Operational resilience is no longer simply a matter of compliance, according to Marios Stavrou, Head of Operations at SupportCY, the Bank of Cyprus initiative.
Speaking to Politis, Stavrou said resilience is about an organisation's ability to adapt quickly, maintain critical operations and make sound decisions when conditions change faster than planned.
Climate crisis
Wildfires, prolonged heatwaves, drought, flooding and extreme weather events are no longer distant scenarios, Stavrou said.
He noted that the international community now recognises wildfires, coastal flooding and extreme temperatures among the most significant climate risks facing countries, particularly in the Mediterranean region.
For businesses, understanding the risk is not enough. It must translate into specific operational decisions.
A wildfire may never reach an organisation's premises but could disrupt electricity supplies, close transport routes, affect air quality or prevent employees and suppliers from travelling.
Similarly, a heatwave can sharply increase energy demand, affect equipment and create serious risks for staff.
Adaptation, he argued, should therefore include alternative premises, resilient infrastructure, adequate backup systems, safe working conditions, diversified supply routes and clear criteria for suspending or relocating operations.
Geopolitical instability
Cyprus' geographical location is an advantage, Stavrou said, but it also increases the economy's exposure to regional tensions.
"Conflicts, sanctions, airspace restrictions, disruptions to shipping and increases in energy or transport costs can directly affect supplies, travel, payments, insurance coverage and market access," he said.
Preparedness, he added, does not mean predicting the next crisis but understanding where actual exposure lies.
Which products or services depend on a single country, port, air connection or supplier? Which contracts may be affected by sanctions or sudden cost increases? How quickly can a company activate alternative routes and who approves those decisions?
"These questions must be answered before regional instability develops into an internal business crisis," he said.
Digital resilience
As more operations move into digital environments, a cyber incident can rapidly escalate into a complete business interruption, Stavrou warned.
Loss of access to data, electronic payment systems, booking platforms, communications systems or cloud services affects far more than an IT department.
"It affects customers, revenues, regulatory obligations, reputation and management's ability to understand what is happening," he said.
Cyber resilience, he stressed, requires not only prevention but also the capacity to continue operating and recover.
Businesses need reliable backups, alternative methods of communication, clear manual operating procedures, tested recovery time objectives and a full understanding of third-party technological dependencies.
They should also have tested how they would function when core systems are unavailable and information about an incident remains incomplete or contradictory.
Interdependence
According to Stavrou, the greatest vulnerabilities are often found between an organisation's functions.
Direct and indirect risks can often only be fully understood when experienced in real-life conditions or crisis situations, making it essential to adopt a systemic approach to interdependencies in a multi-risk environment.
A climate-related disaster can cause power outages while simultaneously restricting access to facilities.
A geopolitical event can affect suppliers, telecommunications links and digital services.
A cyber incident at a critical infrastructure provider can spread disruption across dozens of businesses.
Mapping dependencies helps identify these common points of failure and allows management to prioritise interventions based on their actual operational impact.
He added that resilience cannot be achieved by each organisation working alone.
Global experience shows that resilience is built as an ecosystem requiring a shared understanding of risks, timely information-sharing, clear communication channels and coordinated exercises.
The Cyprus dimension
Given Cyprus' small size and the interconnected nature of many essential services, organised cooperation before a crisis can significantly reduce response and recovery times across both business and society, Stavrou said.
He also emphasised that a business continuity plan only has value if it can be implemented under real-world conditions.
The best exercises do not test whether participants remember a plan. They test whether they can recognise escalation, protect critical services, prioritise recovery and coordinate beyond the boundaries of their own organisation.
For a Cypriot business, a realistic stress test could combine an extreme weather event, power outage, access restrictions, cyberattack, problems involving a critical supplier and misinformation.
The objective is not for the team to fail but to reveal incorrect assumptions, unclear responsibilities and inadequate alternatives before an actual crisis occurs.
Preparing for the next crisis
The next step for businesses in Cyprus, Stavrou said, is to move from merely creating plans to demonstrating an ability to adapt.
Climate resilience, geopolitical resilience and cyber resilience should form part of a single operational strategy because they depend on the same critical functions, infrastructure and decision-making processes.
The organisations that weather the next crisis most successfully will not be those that tried to predict every possible scenario, he said.
Rather, they will be those that understood their dependencies, adapted early and realistically tested their ability to make decisions and continue operating.
"For Cyprus," Stavrou concluded, "this transition is a prerequisite for businesses, critical infrastructure and an economy that can operate reliably in an environment of constant uncertainty."
