What Does Operational Resilience Actually Look Like for an SME? 

Operational Resilience can sound like something designed for large banks, critical infrastructure providers or heavily regulated organisations. 

But the underlying question is relevant to every business. 

What does your organisation depend on to keep delivering the services that matter, and what happens when one of those things fails? 

For an SME, the answer might involve a relatively small number of employees, suppliers and technology platforms. 

That does not make those dependencies less important. 

In fact, smaller organisations can sometimes have fewer alternatives available when something goes wrong. 

Effective Operational Resilience starts with understanding those dependencies and putting proportionate arrangements around them. 

Start with the important services 

It is easy to begin resilience planning with individual risks. 

What happens if our internet connection fails? 

What happens if a server goes down? 

What happens if a supplier has an outage? 

Those questions are useful, but there is a more important one to ask first. 

Which services actually matter most to the organisation? 

Which activities need to continue for customers? 

Which services generate revenue? 

Which operations would create the greatest impact if they became unavailable? 

Which functions are essential to employees? 

Once those services are understood, the organisation can begin identifying what they depend on. 

This service-based view helps prevent resilience planning from becoming a long list of disconnected technical risks. 

Understand the dependencies 

Important services rarely depend on one thing. 

They may rely on: 

• Applications and infrastructure 

• Cloud platforms 

• Data 

• Networks and connectivity 

• Suppliers 

• Employees and specialist skills 

• Physical locations 

• Business processes 

• Other internal services 

A customer-facing service might appear to depend primarily on one application. 

But that application may depend on a cloud provider, an identity platform, connectivity, third-party integrations, internal data and employees who understand how to operate it. 

Understanding those relationships creates a much clearer picture of resilience. 

It can also expose dependencies that have previously gone unnoticed. 

Don’t forget suppliers 

SMEs increasingly rely on third parties to provide technology and business services. 

Cloud infrastructure, software platforms, managed services, payroll, communications, cyber security and specialist support may all sit outside the organisation. 

Outsourcing can reduce the need to manage everything internally. 

It does not remove the dependency. 

Organisations should understand which suppliers support important services and what would happen if those suppliers could no longer deliver as expected. 

What service have they committed to provide? 

What happens during an outage? 

How quickly will they respond? 

What contingency arrangements exist? 

Do we have access to our information? 

Could we move to another provider if necessary? 

Who manages the relationship internally? 

Supplier management is therefore an important part of Operational Resilience. 

You can outsource a service. You cannot outsource the impact if that service fails. 

Look for single points of failure 

Some dependencies create greater vulnerability because there is no practical alternative. 

One employee may hold critical knowledge. 

One supplier may support an essential system. 

One internet connection may support an entire location. 

One application may be required for a key business process. 

One administrator may hold access required to recover an important service. 

Not every single point of failure needs an expensive backup solution. 

The appropriate response depends on the potential impact and the organisation’s risk appetite. 

But the organisation should know the dependency exists. 

Visibility allows an informed decision. 

Without visibility, the organisation is simply relying on the dependency continuing to work. 

Business continuity is part of resilience, not the whole of it 

Business continuity plans remain valuable. 

They can establish what should happen when disruption occurs, who needs to respond and how important activities can continue. 

But a document alone does not create resilience. 

Operational Resilience also involves the decisions made before disruption occurs. 

How technology is designed. 

How suppliers are selected and managed. 

How responsibilities are allocated. 

How risks are reviewed. 

How changes are controlled. 

How employees are trained. 

How incidents are analysed. 

How lessons lead to improvement. 

A continuity plan helps an organisation respond. 

Operational Resilience asks whether the organisation has reduced avoidable vulnerabilities in the first place. 

Make ownership clear 

Dependencies need owners. 

If an important service relies on a particular supplier, somebody needs to understand and manage that relationship. 

If a technology risk threatens service delivery, somebody needs responsibility for reviewing it. 

If a continuity action is required, somebody needs to ensure it actually happens. 

Without ownership, resilience can become everybody’s responsibility in theory and nobody’s responsibility in practice. 

Clear ownership does not mean creating a large resilience team. 

For an SME, responsibilities may sit within existing operational, technology, supplier or governance roles. 

What matters is that people understand what they own. 

Think about acceptable disruption 

Not every service needs to be available every second of every day. 

The question is what level of disruption the organisation can realistically tolerate. 

Could the service be unavailable for an hour? 

A day? 

Longer? 

Would customers be affected immediately? 

Would there be financial consequences? 

Would data be lost? 

Would another process work temporarily? 

Understanding impact helps organisations prioritise resilience investment. 

The most important services and dependencies should receive the greatest attention. 

That is more useful than trying to make every part of the organisation equally resilient. 

Learn from what goes wrong 

Incidents provide valuable information. 

A supplier outage may expose an unexpected dependency. 

A recurring system failure may reveal an underlying technology problem. 

A failed change may expose weaknesses in testing or approval. 

An employee absence may highlight concentration of knowledge. 

The immediate priority is understandably restoring normal operations. 

But once the immediate problem is resolved, organisations should ask: 

Why did this happen? 

What did we learn? 

Could it happen again? 

What should change? 

This is where Operational Resilience connects directly with continual improvement. 

A resilient organisation does not simply recover from disruption. 

It learns from it. 

Use governance to keep resilience alive 

Risks and dependencies change. 

New suppliers are introduced. 

Technology is replaced. 

Employees change roles. 

Services evolve. 

AI and automation may create new dependencies. 

An Operational Resilience review completed once and then forgotten will gradually become less useful. 

Resilience therefore needs appropriate governance around it. 

Who owns important services? 

Who reviews risks and dependencies? 

How are supplier changes considered? 

How are incidents reviewed? 

How are actions tracked? 

How does management know whether resilience is improving? 

Recognised standards and frameworks can provide useful structure for these activities. 

But the objective should remain practical. 

Resilience is about understanding what matters 

For SMEs, Operational Resilience does not need to mean trying to prepare for every possible disaster. 

It means understanding: 

Which services matter. 

What they depend on. 

Where important risks exist. 

Who owns those risks and dependencies. 

What happens when disruption occurs. 

What needs to improve. 

A business continuity plan tells you what to do when something goes wrong. 

Operational Resilience helps you understand what could go wrong, why it matters and how prepared you really are. 

If you are reviewing your Operational Resilience ahead of 2027, talk to KA2.