Criticality changes the questions leaders need to ask

Understandably, the immediate focus for many organisations is on compliance, including new obligations, multi-hazard risk assessments, and the required documentation. These activities are essential. Yet designation represents something far more significant.

The real significance of critical entity designation is that it makes existing responsibilities explicit. Organisations that provide essential services have always been critical. The difference is that their role in maintaining societal stability is now formally recognised and increasingly scrutinised.

This fundamentally changes the leadership question. Rather than asking “How do we protect our assets?”, leaders increasingly need to ask “How do we maintain essential services when disruption becomes complex, prolonged, or interconnected?”

The CER Directive makes clear that resilience is about maintaining essential services, not simply protecting individual assets. While the distinction appears subtle, it changes how resilience should be understood.

Modern infrastructure no longer operates as a collection of independent assets. It functions as an interconnected ecosystem. Think of it this way:

• Energy systems depend on digital infrastructure,
• Water utilities depend on energy,
• Transport systems depend on communications,
• And every critical organisation depends on suppliers, contractors, authorities, and other service providers.

As a result, resilience is increasingly determined by what happens between systems rather than within them.

This is why major disruptions rarely remain isolated. A cyber incident can affect operational systems. A power outage can disrupt communications. A supply chain shortage can delay recovery. Extreme weather can trigger failures across multiple interconnected systems simultaneously. What begins as a localised incident can rapidly evolve into a system-wide challenge.

The organisations that perform best during disruption have already answered five fundamental questions:

• Which services must continue under almost any circumstances?
• Which dependencies enable those services?
• How could disruption propagate across our organisation or beyond it?
• How will decisions be made when information is incomplete or time is limited?
• What does successful operation in degraded conditions actually look like?

This represents a shift from resilience as a compliance exercise to resilience as an operating model.

Many organisations will begin their CER journey by strengthening governance, completing risk assessments, and improving documentation. These activities are necessary. However, compliance alone does not guarantee performance under stress.

An organisation can satisfy every regulatory requirement and still struggle when disruption spans multiple functions or persists over time. The real test comes when decisions must be made quickly, information is incomplete, and competing priorities emerge at the same time. It is then that resilience becomes visible Under these conditions:

• Governance either enables rapid cross-functional decision-making or creates delay.
• Information either flows across the organisation or remains trapped within functional silos.
• Dependencies are either understood in advance or discovered during the incident itself.
• Service priorities have either been established beforehand or must be determined during the crisis.
• The organisation either continues to deliver essential services in a controlled degraded state or struggles to coordinate an effective response.

Ultimately, resilience becomes less about the existence of plans than about how the organisation behaves when those plans are tested.

The organisations that will succeed in an increasingly volatile world will not necessarily be those with the most comprehensive compliance programmes. They will be those that recognise criticality as a defining characteristic of how they operate, understanding that designation represents a shift from managing internal risk to accepting system responsibility.

Embracing criticality explores what this shift means in practice. It examines how organisations can move beyond compliance by embedding resilience into governance, decision-making, and operations, enabling them to sustain essential services when disruption is at its most complex. But ultimately being designed as a critical entity is something to embraced rather than being seen as a burden as designation highlights the important of an entity to society.