Building a Safe Future: A Strategic Approach to the Resilience Act for Critical Entities | EY

Ultimately, designated businesses will be required to:

1. Conduct risk analysis, consider:

• canning continuity risks and threat assessment (environmental, technological, geopolitical, man-caused and utilities & services)
• Definition of the minimum viable company and identifying critical services (processes and activities);
• Identifying critical dependencies (machines, locations, employees, IT/OT, data, third parties);
• Mapping risks on critical dependencies, current measures, and evaluating remaining risks.
  
  

2. Develop resilience plans and measures, considering:

• Identifying critical dependencies (machines, locations, employees, IT/OT, data, third parties);
• Mapping risks on critical dependencies, current measures, and evaluating remaining risks.

3. Establish incident response and notification protocols.

• Identifying critical dependencies (machines, locations, employees, IT/OT, data, third parties);
• Mapping risks on critical dependencies, current measures, and evaluating remaining risks.

How can I start preparing?

A good first step is to familiarize yourself with national legislation so you can assess whether your company will be designated as a critical entity. If so, it is important to understand the requirements of the WWKE.

Secondly, gain insight into the current maturity of your business continuity management. Then conduct a gap analysis to review and improve your continuity system. However, keep in mind that this is not a one-time exercise but requires continuous effort from your organization. Ensure you gain insight into your resource needs during and after the resilience program.

Just compliance or a strategic advantage?

The WWKE is not just about compliance; it offers companies the opportunity to adopt a strategic approach to resilience. The WWKE can be seen as a tool—instead of the end goal—to evolve organizations from a reactive mindset to those with proactive and adaptive resilience capabilities. Business resilience is both a value-protecting and value-creating investment. By following a strategic approach, companies can:

• Identify and leverage operational efficiencies that enhance resilience.
• Increase external investment willingness in their organization.
• Benefit from disruptions by being better prepared than competitors.
• Foster innovation by integrating resilience into business models and practices.