What is resilience? – From risk analysis to the ability to withstand
Resilience is more than robustness. It describes a system’s ability to remain able to act despite disruptions and to recover functionally after a shock. In the context of whole-of-government defence, resilience means: being prepared when systems fail, supplies falter or infrastructure is damaged.
“Resilience and safeguarding peace deliberately rest on participation and responsibility across the whole of government and the whole of society. Only if it is thought through and acted on together can OPLAN DEU be triggered in good time and receive appropriate civilian support.” (translated quote)
Lieutenant General Sollfrank
The concept covers technical, organisational and societal dimensions:
- Technical: redundant systems, backup power, robustness against cyberattacks
- Organisational: crisis plans, emergency teams, alerting chains
- Societal: ability to communicate, self-help capacity, trust
Resilience cannot be imposed “from above”. It develops within the structures themselves. That is why we need a resilience architecturethat connects critical infrastructure operators, authorities, the population and security actors. Exercises, partnerships and a clear division of roles are decisive.
Making Germany resilient – but how?
Lieutenant General Alexander Sollfrank names four key capabilities that a resilient society needs in terms of defence capability:
- Robustness against cyberattacks
- Sufficient reserves (materiel, energy, staff)
- Redundant structures (e.g. alternative transport routes)
- Agility of authorities and businesses
Resilience must be built jointly with civilian and military actors. The German Basic Law does not recognise a state of hybrid war – which makes a whole-of-government situation pictureall the more important as a basis for decisions on effective protective measures.
There is therefore a particular need for:
- Stress tests & simulation exercises (e.g. blackout simulations)
- Cross-sector cooperation
- Mapping & protecting system-critical supply relationships (e.g. cold chains in the supply of medicines)
Responsibility of the state, politics and society
Resilience emerges from the interplay of the military, politics and society:
- Politicians need to know under what conditions military action is possible – and where delays create risks
- The military , in turn, must understand political decision-making logic in order to request support at the right time
At the same time, every individual bears responsibility:
Citizens should strive to reduce their own vulnerability.
That means knowing emergency plans, taking precautions and staying informed.
Because successful defence is not just a state task, but a task for society as a whole.
A robust whole-of-government situation picture – i.e. a shared picture of threats, weaknesses and resources – is the basis for the right decisions. Only in this way can decisive and effective measures be taken in the hybrid space – even though the Basic Law itself does not yet recognise a state of “hybrid war”.
What really makes infrastructure resilient?
Organisational resilience does not begin in a crisis; it must be proactively built into structures, processes and decision-making . The model of organisational crisis resilience (Kerstan & Röhl, 2022) shows that technical protective measures alone are not enough.
Instead, what matters is the interplay of the ability to perceive, decide, act and learn – both within organisations and across the wider system.
Resilient structures are characterised by the following capabilities:
- Recognising risks: early situation pictures and scenarios
- Being able to act: clear responsibilities and decision-making channels
- Staying flexible: fallback options, diversions, emergency operation
- Learning from the crisis: evaluation and adjustment after incidents
These four dimensions are only effective if they are anchored institutionally and supported by exercises, communication and leadership .
Model of organisational crisis resilience
The following diagram (Kerstan & Röhl, 2022) shows the key capabilities of resilient organisations in the infrastructure sector. It makes clear that resilience is not a state but a process of recognising, deciding, acting and learning – embedded in communication and leadership. The assessment of coping capacity can be applied to both businesses and local authorities.
Robust – redundant – prepared: what is needed in an emergency?
- Robustness means resistance to attacks or outages (e.g. armoured networks, hardened systems)
- Redundancy means duplicate routes or systems to keep functioning in the event of a failure (e.g. two lines, two data centres)
- Reserves are additional resources that are not used in normal operations but can be decisive in a crisis (e.g. diesel stocks, staff pools, vacant space)
Only when these three elements are considered together can resilience be put into practice – whether in a hospital, in grid operations or at local level.
