists, the MVC forces organisations to be explicit about what must endure and why.
This means boards must be able to answer a small number of difficult questions with evidence rather than assumption:
- Which products, services and operational capabilities must continue for the organisation to remain viable and credible?
- How have those critical elements been stress‑tested under realistic failure conditions, rather than theoretical scenarios?
- Which digital and physical dependencies would most quickly undermine viability if they failed, and how are those risks mitigated?
- Where do critical decision rights sit if disruption is prolonged, automation behaves unpredictably or information is incomplete?
- What real‑time evidence would the board have that the organisation remains viable while operating under sustained pressure?
These are governance questions that go to the heart of how an organisation is run. Boards that cannot answer them clearly are exposed when disruption becomes visible and stakeholders expect steady, confident leadership.
When organisations define and protect their minimum viable company, they do more than safeguard themselves. They strengthen the resilience of the wider systems and ecosystems in which they operate.
Resilience as infrastructure
Across Europe, resilience is increasingly being recognised as a form of infrastructure in its own right. Like energy or transport systems, it must be deliberately designed to operate reliably, to degrade safely under stress, and to recover predictably after disruption. When it functions well, it is largely invisible. However, when it fails, the consequences are immediate and far‑reaching.
In Ireland, this perspective reinforces the emergence of a resilient‑nation approach. Digital trust, operational continuity and system endurance are becoming foundational to economic growth, public confidence and national competitiveness. Public investment programmes, regulatory convergence and the direction of private capital are already aligning around this change.
The organisations that succeed will be those that retain control as pressures converge. Engineering resilience into systems and demonstrating that resilience through testing and evidence is no longer optional. It is now a defining responsibility of leadership.
