Disaster Preparedness for Critical Infrastructure: A Guide to Building Resilience

Disaster preparedness for critical infrastructure is mostly a dependency problem. A substation, a water plant, or a hospital rarely fails on its own. It fails because something it depends on failed first: the power, the fuel truck, the network, the one vendor nobody listed. Plan for those dependencies and you are prepared. Plan only for the hurricane and you are not.

That is true for the people who run critical infrastructure and for the much larger group of businesses that depend on it. This guide is for both.

Old View	New View
Plan for each scenario: hurricane, ice storm, cyberattack	Plan for the consequences: lost people, facilities, technology, and third parties
Our facility is hardened, so we are prepared	Our facility is only as resilient as the power, water, communications, and transportation feeding it
The utility will restore service	We know how long we can run without the utility, and what we do at hour 73
Government will coordinate the response	We built relationships with emergency managers years before we needed them
The plan is done when it is written	The plan is done when it has survived an exercise

What Counts as Critical Infrastructure

The Cybersecurity and Infrastructure Security Agency (CISA) recognizes 16 critical infrastructure sectors:

• Chemical
• Commercial Facilities
• Communications
• Critical Manufacturing
• Dams
• Defense Industrial Base
• Emergency Services
• Energy
• Financial Services
• Food and Agriculture
• Government Services and Facilities
• Healthcare and Public Health
• Information Technology
• Nuclear Reactors, Materials, and Waste
• Transportation Systems
• Water and Wastewater

Four of them carry the rest. CISA’s infrastructure dependency guidance names energy, communications, water, and transportation as critical to the operations of almost all other sectors, and to each other. These are the lifeline sectors. Power runs the pumps that move water. Communications run grid control. Fuel for backup generators arrives by truck, on roads that may be closed.

FEMA uses a parallel idea in response and recovery. Its eight community lifelines are Safety and Security; Food, Hydration, Shelter; Health and Medical; Energy; Communications; Transportation; Hazardous Materials; and Water Systems. When emergency managers ask “is this lifeline stable?”, they are asking whether the community can function. Your plan should be able to answer the same question about your organization.

Why Critical Infrastructure Continuity Is Different

Most business continuity plans assume the outside world keeps working while one company recovers. Critical infrastructure continuity cannot make that assumption. When a regional disaster hits, your operation, your suppliers, your employees’ homes, and the agencies you would call for help are all hit at once.

Three things follow.

Failures cascade. A power outage becomes a water outage, which becomes a hospital diversion, which becomes a public health problem. The disaster you plan for is rarely the disaster you manage. You manage the second- and third-order failures.

Duration matters more than cause. An outage of four hours is an inconvenience. An outage of four days changes who can come to work, how you get fuel, and what you tell regulators and customers. Plan for duration.

The public is watching. When a water system or a grid operator stumbles, the story is no longer operational. It is reputational and political, and your executives will be answering for it.

Disaster Preparedness for Critical Infrastructure Operators: Six Practices

1. Map your dependencies, upstream and downstream. List what you need to operate (power, fuel, water, communications, key vendors, specialized technicians) and who needs you. Most operators know their own assets well and their dependencies badly. Our guide to dependency mapping covers the technology side.
2. Plan for consequences, not scenarios. There are hundreds of ways to be disrupted and only four consequences that matter: you lose people, a facility, technology, or a third party. Build your strategies around those four, and any scenario becomes a combination of them.
3. Hunt single points of failure. The question I ask in every program review: is there a single point of failure in one geography, one facility, one piece of software, one server, or one person? In critical infrastructure the answer is often a single substation feed, a single control system vendor, or the one engineer who knows how the legacy system really works. Our guide to single points of failure walks through how to find them.
4. Pre-authorize the decisions you know you will face. Before founding Bryghtpath, I led crisis management at Target. Before a storm, we deployed generators to stores without asking anyone’s permission in the moment, because the triggers and the facilities leader’s authority were written down in advance. Write down who can spend, shut down, or restart, and at what threshold. Speed comes from decisions made before the storm.
5. Build relationships before you need them. A line from a US Northern Command challenge coin has stuck with me for years: “When you need a friend, it’s too late to make one.” Know your county and state emergency managers, your fusion center, and your mutual aid partners by name. I talked through how that worked in practice on Managing Uncertainty, Episode 73.
6. Exercise the cascade. A tabletop exercise that tests one failure in isolation teaches very little. Start with the power loss, then take away the cell network, then delay the fuel delivery. Bring in the partners you depend on. The right exercise format depends on your program’s maturity, but every format should test the handoffs.

If Your Business Depends on Critical Infrastructure (It Does)

Every organization is a customer of the lifeline sectors. Most plan as if those sectors will never fail.

At Target, a division once asked my team for a detailed threat analysis. We pointed out that our most common call was “the power is out.” After weeks of analysis, the division concluded that its top risk was a power outage at facilities without generators. The answer had been in the call log the whole time.

Ask your team five questions:

• How long can each critical site run without utility power, and what happens when the generator fuel runs out?
• If the cell network and internet are down across the region, how do you reach your people and they reach you?
• Which of your critical vendors sit in the same region as you, on the same grid?
• Can your employees get to work if roads, transit, and schools are closed for a week?
• Who in your organization knows your local emergency manager?

If nobody can answer, that is your first finding.

What This Looks Like in Practice

A major U.S. electric, natural gas, and nuclear energy company came to us after a national exercise showed that its business continuity and crisis management capabilities were inadequate for the evolving threats to the electric grid and natural gas distribution systems. Our Resiliency Diagnosis® of that utility included 33 interviews, among them every member of the executive team, and a review of nearly 500 pages of documentation. We briefed the CEO and executive staff and provided a written summary to the Audit Committee of the Board. The utility then made a significant multi-year investment in its program, and we were retained to help build it out.

The lesson is not that the utility had a bad program. A national exercise exposed the gaps, and leadership acted on them. That is what exercises are for. More on our work in the sector is on our power and utilities page.

Response and Recovery: Keep the Priorities Simple

When the disaster arrives, the order of priorities does not change: life safety first, then your people and their families, then restoring operations. Restoration follows a plan you wrote in advance. Power goes to hospitals, water, and emergency services first because everyone agreed to that before the storm, not because someone argued for it at 2:00 AM.

Then run the after-action process. Even a response everyone praises produces a long list of things to fix. Assign each one an owner and a date, and test it in the next exercise.

Critical infrastructure is not resilient because it is hardened. It is resilient because the people who run it, and the people who depend on it, planned for the day the lifelines go dark.

Keep Going

A few ways to go deeper if this was useful.

• Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Business Continuity.
• Build the program. Our Business Continuity services help operators and the organizations that depend on them plan for dependencies, not just scenarios.
• Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
• Talk to us. Set up a call to think through your program with us.