The six resource categories

Six categories, not one

ISO 22301 § 8.3.4 lists the resource categories to address. They do not reduce to IT.

The commonest methodological error is to address only the "technology" category and consider the strategy set. In most real disruptions lasting beyond 24 hours, the binding constraint is people or suppliers.

The four response families

For each resource, ISO/TS 22331 offers four families:

1. Accept — do nothing, absorb the disruption. Legitimate provided the decision is documented and its impact known.
2. Reduce likelihood — redundancy, preventive maintenance, hardening. Acts before the event.
3. Reduce impact — recovery site, degraded mode, buffer stock. Acts during the event.
4. Transfer — insurance, outsourcing, contractual clause. Transfers the financial consequence, never the operational or reputational responsibility.

The free strategies people forget

Before committing budget, systematically examine four levers that cost almost nothing:

• Deferral. Some activities can slip without consequence. Identifying them frees people for prioritised activities.
• Manual mode. Many processes ran without IT twenty years ago. Documenting the paper procedure costs two days and covers 48-hour disruptions.
• Cross-training. Training two more people on a scarce skill costs three weeks and removes a human single point of failure.
• Calendar reorganisation. Moving an internal deadline by a fortnight can eliminate an entire threshold effect.

In most organisations these four levers cover half the scenarios at marginal cost. They go unexplored because they do not present themselves as projects.