Resilience is tested when the plan stops being enough.
A cyber incident does not arrive as a neat technical problem.
Operations wants systems restored. Legal wants evidence. Communications needs an answer. Leadership wants to know what the business can still do.
I help organisations understand what must keep working, clarify who owns the critical decisions and build the resilience to act when conditions change.
15 questions · about 10 minutes · free · personally reviewed by André
The first difficult question is rarely technical.
A critical system is unavailable. Security is investigating. The first technical facts begin to arrive.
Then the business questions start:
- Which business services are affected?
- How long can they remain unavailable?
- Which supplier is involved?
- Who can accept the risk of bringing a system back?
- Who speaks to customers, regulators or the board?
A response plan can describe the process. But resilience depends on whether the organisation can make those decisions when information is incomplete and time is limited.
Cyber resilience starts with the business.
What must continue? Which services matter most? Which customers and operations cannot wait? Which dependencies are critical? How much disruption can the organisation tolerate? Who has the authority to decide when trade-offs become unavoidable?
Technology matters. Controls matter. Incident plans matter. But their value is ultimately measured by whether they help the business anticipate disruption, respond intelligently and recover without losing control of the decisions that matter.
From a resilience plan to resilience in practice.
Cyber Resilience Strategy & Governance
Connect resilience priorities to the business, clarify ownership and establish governance that keeps critical risks visible to the people who can act on them.
Executive Crisis Readiness
Prepare leadership to make decisions when information is incomplete, priorities conflict and time is short.
Executive Tabletop Exercises
Test more than the incident-response playbook. Test escalation, decision rights, assumptions, dependencies and the way leadership works under pressure.
Resilience Assessment & Priorities
Turn observations and findings into a practical view of where the organisation is prepared, where important gaps remain and what deserves attention first.
Typical engagements
- Cyber Resilience Review: An in-depth review of critical business processes, dependencies, decision rights and existing resilience measures.
- Executive Cyber Crisis Tabletop: A facilitated crisis simulation with a debrief on decision paths, critical assumptions and practical improvements.
- Cyber Resilience Strategy & Roadmap: A prioritised resilience strategy with clear ownership, governance and a practical roadmap for implementation.
The plan says, “Escalate to leadership.” Then leadership arrives.
Everyone in the room has a legitimate priority.
Restore quickly, or preserve evidence? Reassure customers, or wait for confirmation? Keep operations moving, or isolate more systems?
The plan got the issue into the right room. It did not say who in that room actually decides.
A useful executive tabletop exposes where decision ownership becomes ambiguous and which assumptions fail. It shows what information is actually needed, what can wait and what must change before a real incident tests the organisation.
Start with what matters. Then test whether it will hold.
I do not begin with a generic maturity model and work backwards to the business.
We establish the operational context first: what needs to keep working, which dependencies matter, what leadership can tolerate and where ownership sits. Then I challenge the assumptions behind those decisions and focus effort where it can make the greatest difference.
The goal is not a thicker resilience plan. It is a business that is harder to surprise.
Prepared does not mean knowing exactly what will happen. It means knowing enough to act when you do not.
A resilient organisation understands what it must protect and restore first. Decision ownership is clear. Important dependencies are visible. Technical response and business action work together. Plans have been tested. And the first hour of a crisis is not spent discovering who is allowed to decide.
Executive resilience requires more than technical expertise.
I bring more than 20 years of experience across technology, security and leadership, including over a decade supporting operations for the Defense Commissary Agency (DeCA), a component of the U.S. Department of Defense.
I am a CISM, ISACA author and two-time Cyber Leadership Institute Capstone Winner, having won both the Cyber Leadership Program and Cyber Strategy & Transformation Program Capstones.
Phil Zongo, CEO & Co-Founder of the Cyber Leadership Institute, has specifically recognised my ability to connect cybersecurity with business strategy and communicate executive-level solutions with clarity and persuasion.
More About André →How resilient would your organisation be when the plan meets reality?
Start with the free Cyber Resilience Assessment, provided jointly by [it+]sm and André Porsch Consulting.
15 questions take approximately 10 minutes.
From there, I take over personally.
Within 24–48 hours, you receive a written assessment showing where your organisation is well prepared, where important gaps remain and what deserves attention next.
Assess Your Cyber Resilience →The link takes you to the joint [it+]sm and André Porsch Consulting assessment site.
The Cyber Resilience Assessment incorporates elements of the Five Anchors of Cyber Resilience developed by Phil Zongo and is used with permission.
You do not need another plan nobody has tested.
If you want to know whether your organisation could keep making good decisions when a cyber incident stops being theoretical, we can start there.