Discipline
Cybersecurity and resilience
What has to be ready before the bad day and what the regulator will ask for when it arrives.
4 services in this discipline
This is yours if
Three signs that this is yours.
- The supervisor asks you to demonstrate resilience: the controls exist, the evidence is not assembled.
- A query about post quantum readiness arrived and the starting point is still to be defined.
- You are about to deploy agents and the credential and revocation model is still to be defined.
Use this today, without hiring anyone
Agent continuity planning
The fifteen minute exercise. Get the three people in the process together, tell them the agent has been down for two hours and time the answers. It works on its own, and whatever does not get answered quickly is your gap.
- Who finds out first, and how? If the answer is "the customer calls us", you do not have detection, you have complaints.
- What gets done in the first ten minutes and who decides it? Without a specific name there is no procedure, there is goodwill.
- How many transactions an hour can the manual fallback handle, with the people you have today? The answer is a fraction of current volume, and that number changes the conversation.
- How long can it be sustained that way? Two hours and two days are different plans.
- Who decides to switch it back on, and with what proof that it is fine? It is the question nobody has written down.
And the four failure modes worth having on the list, because the third and the fourth are the ones that surprise people: the vendor goes down · the model changes version with no notice · the cost spikes · the output degrades silently.
It comes from Agent continuity planning. Every service in this discipline brings its own.
The 4 services in this discipline
Can you prove your operation holds up, with evidence and not with confidence?
They no longer ask whether we have controls. They ask whether I can prove it holds.
Your critical functions, your dependencies, your tolerance thresholds and the severe scenarios tested, with the file ready for the supervisor.
See the situationPost-quantum inventoryWhere does your organization encrypt, and what happens when that encryption expires?
The cryptography is spread across twenty years of systems.
Where your organization uses cryptography, what each scheme protects and how many years that data must stay secret, with the roadmap of what to migrate first.
See the situationNon-human identity governanceWho answers for what your service accounts and your agents do?
We have service accounts with privileges and nobody knows who answers for them.
The inventory of everything that is not a person and has access, with a named owner, documented rights and its rotation and revocation rule.
See the situationAgent continuity planningHave you ever tested the failure plan for your AI agents?
The process already depends on the agent and nobody remembers how it was done by hand.
Plan B, written and actually tested: the agent gets switched off and how long your team takes to pick it up gets measured.
See the situationThe other disciplines
AI strategy
12AI governance and compliance
9Automation and agents
8Data and analytics
5Critical operations and crisis
5Mergers, separation and diligence
4Cost of AI and software
5Infrastructure and platform
5Or see it by the cycle: Vanguard, Forge and Taskforce. Or by the question you arrive with, in the seven questions. And if you already know the name, there is the full list.
What is the decision you have in front of you this week?