The cyber resilience context The risks and challenges in building cyber resilience are not uniform but unique to each organization as it faces its specific threats in context. Therefore, as the following sections explore systematized categories of practices and issues drawn from the cyber front line, it is important to emphasize again that an organization’s cyber resilience is tied to the particular nature of the organization’s technological and business processes. These processes are influenced by its preparations for and actions in response to incidents and other factors including the broader ecosystem, its industry and whether it operates in a local or global context. The cyber resilience strategies and practices of organizations are likely to differ not only in the nature of the threats they face but also according to the characteristics of each organization. These may include the: –Size and the scope of its operations –Grade of digitalization and centrality of technological systems, including information technology (IT), operational technology (OT) and internet of things (IoT) –Whether it is categorized as critical national infrastructure (CNI) or otherwise subject to regulatory obligations –Degree of decentralization and independence among the organization’s units –Volume, speed and degree of reliance on its supply-chain ecosystem –Diversity of cybersecurity capacities within and across the organization –Workforce allocated to the most critical processes –Availability of skilled cybersecurity professionals in its labour market –Sector- and industry-specific challenges These and other circumstances influence how any given organization can become more resilient to cyberthreats. Ultimately, there is no universal solution or single approach that fits all organizations; instead, numerous front- line practices exist, which vary by applicability, depending on these contextual factors. The Cyber Resilience Compass: Journeys Towards Resilience 6

The Cyber Resilience Compass 2025