Recent website outages and the launch of the Government’s ‘Be Ready’ campaign offer a timely reminder that resilience is not just about protecting technology. It is about preparing people, organisations and communities to manage disruption.

When the digital world stops

Imagine arriving at work to discover that your organisation’s website is unavailable. Customers cannot access services, staff are struggling to complete essential tasks and your usual communication channels are no longer reliable.
What happens next?

On last week (21 October 2026), websites across Europe and beyond were taken offline as organisations responded to critical vulnerabilities in PHP, a programming language widely used to power websites. Some organisations temporarily withdrew services as a precaution while security updates were applied and risks assessed. The incident demonstrated how a vulnerability in widely used technology can create disruption across multiple organisations and countries.

Taking a service offline can be the right decision to protect systems and information. But it also presents a challenge: how do organisations maintain essential services when the technology they depend on is unavailable?

Cyber security helps protect our systems. Cyber resilience helps us manage when those systems are disrupted.

Cyber resilience is bigger than technology

Our reliance on digital services extends far beyond websites. Online platforms support payments, customer services, supply chains, public information and the delivery of essential services.

A disruption to one system can have consequences across an entire organisation, particularly when multiple services depend on the same technology provider or infrastructure.

This is why cyber resilience must be considered alongside business continuity, crisis management and wider organisational resilience.

Leaders need to understand what matters most, which activities must continue and what alternatives are available if normal operations are interrupted. Technical teams need to manage vulnerabilities and restore systems securely, while operational leaders make decisions about priorities, resources and service delivery.

These responsibilities are connected. Restoring a website is not necessarily the same as restoring the service that people rely on.

The key questions are straightforward –     

• Which of our services would have the greatest impact if disrupted?
• Do we understand our dependencies on suppliers, software and external platforms?
• Can we continue critical activities if our usual systems are unavailable?
• Have we tested our contingency arrangements, including alternative communications?
• Do our people know what to do, who makes decisions and when to escalate an issue?

If the answers are unclear, the organisation may be more vulnerable to disruption than its technology controls alone suggest.

Be Ready – a timely reminder of our shared responsibility

On 22 October 2026, the Government launched its updated Be Ready campaign, encouraging households to take practical steps to prepare for emergencies and temporary disruption to everyday services.

The guidance asks people to consider how they would manage for up to three days if services such as electricity, water, phone networks or the internet were disrupted. It includes straightforward actions, such as keeping essential supplies available and checking whether eligible household members are registered for additional support through the Priority Services Register.

The launch, immediately following the recent website outages, provides a timely opportunity to reflect on a common principle: preparedness is most valuable when it happens before disruption occurs.

We encourage everyone to explore the official Be Ready guidance and consider what practical steps they can take at home.

The campaign also offers a wider lesson for organisations. Resilience is not solely the responsibility of emergency services, technology specialists or those with formal resilience roles. Individuals, businesses, public services and communities all have a part to play.
Small, proportionate actions can help people manage disruption, reduce avoidable pressure on emergency responders and support the wider resilience of our communities.

      
From having a plan to being prepared

For organisations, documented cyber incident response and business continuity plans are essential foundations. However, a plan is only useful if people understand it and can apply it under pressure.

Consider a scenario in which a critical online service must be taken offline following the discovery of a serious vulnerability. There is no confirmed evidence of a successful attack, but the risk requires urgent action.

Customers need information. Staff cannot access familiar systems. Suppliers are seeking guidance and senior leaders want to know when services will return.

Decisions must be made despite uncertainty.

Can the organisation prioritise its most important activities? Are alternative processes realistic and available? Can teams communicate without relying on the affected systems? Who has the authority to accept risk, suspend a service or approve recovery?

These are the questions that exercises help organisations explore before a real incident forces them to find the answers.

A well-designed cyber resilience exercise does not need to be highly technical. It should test how people make decisions, work together, communicate and maintain essential services as circumstances change. The lessons can then be used to improve plans, clarify responsibilities and strengthen capabilities.

The aim is not to predict every possible incident. It is to develop the confidence and adaptability to respond effectively when the unexpected happens.

We cannot eliminate every cyber threat or guarantee uninterrupted digital services. We can, however, improve our understanding of risk, prepare practical alternatives and strengthen our ability to respond and recover.

At the UK Resilience Academy, we believe resilience is built through informed leadership, practical learning and exercising. It means turning awareness into action and ensuring that people understand not only what might go wrong, but what they need to do when it does.

The Government’s Be Ready campaign provides an important opportunity for individuals and households to take practical steps towards greater preparedness. Organisations should take the same opportunity to reflect on their own resilience.

So, if your website went dark tomorrow, would you know how to keep your most important services running?

And if everyday services were disrupted at home, would you know what you and your family needed to manage?

Take a look at the Be Ready guidance. Start the conversation. Test your plans. Take action now, before disruption makes the decisions for you.

Click here for information on the UK Resilience Academy Cyber Resilience Learning Pathway

To talk to us about developing your cyber resilience plans contact us here