IT resilience is the ability of an organisation's technology systems to keep operating, and to recover quickly, in the face of disruptions, whether those disruptions are hardware failures, power outages, cyberattacks, human error, or natural disasters. It is a broader idea than simple backup or disaster recovery: resilience means designing systems so that they either withstand a problem without going down, or return to service fast enough that the impact is minimal. It is a core component of overall business continuity.

Why is IT resilience important?

Organisations now depend on their IT systems continuously. When a critical system goes down, the consequences are immediate: lost productivity, lost revenue, disrupted services, and damaged reputation. For some services there is no acceptable downtime at all, they are expected to be always on. The threats to availability have also grown, from ransomware and cyberattacks to increasingly frequent extreme weather. IT resilience is what stands between a disruption and a genuine crisis, allowing an organisation to absorb the shock and continue serving its users.

What are the components of IT resilience?

Resilience is built from several capabilities working together.

Continuous availability aims to keep services running with minimal or no interruption, often through redundancy so that no single failure takes a system offline.

Redundancy and failover provide backup components, power supplies, links, servers, sites, that automatically take over when a primary component fails.

Backup and recovery ensure data can be restored after loss or corruption, and are the foundation on which recovery rests.

Disaster recovery is the documented, tested plan for restoring systems after a major disruptive event, defining how quickly service resumes and how much data, if any, might be lost.

Workload mobility and flexibility, the ability to move workloads between environments, on-premises, private cloud, public cloud, adds resilience by removing dependence on any single location or provider.

Resilience in network infrastructure

For networks specifically, resilience is engineered into the design through redundancy at every layer. Redundant power supplies keep a device running if one supply fails. Redundant links and ring topologies, using protocols that reroute traffic automatically around a broken connection in milliseconds, keep traffic flowing when a cable is cut. Link aggregation bundles multiple connections so the failure of one does not sever the path. High availability for critical services, such as the servers that assign addresses and authenticate users, prevents those services from becoming single points of failure. The aim is that no single component failure, and ideally no single maintenance action, can take the network down.

How is resilience measured?

Two metrics are central. The Recovery Time Objective (RTO) is the maximum acceptable time to restore a service after a disruption, how quickly you must be back. The Recovery Point Objective (RPO) is the maximum acceptable amount of data loss measured in time, how much recent data you can afford to lose. A system that must be back within minutes with almost no data loss has a very low RTO and RPO, and demands more investment in resilience than one that can tolerate hours of downtime. Defining these objectives is how organisations decide how much resilience each system actually needs.