Resilience as a Holistic System

Organisational resilience does not stem from a single discipline but from the interplay of management systems, leadership, and culture. This foundational article introduces the NOVELEDGE Impact Model: how management systems influence resilience, how resilience supports an organisation’s performance, and why the benefits must ultimately be determined individually for each organisation. All further specialist articles use the model as building blocks and demonstrate where they apply.

Christian Horres

Expert in Business Continuity Management (BCM), risk management, and organisational resilience, particularly in the context of critical infrastructures. His focus is on Business Impact Analyses (BIA), risk analyses, and the development and enhancement of BCM and crisis management structures. Within the NOVELEDGE network, he supports organisations in the practical implementation of resilient structures, considering international standards such as ISO 22301, ISO 27001, and ISO 31000, as well as applicable regulations.

The Impact Model

How management systems contribute to benefits through resilience

Resilience is not an end in itself. It is intended to ensure that an organisation can deliver its performance and achieve its goals even under disruptions. The NOVELEDGE Impact Model arranges the relationships into four stations and three bridges. It serves as the common reference framework for all specialist articles: each building block article displays the same graphic and highlights where it applies.

Four Stations

From discipline to benefit

• 1 Management Systems. Business Continuity Management is a management system that secures prioritised activities and services.^[1] Additionally, risk management, information and cyber security, physical security, emergency and crisis management, supply chain management, compliance, sustainability, as well as quality, occupational and environmental protection, influence resilience. In the model, we understand BCM as the capability through which selected resilience abilities are systematically developed, coordinated, and reviewed.
• 2 Organisational Resilience. ISO 22316 describes it as an organisation’s ability to absorb and adapt to changes.^[2] The model distinguishes four dimensions: anticipate disruptions, absorb their impact, recover performance, and adapt to changed conditions – aligned with the goals of cyber resilience according to NIST: anticipate, withstand, recover, and adapt.^[3] Empirical studies on BCM have so far mostly worked with two dimensions: planned and adaptive resilience.^[4]
• 3 Business Performance. Resilience affects financial performance, such as profit, liquidity, and revenue, and non-financial performance, such as customer satisfaction, delivery capability, and reputation.
• 4 Economic Benefit. What counts as a benefit is not universally defined. For a publicly listed company, corporate value and dividends are paramount, for a family business, continuity and independence, for an operator of critical infrastructure, supply security with economic viability. Therefore, this aspect must be defined individually for each organisation – depending on organisational form, ownership, and mission. Only then does it become clear which performance is the focus and what the resilience must be directed towards.

Three Bridges

How the impact is created and verified

A Maturity Level. Whether a management system is effective depends on how developed it is. Systemically, the maturity level of a BCMS can be described in five stages, as used by the BSI for the compliance audit of critical infrastructures: planned, controlled, established, measurable, and continuously improved.^[5] Operationally, effectiveness counts – for example, whether recovery times are actually adhered to in exercises and real incidents. A formally high maturity level is not automatically effective.

B Context Model. Which discipline contributes what to which resilience dimension has so far hardly been systematically documented. The effect matrix makes this question visible; its fields are gradually filled with the building blocks of this series and with new findings.

It is also unclear how the contributions interact. In the Contribution Model, each discipline contributes directly and alongside each other to resilience; BCM is one discipline among several. In the Orchestration Model, BCM bundles the contributions of other disciplines, aligns them with prioritised services and timeframes, and reviews them. Which model better describes practice, and where disciplines overlap, is a central question of this series.

C Target Image. The final bridge connects performance and benefit. It defines which performance counts for the organisation and how much disruption it can economically withstand. How robust financial thresholds can be derived from this is shown in the contributions From Geopolitical Risk to Financial Resilience and Financial Impact in the Business Impact Analysis.

What Research Shows So Far

Initial evidence for the impact chain

There are initial empirical indications for the chain from BCM through resilience to performance, especially from tourism:

• A systematic literature review derives a model that connects BCM practices through planned and adaptive resilience with the performance of small and medium-sized enterprises.^[4]
• A survey of 331 tour operators shows that organisational preparation and the integration of continuity practices into everyday life are related to financial and non-financial performance.^[6]
• A follow-up study with 140 tour operators in Central Java examines the chain through resilience. The strongest driver is the integration of continuity practices: it is significantly related to planned resilience (β = 0.611) and adaptive resilience (β = 0.535); planned resilience, in turn, is related to financial performance (β = 0.555). Management support, external requirements, and preparation showed no significant influence in this sample.^[7]

For classification purposes: The studies originate from a specific industry and region and are based on surveys conducted at a particular time. They demonstrate correlations, not cause-and-effect relationships, and sometimes yield different results. Whether the findings can be transferred from two to the four resilience dimensions and what role the other management systems play remains open. However, a trend is noticeable: it is not the existence of a BCM that makes the difference, but how firmly it is anchored in everyday life.

The Building Blocks of This Series

Where the expert articles fit into the model

The following chapters describe the foundations on which the model is built: the resilience principles, the interplay of disciplines, the process from event to recovery, and the pillars of organisational resilience.

The Resilience Principles

Organisational resilience does not arise from a single discipline but from the coordinated interplay of leadership, culture, information, resources, integrated management disciplines, and a continuous improvement and evaluation cycle. ISO 22316^[2] provides the normative framework for this; ISO 22301^[8], ISO/IEC 27031, BS 65000, NIST^[3] SP 800-160 Vol. 2, and ENISA complement it with specific guidelines and testing/evaluation approaches.

1. Coordinated Approach Across Disciplines
   Resilience demands the alignment and coordination of BCM, RM, ISMS, crisis management, change/project management, etc. (ISO 22316, 4.2; 5.8).
   The goal: cross-disciplinary coherence instead of silos.
   Practical Anchor: BS 65000 emphasizes precisely this integration at a strategic level; it is a guiding standard for organizational resilience.
   
   
2. Shared Vision & Clarity of Objectives
   A clear, shared direction forms the basis for making decisions in the spirit of resilience (ISO 22316, 5.2).
   Practical Anchor: ISO 22301 integrates objectives into the management system (Chapter 6.2) and links them with measurement/review (Chapter 9).
   
   
3. Understanding & Actively Influencing Context
   Resilient organizations understand their context (internal/external dependencies, stakeholders) and shape it (ISO 22316, 5.3; Introduction).
   Practical Anchor: ISO 22301 Chapter 4 (Context) and references to ISO 31000^[9]/IEC 31010 build the risk bridge.
   
   
4. Effective, Enabling Leadership
   Leadership prioritizes resilience, provides resources, and anchors responsibilities (ISO 22316, 5.4).
   Practical Anchor: ISO 22301 Chapter 5 (Leadership) makes leadership responsibility and policy binding.
   
   
5. Resilience-Promoting Culture
   Culture as a breeding ground: learning, reporting, and error culture as well as decision-making ability under uncertainty (ISO 22316, 5.5).
   Practical Anchor: Hollnagel’s four potentials – Monitoring, Anticipating, Responding, Learning, operationalize culture in behavior.
   
   
6. Shared Information & Knowledge
   Information flow and knowledge management are central (ISO 22316, 5.6).
   Practical Anchor: ISO 22301 Chapter 7.4/7.5 (Communication/Documentation) and 8.4.3 (Warning/Communication) integrate communication into plans and exercises.
   
   
7. Availability & Adaptability of Resources
   Keep resources (people, locations, ICT, supply chain) available, scalable, and redirectable (ISO 22316, 5.7).
   Practical Anchor: ISO/IEC 27031 provides the framework for ICT Readiness in terms of BC objectives (RTO/RPO, DR capabilities).
   
   
8. Continuous Improvement
   Resilience arises from measurement, evaluation, corrective actions (ISO 22316, 5.9; 6.1–6.4).
   Practical Anchor: ISO 22301 Chapter 8.5 (Exercise Program), 8.6 (Evaluation), 9 (Performance Evaluation), 10 (Improvement) – PDCA mapped to resilience.
   
   
9. Anticipating & Managing Change
   Proactively anticipate, buffer, adapt (ISO 22316, 5.10).
   Practical Anchor: NIST SP 800-160 Vol. 2 explicitly describes cyber resilience as Anticipate – Withstand – Recover – Adapt (system engineering approach, transferable to OT/IT landscapes).

Practical Deep Dives and Test/Evaluation Bridge

• Testing & Exercising as a Resilience Engine:
  ISO 22301 requires a programmatic exercise/review regime with reports and actions (8.5, 8.6; PDCA 9–10). This makes resilience principles measurable and verifiable (RTA ↔ RTO, roles/communication, supply chain).
  
  
• Concretizing ICT Readiness: 
  ISO/IEC 27031 translates target times and dependencies into IRBC capabilities* (monitoring, restart, failover/DR, exercise types).
  
  *ICT Readiness for Business Continuity – the readiness/capability of information and communication technology (ICT) to support business continuity (ISO/IEC 27031).
  
  
• Operationalizing Cyber Resilience: 
  NIST 800-160 Vol. 2 provides construct catalogs (e.g., Deception, Diversity, Segmentation, Redundancy, Analytics) and architecture patterns for implementing the four capabilities.
  
  
• Sectoral Stress Tests: 
  European Network and Information Security Agency (ENISA) Handbook for Cyber Stress Tests (2025)* describes supervisory resilience stress tests (including under NIS2^[10]/CER/DORA^[11]) – useful as a blueprint for organization-wide resilience assessments (dependencies, systemic, restart capability).
  
  *Guide by the EU Agency for Cybersecurity (ENISA), describing how authorities can systematically plan and conduct „cyber stress tests“ for critical sectors.
  
  
• Strategic Framework: BS 65000 (Guidance) supports the „whole system“ perspective and refers to integration, maturity, and evaluation; despite being „withdrawn,“ it remains widely used as a reference framework.
  

A Collaboration of Business Continuity, Risk Management and Information Security

Resilience is far more than just a buzzword. For organisations – whether industrial companies, critical infrastructures, or small and medium-sized enterprises – resilience means the ability not only to withstand disruptions and crises but to emerge stronger from them. It is crucial that resilience is not considered in isolation within individual departments but as a comprehensive system that integrates existing structures, processes, and methods.

A central foundation for this consideration is formed by Business Continuity Management (BCM), Risk Management, and Information Security. These systems interlock, among other things, when they are connected through an analysis.

The Process Perspective

From MTPD to RTO

Every resilient approach begins with the processes. Within the framework of a Business Impact Analysis (BIA), they initially receive a Maximum Tolerable Period of Disruption (MTPD) – the maximum downtime that must not be exceeded without existential damage threatening.

From this MTPD, the Recovery Time Objective (RTO) is derived: the targeted recovery time that ensures the MTPD is not exceeded.

Resources and Their Recovery

Focus on RTA

To restore the processes within the RTO, the necessary resources must be identified: IT systems, facilities, buildings, personnel, or even external service providers. For each resource, a Recovery Time Actual (RTA) is determined, i.e., the actual recovery time.

This is where the first critical comparison lies:

• RTA vs. RTO – Can the resource be restored quickly enough to make the process available within the required time?
  
  
• RTA vs. MTPD – Is the maximum tolerable downtime adhered to overall?

This comparison is the central check in the model: Only if process times (MTPD/RTO) and resource times (RTA) are compatible is resilience ensured.

Risk Assessment

Secure

It is not enough to rely solely on the temporal comparison. A risk assessment of the resources is required: What threats endanger their availability? What probability of occurrence and potential damage are conceivable? This is where risk management comes in and defines measures to secure the resources. This aspect is described in the model with the term Secure.

Information Security

CIA Level and Protection Needs Analysis

Resources often contain information objects whose protection needs must be assessed separately. Information security introduces the protection needs analysis, which is oriented towards the CIA criteria:

• Confidentiality
• Integrity
• Availability

Particularly, Availability is closely linked to the previously determined RTO values. Information objects – and thus the resources that carry them – must be available within the MTPD or RTO. Otherwise, a direct gap in resilience arises.

Resilience as a Cross-Sectional Task

The interplay of BCM, risk management, and information security illustrates: Resilience is not a standalone discipline. Only when all elements are viewed in an integrated manner does a consistent picture emerge:

1. Processes define MTPD and RTO.
2. Resources are identified and assessed in terms of their RTA.
3. Risks of the resources are evaluated and mitigated.
4. Information objects receive their protection needs analysis with CIA classification, where Availability is directly linked to RTO/MTPD.
5. In the Check, all parameters are aligned to ensure consistency and feasibility.

This creates a system that not only reacts to crises but also proactively identifies and integratively secures vulnerabilities.

From Theory to Implementation

Whether industrial companies, operators of critical infrastructures, or medium-sized enterprises: Resilience requires thinking in terms of dependencies and interfaces. The model outlined here demonstrates that business continuity, risk management, and information security are not competing systems but components of a common architecture.

The visualisation – from the process through the resource to the information object and the final risk and time assessment – makes it clear: Resilience is a comprehensive system that operates in its interconnection. Those who manage to systematically integrate these systems lay the foundation for an organisation that is not only resilient but also future-proof.

Resilience Community and Standards as a Framework for Orientation

The so-called Resilience Community today offers a multitude of orientations: international standards such as ISO 22301 (Business Continuity Management), ISO/IEC 27001^[12] (Information Security) or ISO 22316 (Organizational Resilience), industry-specific standards like NIS 2, national guidelines like the BSI-Standards 200-4 or regulatory requirements such as the KRITIS-Dachgesetz^[13]. This diversity highlights the high relevance of the topic but also carries the risk of fragmented implementation if organisations only consider individual requirements in isolation. Therefore, a tailored approach that is customised to the respective organisation is crucial. Only when the systems are holistically aligned does a resilience concept emerge that not only fulfils individual standards but also, in the sense of a comprehensive system, considers and integrates the requirements from other relevant management systems. This way, it is possible to meet the different regulations and simultaneously build a resilience system that is consciously designed to suit the organisation.

From Incident to Recovery

The Interplay of BCM, Emergency, and Crisis Management

An incident rarely arises out of nowhere. Between preparation, acute response, and subsequent recovery lies a clearly structured process in which Business Continuity Management (BCM), emergency management, and crisis management each take on different but interlocking roles.

Before the Incident

Preparation through Business Continuity Management

BCM ensures that organisations are prepared for potential disruptions during the Preparation Phase. This includes conducting Business Impact Analyses (BIA), identifying time-critical processes, and defining recovery objectives (RTO/MTPD).

The goal is to prepare structures, strategies, and processes so that in an emergency, a rapid response can be made and the recovery time is kept as short as possible – ideally below the tolerable level of disruption.

In other words, BCM lays the foundation to prevent disruptions from becoming crises.

Upon Event Occurrence

Role of Emergency Management

When an event occurs, emergency management takes precedence. It implements immediate measures for hazard prevention and stabilisation of the situation. This includes evacuations, technical security measures, or initial communication steps. Emergency management acts operationally, tactically, and immediately – it prevents escalation and protects people, the environment, and assets.

In Case of Escalation

Transition to Crisis Management

If the incident goes beyond operational measures, requiring strategic decisions or organisation-wide management, crisis management takes over. It assesses the situation, makes decisions, prioritises actions, and manages communication internally and externally.

The aim: damage limitation, coordination of all parties involved, and leadership under uncertainty.

Crisis management thus serves as the central control mechanism in the acute phase – it combines tactical action with strategic decision-making capability.

After Stabilisation

Return through Business Continuity Management

Once the situation is stabilised, BCM comes back into focus.

The recovery phase begins: processes are reactivated according to established recovery strategies, systems and resources are gradually ramped up, and the transition to normal operations is organised.

BCM ensures that business-critical operations are functional within the defined RTO times and that the organisation returns to a stable operational state – the so-called “Business as Usual.”

After the Event

Learning and Hardening

The process is only complete when the organisation learns. After each disruption or crisis, experiences are evaluated, weaknesses analysed, and improvement measures derived.

This closes the BCM lifecycle loop: experiences lead to adjustments, and adjustments lead to resilience.

Overview of Interaction

BCM, emergency management, and crisis management together form an integrated overall system. While BCM prepares, emergency management stabilises, and crisis management directs, the recovery phase ensures continuity and trust. Only when these disciplines seamlessly interlock can organisations manage disruptions, learn from them, and emerge stronger.

Pillars of Organisational Resilience

From Information Security to Business Continuity Management

Organisational resilience describes an organisation’s ability to remain operational despite disruptions, adapt, and return to a sustainable operation as quickly as possible.

To ensure this is more than just a buzzword, resilience requires a clear foundation. In the NOVELEDGE approach, the essential pillars consist of the following elements:

• Information and Cybersecurity
• Physical Security
• Emergency Management
• Crisis Management
• Business Continuity Management (BCM)

These components can be effectively grouped into three overarching pillars:

1. Protection (digital and physical security)
2. Event Management (emergency and crisis management)
3. Ensuring Business Operations (Business Continuity Management)

Protection

First pillar with information security and physical security

Information and Cybersecurity for Protection in the Digital Space

Information security and cybersecurity form the first layer of defence. The goal is to manage specific risks and threats in the digital space so that the confidentiality, integrity, and availability of information are maintained.

This includes, for example:

• an Information Security Management System (ISMS)
• technical measures (firewalls, encryption, access controls, monitoring)
• organisational measures (policies, roles, training, awareness)
• processes for detecting and handling security incidents (Incident Handling)

Cybersecurity increasingly addresses external threats such as malware, phishing, ransomware, or targeted attacks. Information security also encompasses internal risks, misconfigurations, human errors, and the protection of information assets regardless of the medium.

Physical Security as a Counterpart in the Real World

As a counterpart to digital security, physical security ensures that people, buildings, technology, and infrastructures are protected from specific dangers – such as:

• unauthorised access
• sabotage and theft
• fire, water, power failure
• natural events or structural damage

Access controls, locking systems, video surveillance within legal limits, fire protection concepts, emergency power supply, or physically separated server rooms are typical measures.

Outcome of this pillar:

Digital and physical protection together form a fundamental level of protection on which all further resilience measures are built. They do not prevent every disruption but significantly reduce the likelihood of occurrence and the potential extent of damage.

Event Management

Second Pillar with Emergency Management and Crisis Management

Even the best protection concept cannot prevent all events. Resilience therefore also means actively managing disruptions when they occur. This is where emergency management and crisis management come into play.

Emergency Management

Acting in Incidents with Limited Impact

Emergency management addresses incidents with lesser or limited impacts that still require targeted, rapid action to:

• limit the extent of damage,
• prevent chain reactions, and
• return to a stable state as quickly as possible.

Examples:

• Failure of a single application
• Locally limited IT disruption
• Short-term interruption of a supply (e.g., power flicker affecting systems)
• Security incident with initially manageable scope

This involves:

• Structured initial assessment (“Is this still an incident, or already a crisis?”)
• Rapid containment
• Technical and organisational immediate measures
• Clear communication channels

Modern approaches can utilise AI-supported monitoring and analysis to detect anomalies earlier, identify patterns faster, and intervene more precisely. AI does not replace responsibility but supports detection, prioritisation, and documentation.

Crisis Management

Assuming and Coordinating in a Crisis

When an event reaches a significant magnitude – for example, because multiple locations are affected, people are at risk, the organisation’s reputation is severely threatened, or critical processes fail on a large scale – we speak of a crisis.

Crisis management then takes on the task of

• actively “assuming” the situation – that is, taking responsibility and control,
• consolidating and prioritising decisions,
• ensuring the coordination of all involved areas,
• managing communication internally and externally,
• maintaining organisational operations as far as possible,
• and designing a path back to a sustainable normal operation.

Crisis teams, clearly defined roles, structured situation reports, decision-making bases, and a well-practised interaction of specialist areas are crucial here. Emergency management and crisis management interlock: emergency management detects and escalates, crisis management controls and prioritises.

Securing Business Operations

Third Pillar with Business Continuity Management (BCM)

While information security and physical security primarily act preventively and emergency and crisis management focus on event management, Business Continuity Management goes a step further:

It accepts that despite all measures, unforeseeable circumstances can occur and impact central processes – and consciously designs the ability to maintain or quickly restore critical operations.

All-Hazards Approach and Time-Critical Processes

BCM follows an all-hazards approach: The focus is not on the specific scenario, but on the impact on the organisation’s time-critical processes.

The core instrument is the Business Impact Analysis (BIA). It identifies:

• which processes are critical for the organisation,
• from when a failure is no longer acceptable (Maximum Tolerable Period of Disruption, MTPD),
• which Recovery Time Objectives (RTO) are required for processes and resources,
• which resources (IT, buildings, people, suppliers, infrastructure) are necessary for these processes,
• and what dependencies exist between processes and resources.

This ensures that BCM does not only consider abstract „risks“, but concrete impacts on business or organisational operations.

Business Continuity Plans as Structured Recovery Assistance

Based on the BIA, Business Continuity Plans (BCPs) are developed. They include:

• clear instructions for operating in emergency mode,
• prioritisation of processes and resources,
• defined recovery strategies (e.g., alternative sites, manual backup processes, alternative supply routes),
• roles and responsibilities,
• communication and escalation paths.

These plans are not an end in themselves, but serve:

• to maintain operational capability during disruptions,
• to ensure coordinated recovery before reaching the level of unacceptability,
• and as a qualified decision-making basis for crisis management.

Decision Support for Crisis Management

Through the BIA, the organisation knows:

• its most critical processes,
• the permissible downtime for each process,
• and the dependencies on resources and other processes.

For crisis management, this means:

In the event of an incident, it can make informed decisions about which resources need to be prioritised, what impact certain measures will have on specific processes, and how a failure in one area propagates through the organisation.

This makes BCM the link between preventive security (digital and physical) and reactive management (emergency and crisis management). It fills the gap that arises when, despite all protective measures, an impact occurs.

Conclusion

Resilience is more than „just“ security

The three pillars – protection, event management, and business continuity assurance – clearly demonstrate:

• Information and physical security reduce risks and threats but cannot completely eliminate them.
• Emergency and crisis management ensure that an organisation does not fall into a state of shock during disruptions but actively manages, coordinates, and communicates.
• Business Continuity Management ensures that time-critical processes are maintained or quickly restored under exceptional conditions – structured, coordinated, and bound to previously defined tolerance limits.

Together, this creates a robust resilience architecture that:

• covers both the digital and physical realms,
• addresses both minor disruptions and major crises,
• and provides management with a reliable basis for decision-making.

The impact model brings these components together: management systems influence organisational resilience and the performance of the organisation, and each organisation determines which benefits ultimately matter. The expert contributions in this series complement the model step by step – each shows where it applies.

If you need support with the adaptation or implementation of management systems – be it Business Continuity, Risk Management or Information Security – you can rely on the expertise of our network. Together, we develop solutions that are tailored to your organisation and practically implementable.

Secure support now!

Sources

The information in this article is based on the following sources. Content from paid standards is not quoted verbatim; their contents are paraphrased.

1. Galaitsi, S. E.; Pinigina, E.; Keisler, J. M.; Pescaroli, G.; Keenan, J. M.; Linkov, I. (2023): Business Continuity Management, Operational Resilience, and Organizational Resilience: Commonalities, Distinctions, and Synthesis. International Journal of Disaster Risk Science, 14, 713–721. doi.org/10.1007/s13753-023-00494-x ↑
2. ISO 22316:2017 – Security and resilience – Organizational resilience – Principles and attributes. Publisher: International Organization for Standardization, Geneva. Available for purchase through standards trade. ↑ ↑
3. National Institute of Standards and Technology: NIST Special Publication 800-34 Rev. 1 – Contingency Planning Guide for Federal Information Systems. May 2010. Freely available at NIST. ↑ ↑
4. Awang Ali, Q. S.; Hanafiah, M. H.; Mogindol, S. H. (2023): Systematic literature review of Business Continuity Management (BCM) practices: Integrating organisational resilience and performance in small and medium enterprises (SMEs) BCM framework. International Journal of Disaster Risk Reduction, 99, 104135. doi.org/10.1016/j.ijdrr.2023.104135 ↑ ↑
5. Federal Office for Information Security (BSI) (2025): Maturity and Implementation Level Assessment within the Framework of Proof of Compliance (RUN), Version 1.0 from 02.01.2025, Chapter 3.2 (Maturity Levels of BCMS). bsi.bund.de ↑
6. Awang Ali, Q. S.; Hanafiah, M. H.; Mogindol, S. H. (2024): Navigating turbulent waters: The impact of business continuity management (BCM) practices on financial and nonfinancial performance of tour operator companies. Journal of Contingencies and Crisis Management, 32(1). doi.org/10.1111/1468-5973.12550 ↑
7. Yulianto, E.; Awang Ali, Q. S.; Hanafiah, M. H. et al. (2025): Strengthening resilience and performance through business continuity management: insights from central java tour operators. Quality & Quantity, online 26.07.2025; 60(4), 11961–11987. doi.org/10.1007/s11135-025-02285-6 ↑
8. DIN EN ISO 22301:2020-06 – Security and Resilience – Business Continuity Management System – Requirements (ISO 22301:2019). German version EN ISO 22301:2019. Publisher: DIN German Institute for Standardization, Berlin. Available for purchase through standards trade. ↑
9. ISO 31000:2018 – Risk management – Guidelines. Publisher: International Organization for Standardization, Geneva. Available for purchase through standards trade. ↑
10. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS-2 Directive). Freely available at EUR-Lex. ↑
11. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Freely available at EUR-Lex. ↑
12. ISO/IEC 27001:2022 – Information security, cybersecurity and privacy protection – Information security management systems – Requirements. Publisher: International Organization for Standardization and International Electrotechnical Commission, Geneva. Available for purchase through standards trade. ↑
13. Umbrella Act to Strengthen the Physical Resilience of Critical Facilities (KRITIS-Dachgesetz – KRITISDachG). Freely available at gesetze-im-internet.de. ↑