The worst time to discover that your resilience strategy exists only on paper is during a crisis. You may have ticked every compliance box on your list, but if a major operational disruption hit your organisation tomorrow, would you feel confident that you could keep essential services running? That distinction matters more than you might realise.
PwC's Global Crisis and Resilience Survey tells an interesting story: while 70% of business leaders feel ready to handle a major disruption, most organisations simply do not have the tested plans or trained teams in place to back that confidence up when it really matters.
So, if the plan exists but the confidence does not, where exactly does the gap lie? For businesses, this space between compliance and actual capability is where real risk lives.
Rising standards: how new regulations are shaping modern security
One example of regulation driving change is the European Union's Critical Entities Resilience (CER) Directive. This represents the most significant expansion of European resilience regulation in two decades. EU Member States must formally identify critical entities by July 2026. This mandate will increase the number of designated organisations in Europe to more than 15,000 by 2027 – a significant rise from just 100 under the previous framework.
This major shift will trigger a wide-reaching ripple effect across the entire business ecosystem. Because these designated organisations are legally responsible for the resilience of their value chains, they may now need to pass stricter security requirements directly down to their partners. This means that even smaller suppliers, subcontractors and service providers that fall outside the directive's direct scope may have to demonstrate their resilience to maintain their contracts.
For these vendors, strong security is no longer simply a legal checklist - it is a licence to operate and protect their place in the supply chain.
The local stakes are already high. Under national legislation such as Germany's KRITIS Umbrella Act, organisations serving more than 500,000 people must report major incidents within 24 hours. Fines can reach up to €1 million.
At its core, this regulatory push is not about complex legal details or the fear of heavy fines, but rather a much simpler reality: security standards are rising rapidly across the board, and no business operating in or alongside critical sectors can afford to ignore the change.
This regulatory push is also forcing necessary conversations about system dependencies at management and board level. Claus Fibiger, who leads Securitas in Denmark and chairs the board of the Confederation of Danish Industry's guard and security industry association (VSI), sees this shift daily.
"Directives are not just regulatory burdens," says Fibiger. "They are strategic drivers shaping business decisions and investments."
But what happens after you tick the compliance box?
Why audits pass but defences can fail
Compliance audits verify that policies, controls and documentation exist at a specific point in time. They confirm that a structure is in place, but they cannot confirm whether that structure will hold under pressure.
This gap is especially challenging for smaller, downstream partners supporting larger organisations or businesses affected by CER or NIS2 regulations. PwC's Global Digital Trust Insights survey reveals that third-party vulnerabilities are now ranked among the most critical threats facing organisations today. This means that a vulnerability in a smaller supplier can threaten the resilience of the entire network.
This is not a failure of regulation. It is a failure to treat compliance as anything more than a finish line.
What active readiness looks like in practice
The shift from passive compliance to operational resilience is proven only under pressure.
A global financial services firm discovered this first-hand. Despite having an established security programme, an internal review revealed that its existing reporting system had significant gaps in tracking live, fast-moving threats. This limited both its day-to-day resilience and its readiness for upcoming regulations.
The organisation addressed this by building a real-time risk intelligence service. By integrating 24/7 monitoring, early-warning alerts and dedicated crisis support, it shifted from reacting to threats to anticipating them.
The path to resilience: a five-step action plan
Regulations raise the floor. But for leaders of essential services and their supply chain partners, the real question is: what happens if our systems are tested tomorrow?
Moving from checking boxes to being truly ready requires a simple, step-by-step plan. Securitas experts recommend five straightforward actions to help protect your business:
- Understand: Start by mapping your key people, physical sites and daily processes to understand exactly how a sudden outage would affect your overall operations.
- Assess: Identify your weak spots by evaluating the active threats in your region against your existing teams, tools and response plans.
- Mitigate: Address your immediate gaps while building smart, long-term security solutions to protect your most critical business areas.
- Govern: Track practical measures, such as how quickly your team responds to incidents and how long your systems remain operational, to ensure your security measures work under pressure.
- Evolve: Because threats change constantly, review and update your operational plans and security arrangements at least twice a year to keep pace with these shifts.
While meeting a regulatory standard is necessary to demonstrate that you are prepared on paper, active operational resilience is what proves your teams are truly ready to handle a crisis in practice.
Talk to us about keeping your business running during a crisis.