Resiliency IS Protection

For at least two years there has been an ongoing debate on the emphasis that the Department of Homeland Security should place on resilience in lieu of a perceived prejudice for protection.

The juxtaposition of resiliency and protection as themes for the Department of Homeland Security misstates the issues – it is not either/or. A different way of looking at the problem is as a continuum of Prevent, Protect (to include Mitigate), Respond and Recover — with preparedness as a theme underlying all of those tasks AND Resilience as the outcome. One needs to prepare to prevent, prepare to protect, prepare to respond and prepare to recover. Creating a capacity to address all of these areas in a coherent manner builds resilience in a system or in an organization. The Nation’s current challenge is to establish the full mission in one inclusive continuum that addresses national expectations and includes systems designed to achieve full recovery at the end of an event, preparedness for each segment of the continuum, and the inclusion of all relevant public and private actors in the processes.

Resilience is the goal of the continuum. We cannot prevent all occurrences, but we can prevent some, and we should focus on prevention where prevention is realistic – terrorism, flooding, pandemic and food borne illness, for instance. We cannot protect ourselves from all things, but we can focus on things that absolutely require high levels of protection – nuclear power plants, mass transportation assets, critical communications structures. While we will need to respond to failures in prevention and protection, we can focus recovery preparations on those events where we know that we will fail – hurricanes, tornadoes, floods, ice storms. True preparedness for recovery requires more than the current focus on short-term recovery of basic services and functions. It requires instead an adjustment of thinking which aims from the beginning at regaining the rhythms of life, commerce, and interactions which define the long term recovery of every community. We need to see and understand the linkages between the work done before the event along the resiliency continuum and the ability to recover fully and quickly after the event.

Achieving Resilience implies the systematic inclusion of the full fabric of society in the continuum of preparedness in order to secure a full recovery. While the efforts of governments (federal, state, local, tribal) are critical, they are not sufficient. The private business sector provides most of the Nation’s critical infrastructure and must be integrated either voluntarily or through regulation. Each method will have a place. The business sector will have an incentive to participate in resilience activities where they can be shown to prevent loss and ensure a degree of protection from business disruptions. Large businesses already operate across the continuum – preventing those things that seem preventable, protecting critical assets and information, responding to disruptions as required and getting their business back on line as quickly as possible. Because the best of them operate this way on a daily basis, the private business sector inherently “gets” resilience. On the other hand, they frequently see protection as a governmental responsibility that may come with regulation, restriction and demand for proprietary information.

In a wider sense, the private sector is not limited to the private business sector but also includes the non-governmental, volunteer, faith-based, academic and associational organizations that make up our social fabric. All of these organizations are important to the resilience continuum – some are critical. Very few of these entities view themselves as agents of “protection” and yet they bring tremendous resources to the response and recovery effort when prevention and protection fail. This part of the private sector is best engaged under the rubric of resilience. Their involvement in the preparation phase can magnify the potential for faster and more complete community-level response and recovery. In addition, they can play a critical role in building a culture of individual and family resilience. This is an often invisible element of critical infrastructure protection and recovery because without staff and employees capable of returning to work, no facility or sector can sustain itself during an incident or recover and return to full functionality.

Finally, a focus only on protection leads to a built in bias against a systems or network approach for dealing with critical infrastructure and therefore does not address inherent vulnerabilities associated with critical sectors. No sector exists in isolation and none can be fully protected from failure. Resilience implies a conceptual framework that encourages an understanding of critical interdependencies between sectors and acknowledges that failure in one critical sector always affects other sectors frequently cascading sufficiently to bring down the entire system. The resilience continuum looks across sectors to discover what part of the continuum is best applied to specific parts of the system – like robust private business protecting what can be protected, preventing where prevention is possible and preparing to respond and recover where these efforts fail.

CARRI is working to help reinforce the resilience continuum.