This self-assessment is designed as a conversation starter, not a certification or maturity score. Work through each question and mark whether the capability is demonstrated, partly demonstrated, or not yet demonstrated. Any item that depends on an assumption rather than evidence deserves follow-up.
Critical functions
Can leadership identify the functions that must continue or recover first?
- Critical functions are named in terms of outputs or services, not only departments.
- Leadership agrees which functions receive priority during disruption.
- The organization knows the minimum viable level of service for each critical function.
- Priority decisions have been revisited after major operational change.
Dependencies
Are the resources behind critical work actually mapped?
- People, facilities, systems, data, suppliers, utilities, equipment, approvals, and communications are mapped for critical work.
- Single points of failure and concentration are visible.
- Named alternates have been checked for actual capacity and access.
- Dependency owners know what evidence would trigger escalation.
Continuity and recovery
Are fallback and recovery strategies usable?
- Fallback procedures exist for the highest-consequence disruptions.
- Recovery priorities align with business impact rather than technical convenience.
- Manual or alternate procedures have the required records, credentials, tools, and staffing.
- Reconstitution back to normal operations is addressed.
Testing
Has the organization generated evidence rather than relying on plans alone?
- Critical plans or assumptions have been exercised, observed, or otherwise validated.
- Exercise findings become owned corrective actions.
- Important corrective actions are verified for effectiveness, not only marked complete.
- Testing is repeated after material change.
Governance
Can leaders see material exposure and make decisions?
- Executives can see material single points of failure and overdue high-consequence actions.
- Risk acceptance has a named authority and review date.
- Major changes trigger resilience review.
- Reporting identifies decisions needed rather than only activity completed.
How to interpret your answers
A checked item means your team can point to credible current evidence, not simply that a document exists. Items left unchecked are not automatic failures; they are prompts for validation, ownership, or a deeper assessment. Pay special attention when several unchecked items support the same critical function or dependency.
Prioritize by consequence and confidence
Start with gaps connected to important products, services, safety, customers, or operations. Then ask how confident the organization is in the current contingency. High consequence plus low evidence is usually a stronger reason for follow-up than a low-consequence documentation issue.
Frequently asked questions
Is this a formal resilience maturity assessment?
No. It is a practical self-screen to help identify where a deeper assessment or test may be useful.
Should every item be checked before an organization is considered resilient?
No. The checklist is not a pass/fail standard. Use it to find high-consequence assumptions and decide what deserves validation, treatment, or a more formal assessment.