Executive summary The specific actions any organization takes to strengthen its cyber resilience will vary depending on the context and will change over time as the business, threat landscape and underlying technologies evolve. There are, nonetheless, some paths to success that can be illuminated by the collective experiences and insights of peers. Sharing good practice, what works and how to overcome barriers to success has motivated this endeavour (see Unpacking Cyber Resilience). To gather insights on leading practices, the World Economic Forum, in collaboration with the University of Oxford, conducted a series of consultations and workshops with cyber leaders across geographies and industries, addressing the following questions: What have they done to cope with threats posed to their organization? What worked for them? What failed? Those discussions identified numerous concrete front-line practices that, while not exhaustive, provide a rich source of inspiration and direction. For accessibility and actionability, the Cyber Resilience Compass systemizes them into seven interrelated categories:Leadership Governance, risk and compliance People and culture Business processes Technical systems Crisis management Ecosystem engagement This white paper highlights the critical role of collaboration, knowledge-sharing and adaptive learning in strengthening cyber resilience. There is no universal blueprint for success – each organization must tailor and scope its approach based on its specific context, strategy and external factors. However, by drawing on the experiences of others, organizations can identify effective strategies and shape their own resilience roadmaps to navigate an increasingly complex cyber landscape. As a vehicle for the sharing of front-line practices and experiences, the Cyber Resilience Compass seeks to provide the valuable insights that help organizations develop and refine their cyber resilience journey.Cyber resilience is an organization’s ability to minimize the impact of significant cyber incidents on its primary business goals and objectives. The Cyber Resilience Compass: Journeys Towards Resilience 4

The Cyber Resilience Compass 2025