Redefining resilience: Leading through uncertainty

For regulated utilities, resilience is not just a business imperative but a national duty. Energy generation and transmission sit at the centre of the system that sustains the UK’s critical national functions - the services and supplies underpinning society. The challenge is therefore not only to prevent disruption to it, but to ensure it can endure severe compounding risks.

The Minimum Viable Company (MVC) concept offers the foundations of a solution. While the MVC helps identify what must continue operating in a crisis, energy providers also need to scale that thinking through a systems lens. To think how they can make both their own organisations and society more resilient. Or rather, to consider their role in sustaining a Minimum Viable United Kingdom: the essential infrastructure, services and capabilities required to preserve national security, economic stability, and the basic functioning of society. When embedded at every level of the organisation, resilience can evolve from a protective measure into a defining strength. Strategic control, operational preparedness and digital security form the foundation of a more agile organisation - one that keeps the nation powered, no matter what lies ahead.

Linking risk to resilience and turning control into your competitive edge

In a world defined by volatility, where events like cyber threats and supply chain shocks are becoming the new normal, resilience has become a measure of strategic strength. Leading organisations no longer view it as insurance but as a source of agility, permanence and performance. Regulations such as the EU Digital Operational Resilience Act (DORA) and the UK Corporate Governance Code are accelerating this shift. Firms are now increasingly expected by both regulators and investors to prove they can continue to operate, recover and evolve through disruption. But real resilience goes beyond compliance. It means crafting a single, integrated framework by bringing risk management, operational hardiness and performance together.  

Moving from risk management to resilience

Risk management reduces the likelihood of failure, while resilience limits its impact. Together they form a continuous cycle of prevention and adaptation. Embedding this integration requires a balance of changes: fostering collaboration between risk, compliance and operations, while using real-time data to anticipate vulnerabilities. The “bowtie” model captures this balance: prevention on one side, impact mitigation on the other, and insight at the centre. When combined, they create stronger, more efficient controls.

Redefining resilience
Defining the minimum viable company
Mapping out what matters  

Every part of a utilities provider, from control rooms and SCADA systems to engineers, suppliers and data networks, is deeply connected. Mapping these interdependencies reveals vulnerabilities and guides where redundancies or failovers are needed. Backup systems, secondary suppliers and automated recovery processes ensure critical functions remain operational during disruption.

Leading from the front

Resilience is now a national priority. The UK government expects critical infrastructure boards to lead on cyber and operational excellence. This means embedding these priorities into governance, aligning cyber and operational strategies and working closely with regulators and partners.

Building for the future

As the energy transition accelerates, businesses must evolve too. Data-driven insights and digital twins can help model stress scenarios and guide investment in critical assets. By defining its Minimum Viable Company (MVC), companies can protect not only their own operations but also the nation’s energy security. Resilience is both a corporate and societal responsibility, essential to keeping the UK moving through disruption and beyond.