Resilience Is Not an IT Issue
In many organizations, the CISO is the most visible authority on resilience. That is structurally explainable. But it is not the same as a complete perspective on vulnerability, adaptability, and strategic capability.
The Structural Shift
In many organizations today, resilience is primarily viewed through the lens of cybersecurity. Business continuity, crisis management, operational recovery: these are increasingly shaped by IT security logic. Not because it is the most comprehensive perspective, but because it is the most established.
There are structural reasons for this. Cybersecurity developed in a global, English-speaking ecosystem with few legacy constraints. It produced frameworks, metrics, certifications, and regulatory momentum. It addressed measurable risks with standardized solutions — and positioned itself close to the board.
What This Leaves Invisible
Other security domains — physical, organizational, procedural — remained fragmented, less formalized, and harder to quantify. They often operate outside the strategic core. Their influence on the overall understanding of resilience is limited as a result.
This creates an asymmetry. Because digital risks are more visible and auditable, they dominate the resilience narrative. Other dimensions — leadership culture, systemic interdependence, the capacity to navigate uncertainty — are frequently underrepresented.
What This Means for Leaders
Leadership in times of uncertainty and overlapping crises requires more than recovery plans and security dashboards for IT services.
Understanding how resilience is framed within an organization, and whose logic defines it, is not merely a technical consideration. It is a question of governance and leadership responsibility.
Resilience belongs at the executive level — not as an IT subcategory, but as a guiding principle for navigating complexity.
Quotable
“Cybersecurity is not the same as resilience. It is one dimension of it.”
“Because digital risks are more visible, they dominate the resilience narrative. That is not a complete perspective.”
“Resilience belongs at the executive level — not as an IT subcategory, but as a guiding leadership principle.”
→ How Rico Kerstan treats resilience as a leadership topic: Services → The conceptual model: Approach