Is it five to twelve—or already later than that?

Whether it’s five to twelve, twelve o’clock, or already five past twelve depends on the starting point. Some organizations still have resources, while others are running out. Still others have already lost key capabilities. The crucial question is: Can we—and are we willing to—act in time? SPARTANAT author Jörg Dreger explains why personal responsibility, situational awareness, and leadership ability will determine whether organizations remain capable of acting in the future.

Security Can No Longer Be Taken for Granted

As early as tomorrow, an event could pose an existential threat to an organization or a key performer. In addition to system failures, natural disasters, and accidents, we must anticipate adversaries who deliberately exploit vulnerabilities and disable critical functions.

Security is not an isolated discipline. It is part of the entire performance chain and must integrate people, processes, technologies, and resources. Its purpose is clear: organizations must remain capable of making decisions and taking action even under extraordinary stress.

Not Placebos, but Effective Solutions

We do not need symbolic security measures that look impressive on paper but fail in an emergency. Concepts and certifications are no substitute for actual capabilities.

What is needed are concrete solutions for threat mitigation that meet four conditions: They must be effective, organizationally feasible, achievable with available personnel, and economically viable. A measure that no one can operate, whose ongoing operation cannot be financed, or that collapses under pressure is not a solution.

Good measures also support day-to-day operations: clear responsibilities, reliable information channels, and well-coordinated processes improve efficiency and speed during normal operations. Security must not be a costly parallel universe.

Personal responsibility begins before an incident occurs

Anyone who expects the government, authorities, or external service providers to solve every problem in a timely manner in an emergency is taking a considerable risk. Public emergency response remains indispensable, but it cannot intervene everywhere at once.

Companies and organizations must identify their critical functions, set priorities, and take their own precautions. This does not mean having to do everything on their own. Rather, it is about networking existing capabilities, involving partners, and organizing support in advance in a binding manner.

Not everyone needs a large crisis management team. But everyone needs clear responsibilities, robust processes, and a leadership structure that works with the people and resources actually available.

No Effective Leadership Without a Situational Picture

Those who do not know what is happening cannot make targeted decisions. An up-to-date, robust situational picture is therefore the foundation of any effective emergency response. It is not about collecting as much data as possible, but about translating relevant information into concrete decisions.

What has happened? Which locations, people, supply chains, and processes are affected? What capabilities are available? Where are resources lacking? Who decides, who acts, and with what priority?

A situational overview must be appropriate for every level, from the operational team to senior management. It should be kept up to date with reasonable effort and utilize existing data. Even the best overview is useless if it is not available in an emergency.

Leadership from the Very First Moment

Crises do not wait for working groups to be formed, responsibilities to be clarified, or new systems to be procured. Leadership, decision-making, and communication must function from the very first moment—even when regular infrastructure fails.

This requires accessible decision-makers, clearly defined authorities, readily available situational information, alternative communication channels, and well-rehearsed procedures. This does not necessarily have to be expensive. Significant improvements can often be achieved with existing resources and targeted additions. What matters is not the scale of the plan, but its practicality.

Capability to Act Rather Than Reactive Measures

In the face of growing threats and scarce resources, we can afford neither inaction nor reactive security measures. We must consistently think in terms of results: What impact is required? What capabilities must be in place to achieve this? And how can they be organized in a sustainable, affordable manner with realistic staffing levels?

It is not the number of measures adopted that determines security, but their effectiveness at the decisive moment. Five to twelve, twelve o’clock, or five past twelve: What matters is that insights are finally turned into actionable steps.

The next article will focus on the situational picture: How can an up-to-date, meaningful, and decision-relevant situational picture be created and utilized at any desired level—particularly within companies—with a reasonable amount of effort?

JÖRG DREGER is a managing partner of DREGER Group GmbH and has more than 30 years of operational experience in information and communication technology as well as in security and crisis management. His focus is on holistic security concepts, the protection of critical infrastructure, and the ability of organizations to lead and act effectively in crisis situations.

He is a member of the Executive Board of the German Society for Defense Technology (DWT), spokesperson for the section and working group leaders, and the Rhine-Main regional representative of the Federal Association for the Protection of Critical Infrastructure (BSKI). In addition, he is actively involved as a speaker and organizer in the security policy dialogue.

DREGER Group online