Administrative Resilience and Cyber Threats: Resilience Starts with Leadership

Administrative resilience is about an organization’s ability to deliver services, serve customers, process information, and maintain its core business when technology, information, suppliers, personnel, or the operating environment are disrupted. Organizational resilience is built at multiple levels.

This article examines administrative resilience in preparing for and recovering from cyber threats at the strategic level of an organization.

A company’s most critical business processes depend on cloud services, supplier networks, data, digital service chains, and AI solutions. In many organizations, the entire business can grind to a halt if any one of these fails. At the same time, geopolitical uncertainty, competition between states, and hybrid threats targeting critical societal functions have made disruptions to digital dependencies a matter of national security and security of supply as well.

The focus of regulation has expanded from protecting individual systems to more comprehensive risk management, infrastructure protection, and strengthening the security and resilience of essential services. The NIS2 directive and Finland’s national Cybersecurity Act emphasize management responsibility and risk management. Alongside them, instruments such as the CER Directive, the Cyber Resilience Act (CRA), DORA, and, to some extent, the EU AI Act approach the same challenge from different perspectives: How can societies and organizations continue to operate during disruptions?

When an organization faces a serious disruption, the first problem is usually not technical. More often, what is unclear is who makes the decisions, who owns the risks, what is critical, what level of risk the organization is prepared to accept, and who must be notified and when.

Many data breaches, service outages, or supply chain disruptions escalate into crises only when the organization lacks a shared understanding of these questions. Resilience is not built through individual technical controls, but through proactive decision-making, clear responsibilities, and consistent security governance. Responsibility for the strategic management of security rests with senior management (Finnish national Cybersecurity Act 124/2025, Section 10).

Management’s most important role is not to decide on specific procedures or technologies, but to make strategic decisions. The five most important are:

1. What are the organization’s critical services?

Not everything can or should be protected to the same level. The first question is therefore: What operations must we be able to maintain under all circumstances? If this is unclear, security investments cannot be prioritized effectively either (Finnish national Cybersecurity Act, Section 9(2)(5)).

2. What is the organization’s critical information?

Information that is essential to the business must remain available, accurate, confidential, and unaltered even after a disruption. Management must be able to answer the question: What information, if lost, altered, or leaked, would cause the greatest harm? (Finnish national Cybersecurity Act, Section 2(11)).

3. Who are the critical suppliers?

The organization must know its direct suppliers and identify the technological, operational, informational, and contractual dependencies associated with them. It must understand how a disruption, interruption in the flow of information, or change of supplier would affect critical services (Finnish national Cybersecurity Act, Section 9(2)(4)).

4. How much risk are we prepared to accept?

Business risk can never be completely eliminated. Ultimately, every investment involves decisions about which risks to reduce, which to transfer through measures such as contracts or insurance, and which to accept. These are decisions for the board and senior management.

5. How will disruption situations be managed?

If business continuity and crisis planning begin only when a disruption is detected, they begin too late. True resilience means that responsibilities, decision-making processes, and communication models have been defined before a disruption occurs. Agree on and rehearse how critical decisions will be made, based on what information, and within what timeframe (National Cyber Security Centre).

In many organizations, security is still discussed as an expense, when in reality it is a business enabler. Well-designed resilience increases customer trust, facilitates regulatory compliance, reduces the impact of disruptions, accelerates recovery, and strengthens the organization’s competitiveness.

The same investment can simultaneously support other information security and data protection requirements, AI governance, and supply chain risk management.

If you want to assess your organization’s administrative resilience, start with these questions:

1. Do we know our critical business functions and services?

2. Do we know our critical information and assets?

3. Do we know our critical suppliers?

4. Has our risk tolerance been defined?

5. Does management understand its responsibilities during a disruption?

If there is no clear answer to any one of these questions, that is where corrective action should begin.

This article opens a three-part series on administrative resilience and cyber threats. In the next part, we’ll examine how the principles defined by management are translated into practice through governance models, risk management, contracts, data protection, and AI governance. This is what determines whether resilience moves from an objective to a concrete way of working that can also stand up to legal scrutiny.

See also our previously published guide: The EU NIS2 Cybersecurity Directive and Finland’s national Cybersecurity Act, a concise introduction to Finnish legislation covering who the Act applies to, what obligations it imposes on different organizations, and where to find reliable guidance from the authorities.