COVID appeared to catch many of us by surprise. But should it have? We’ve had infectious disease outbreaks before and many organisations had plans in place to deal with a flu pandemic. Maybe we didn’t quite expect full lockdowns and not for the duration or maybe with the frequency in which they occurred.

We might not have future pandemics like COVID – or maybe we will – but COVID has taught us that we should always be prepared for an unexpected external shock that will disrupt our normal business operations.

Resilience First has been working with our members, CIS Security, on our Operational Resilience guide, focusing on Preparation. CIS is one of London’s leading security companies specialising in security services and facility management.

Operational Resilience Guide - Preparation

The full report is available here but let’s look at some of the key messages that we can learn from their experience of the pandemic and what preparation meant to them.

Leadership and Governance

Many companies have assessed risk and have in place plans to address these. But being resilient isn’t just about a process, it has to reflect the culture of the organisation and that is set at the highest level.

At CIS, the Leadership Team acted as the Incident Management Team and met daily during and in advance of lockdown. The team had already trained together and scenario-tested in advance on other catastrophic scenarios, such as denial of access to their single Head Office. This meant they were already well-prepared and had built relationships in the team. 

The organisation was already well on the way to achieving BS ISO 22301 certification. This is the international standard for business continuity. Certification for Head Office Services was achieved in 2021.

The company placed value in ensuring that good principles adopted were filtered down throughout the organisation. This proved effective during the pandemic where on-site staff were able to assimilate change in a short space of time, particularly while there was such fluidity in the early stages.

Planning and Foresight

Assessing risk will allow us to manage expected occurrences but not all disruptive activity will be predictable. CIS already had a senior person whose duties included scanning and analysis for emerging risks. This meant their Incident Management Team were primed and mobilised early before lockdown and would set them ahead of other organisations who adopted a ‘wait and see’ reactive mode. Scenario testing again played an important part in this as accountability and awareness of responsibilities were already in train.

Planning, though, is not only about processes. People, too, are the most important resource in any company and planning should include an understanding of how to support employees. This became critical for many companies during the pandemic where concerns around health and protection from disease were high.

Strategy and Information

In any incident or event, information and communication is critical. At CIS, they appointed someone to co-ordinate information, ensuring all employees had the same advice. COVID was unique in some respects as no-one was quite sure how it may progress or be managed in the early stages. Speculation and rumour were constant. CIS elected to only use formal government guidance and this one source of information proved vital in getting the right advice to employees particularly during periods where restrictions and protective measures were quickly changing.


All companies and organisations are different, but the principles that got us through the COVID pandemic can be applied across the business community to ensure we are as well prepared as we can be for future shocks.

The experience gained from CIS shows us that preparation has to be about accepting that large external unexpected issues can significantly disrupt your business’ operations. Businesses need to always be one step ahead and keep testing their processes and practices. They need to be clear that they only follow reliable advice. And working across the organisation and empowering staff will provide an agile and dependable workforce that should get them through whatever shocks they might have to face in the future.