Full spectrum threats: Why organizational culture (and its micro-cultures) are critical to the success or failure of organizational resilience

This chapter will explore the challenge that despite the best efforts of organizations to ensure and assure resilience, the general cultural climate of an organization (or the characteristics of micro-cultures within it) can undermine sensible preparations. Even worse, these human vulnerabilities (which either exist or could be developed by external or internal actors) are such that new threats to resilience are inextricably embedded within the private and public sector. This does not mean, however, that nothing can be done. By looking at several case studies, and drawing on consultancy and other experience, the author will propose some practical and pragmatic means by which an organization could achieve a better diagnosis (i.e., situational awareness) and enhanced treatment options for two scenarios. The first is to ensure that the organization works better when resilience measures are invoked or exercised (e.g., business continuity scenarios); the second scenario is that of achieving limitation in terms of the unrealized opportunities that the cultures (macro and micro) of the organization offer to the imaginative, determined or lucky adversary. This chapter is intended to provide intellectual ammunition and inspiration to security practitioners or board members seeking to drive change agendas which generate genuine improvements in risk assessment or management. Whilst the culture of an organization is often the source of susceptibility: it could also be harnessed and leveraged as the reservoir of resilience.