How to make a business case for improving your resilience

Decision-makers have limited resources, and they need to know an investment in resilience is worthwhile before they'll commit to it. A robust business case gives them that confidence — and makes the decision defensible against competing priorities.

What is a business case?

The purpose of a business case is to outline the costs and benefits of certain initiatives. The costs of improving your resilience are straightforward to assess and can be obtained through quotations. However, estimating the benefits of improved resilience or reducing the risks from having the services can be more challenging.

What to count?

The most reliable place to start is the cost of recovering faster from a disruption: lost revenue per hour of downtime, contractual penalties, staff time. It's much harder to quantify the cost of reputational damage, or of non-compliance with a regulation like CPS 230. Both matter, but they need different kinds of evidence.

Estimating the likely benefit?

We've built models that quantify the most likely impact of a disruption to your business services — based on the Prioritised Activities identified in your Business Impact Analysis, and how long your organisation can tolerate them being unavailable. That gives you a defensible number to weigh against the cost of improving your resilience, which is what turns "we should probably do this" into a business case a decision-maker can actually approve.