The fourth industrial revolution has brought several risks to factories along with its plethora of benefits. The convergence of new technologies, legacy technologies, information technologies and operational technologies in the same network generates a wide attack surface. At the same time, factories need continuous production to meet their customers' demand, so any stopped production can have harsh effects on a factory's economy. This makes cyber resilience a key requirement in factories nowadays. However, it is difficult for managers to define effective cyber resilience strategies, especially considering the difficulty of estimating adequate investment in cyber resilience policies before the company has suffered cyber incidents. In this sense, the purpose of this article is to define and model an effective cyber resilience strategy. To achieve this, the system dynamics methodology was followed in order to get five experts' opinions on the best strategy to invest in cyber resilience. Interviews were conducted with these experts; their reasoning was put into behavior over time graphs and a system dynamics model was built from these findings. The main conclusion is that a cyber resilience investment strategy should be dynamic, investing in both technical security and personnel training, but at first with an emphasis on technical security and later shifting to have an emphasis on training.

A growing majority of the world's population lives in cities, and the concentration of people and critical services in cities increases their exposure to acute shocks and long-term stresses. Therefore, building resilient cities that are able to resist and absorb threats and are capable of adapting to and recovering from shocks and stresses is vital for the wellbeing of society. Although the literature offers several studies on how city resilience can be improved, operationalizing resilience is still a challenge. This article describes the different phases of the co-creation process followed in the development of a maturity model that can guide cities in assessing and future improving their resilience level. This co-creation process was conducted using different methodologies involving an interdisciplinary group of international experts who contributed their knowledge and experience to the development process of the maturity model. The outcome of this process is the final version of a maturity model that operationalizes the steps that should be taken to build city resilience.

Climate change (CC) is one of the most challenging issues ever faced, as it affects every system worldwide at any scale. Urban areas are not an exception. Extreme weather-related events have seriously affected urban areas in recent years, and they have a significant impact on the welfare of people. According to UN projections, by 2050 more than 68% of the world's population could be concentrated in urban areas. Additionally, daily life in urban areas is highly dependent on certain critical services and products provided by critical infrastructures (CIs). Therefore, it is especially relevant to understand how CC affects urban CIs in order to develop mechanisms to improve their capacity to handle crises derived from CC. In this context, resilience-based strategies provide a holistic approach, considering both predictable and unpredictable threats. This paper proposes a guide for assessing and enhancing the resilience level of cities against CC, considering urban CIs as key agents in improving the city's capacity to face and recover from CC-related crises. The guide was developed through a co-creation process in which two cities in the Basque Country (Spain) worked together with CI providers and other relevant stakeholders in the resilience-building process. The resulting guide is to be used by city stakeholders at a strategic level, providing them with: (1) a qualitative assessment of the city's current resilience level in the CC context; (2) better knowledge about urban CI sectors, their interdependency relationships and the chain of impacts due to cascading effects in the short, medium and in the long term and; (3) a set of policies that enhance city resilience.

Unexpected crises and risks affect the urban population. Critical infrastructure dependency, climate change and social dynamics have captured the attention of city decision makers across different disciplines, sectors, and scales. Addressing these challenges mandates an increase in resilience. This article presents the development of the novel European Resilience Management Guideline (ERMG) developed by the European H2020 Smart Mature Resilience (SMR) project. It encompasses five supporting tools for city resilience. The purpose of this article is threefold. First, it describes the extensive co-creation methods used to establish, validate and test the five ERMG tools as collaborations among seven city stakeholders and researchers in Europe. Second, it explains concisely the features of each tool and its use and applicability in the city resilience building process. Third, it shows how EMRG supports strategic management in encouraging the visibility of risk dependencies, identifying vicious loops and potential cascading effects, and promoting collaboration between stakeholders to share resources. The article concludes with a discussion of SMR standardization activities to support the transfer of these research results to wider audiences. It covers guidance on local resilience planning and supporting efforts in building and operationalizing resilience at the city level.

A growing majority of the world's population lives in cities. This rapid urbanization increases the concentration of people and critical services in cities, which also upscale their exposure to acute shocks and long-term stresses such as floods, earthquakes, climate change or social dynamics. While all of these challenges are complex in themselves, in most cases, cities must face a combination of them. Resilience thinking demands cities plan holistically so that they are prepared for whatever shocks and stresses may arise. Although there is a set of frameworks aimed at building city resilience, frameworks specifically aimed at operationalizing the resilience-building process within cities remain undeveloped. This research begins to fill this gap by developing a Resilience Maturity Model (RMM) that provides cities with a roadmap for operationalizing the resilience-building process. For that purpose, the RMM defines a sequence of maturity stages and a set of policies that help cities to assess their current maturity stage and identify the policies that need to be implemented to improve their resilience level.

Citizens living in cities where public entities are committed to the development of city resilience are increasingly aware that the entire responsibility for preventing, responding to and recovering from crises cannot fully fall on public entities and private companies. In fact, citizens are more and more required to prepare for, respond to and recover from crises. To that end, there is an emerging need to involve not only public entities and private companies but also citizens in the process of building a city's resilience in order to understand the different perspectives on the same reality. This research paper is based on a systematic literature review to develop a framework that defines and describes the successful characteristics of public-private-people partnerships (4Ps) in the city resilience-building process. The framework-revolves around two criteria for classification: the dimension of the characteristics (stakeholder relationship, information flow and conflict resolution), and the attributes of the partnership. A preliminary list of relationships among the characteristics found in the literature is also presented. The aim throughout is to define which characteristics need to be developed in order to better ensure successful cooperation among the three main stakeholders: public entities, private companies and citizens.

Critical Infrastructures (Cls) play a relevant role in both society and industry since they provide ba sic goods a nd services. Cls are interependent on each other and a failure in one Cl may spread rapidly to other dependent Cls. The resulting cascading effect leads to the amplification of the perturbation, giving rise to high-impact crises. Modelling and simulation methodologies have been suggested as suitable tools to properly analyse and assess the effect and consequences of crisis in Cls. This paper undertakes a systematic literature review to study which modelling methodologies are the most appropriate for analysing Cls, depending both on the Cl sector and the scope of the modelling.

A resilience-focused approach requires the collaboration of a variety of stakeholders including the local government, emergency services, citizens, and companies in adapting to disasters. Currently however, governments fail to encourage stakeholders to take part in the resilience-building process. To address this challenge, this study presents a maturity model (MM) that provides local governments with a sequence of stages and policies to improve the collaboration with stakeholders. The MM was developed in close collaboration with six European cities and was put into practice through a case study in a UK city. The MM made it possible to assess the current stage of the city under study and to implement policies for engaging stakeholders in the resilience-building process. Finally, challenges associated with the involvement of stakeholders encountered in the city under study are discussed.

Recent efforts undertaken by international organizations and national governments to build cities' resilience illustrate the need to involve the different stakeholders of a city in the city resilience building process. Although there are studies that propose frameworks for building resilient cities, these studies do not provide detailed guidelines that include the sequential steps that local governments need to take to involve the different stakeholders in the city resilience building process. Given this gap, this paper presents a maturity model that provides an ideal sequence of maturity stages that can guide local government in how to involve the different city stakeholders in the city resilience building process. In addition, the maturity model provides a number of policies that local governments need to implement at each maturity stage in order to foster four principles (collaboration and networking, awareness and commitment, learning, and training and preparedness) that represent the foundation for involving stakeholders in the resilience building process. The maturity model was developed and validated as result of an iterative process that included semi-structured interviews with representatives from six different European cities

A resilience-focused approach leads organizations to improve the management of disasters through being aware, flexible, trained, and prepared, having committed top managers and staff, and being part of a wider network of stakeholders. Based on the organizational resilience principles identified in the literature, this article analyses the potential for improvement of the organizational resilience of disaster management organizations through their involvement in virtual communities of practice (VCoPs). VCoPs are groups of stakeholders from different organizations with a common interest that collaborate and exchange knowledge on a regular basis. This article presents a Delphi study that was conducted with a multidisciplinary group of international experts that work in disaster management organizations to evaluate the contribution of VCoPs. The results of the Delphi show that VCoPs help organizations to improve the organizational resilience principles. Nevertheless, there is still a series of barriers that organizations need to face in terms of collaboration and information sharing. This article classifies the existing barriers that hinder participation in VCoPs and suggests solutions to overcome them.

The welfare of society is more and more dependent on the proper functioning of Critical Infrastructures (CIs), and crises that affect CIs usually aggravate their impact on society. Therefore, improving the resilience of CIs is the most important objective of today's crisis managers. Although several resilience frameworks can be found in the literature, their implementation is still incipient and detailed prescriptions for their implementation are lacking. Moreover, some frameworks are only limited to describing the activities performed within the boundaries of the CI, neglecting the role of external agents. This research describes a practical and holistic resilience framework for improving the resilience of CIs taking into account the external agents. The framework is composed of three elements: a set of resilience policies; an influence table that assesses the influence of policies on prevention, absorption and recovery stages; and an implementation methodology that defines the temporal order in which the policies should be implemented. Two empirical studies were undertaken in two CIs to implement this framework. The studies show that the resilience framework helps CIs to diagnose their resilience level, detect areas of potential improvement and complement their risk management approach with a transversal approach to be better prepare to deal with crises. (C) 2015 Elsevier Inc. All rights reserved.

Para mejorar la gestión de desastres naturales es necesario que los agentes involucrados analicen las experiencias pasadas, identifiquen buenas prácticas y documenten lecciones aprendidas. Sin embargo, actualmente los agentes todavía tienen que hacer frente a una serie de dificultades para intercambiar la información y el conocimiento adquirido con el resto de agentes involucrados. En primer lugar, el conocimiento se encuentra fragmentado entre la variedad de agentes procedentes de distintos niveles jerárquicos, culturas y organizaciones involucrados en la gestión de desastres. En segundo lugar, no hay un repositorio común que facilite el intercambio de información y conocimiento entre diferentes organizaciones. Además, hay que añadir la dificultad para compartir información de carácter sensible como informes sobre lecciones aprendidas y buenas prácticas que pueden presentar errores cometidos por las organizaciones en eventos pasados. Por último, existe un exceso de información sobre la gestión de desastres naturales que los agentes no son capaces de analizar. Este artículo presenta un caso de estudio sobre el proyecto europeo ELITE que tiene como objetivo mejorar el intercambio de información y conocimiento entre la comunidad de expertos europeos en la gestión de desastres naturales. Para ello, el proyecto ELITE ha formado una Comunidad de Práctica Virtual (CPV) que agrupa a 70 expertos multidisciplinares en la gestión de desastres naturales a nivel europeo.

Purpose This study aims to present a resilience framework for critical infrastructures (CIs) taking into account internal and external stakeholders involved in a crisis situation and covering the four resilience dimensions defined in the literature, as well as providing practical policies to facilitate their implementation in practice. Design/methodology/approach The research methodology consists of an iterative process in which different research methods such as group model building, multiple case study and Delphi method are applied to gather knowledge from experts in the field. Findings This study presents a holistic and easily applicable framework for CIs where: first, a list of resilience policies is defined and second, the influence of each resilience policy in the three resilience life-cycle stages is assessed. Originality/value This study overcomes three of the main limitations that current resilience building frameworks have: some of them only focus on one resilience dimension without covering the four resilience dimensions of resilience, most of them only focus on internal stakeholders without taking into account external stakeholders, and finally, most frameworks limit to describe the framework theoretically without explaining how it can be implemented in practice.

The safety and proper functioning of Critical Infrastructures (CIs) are essential for ensuring the welfare of society, which puts the issue of improving their resilience level at the forefront of the field of crisis management. Most of the resilience-building principles defined in the literature do not cover all the dimensions that make up resilience and most of them only focus within the boundaries of the CI, neglecting the role of the external agents that also have an influence on enhancing resilience. Furthermore, most of the principles that are present in the literature are theoretical and difficult to implement in practice. In light of this situation, the aim of this research is to present a holistic resilience framework for critical infrastructures in order to improve their resilience level by taking into account internal and external agents and covering all the resilience dimensions. Furthermore, this framework has been defined in close collaboration with the general management of CIs to facilitate its implementation in practice. Finally, in order to illustrate the value added of this framework it was implemented in a nuclear plant.

While crises may appear to be event-driven, post-mortem accounts often identify factors that accumulate over time and increase the likelihood of failure. These factors are particularly difficult to anticipate when multiple organizations are involved in crisis preparation and event detection. Through the development of a systems-based model of crisis management, we learned that knowledge sharing can be accelerated or inhibited by the development of trust among organizations through the management of events. Is it possible to operationalize this finding? This hypothesis is being integrated into our current research in progress, a multi-national Community of Practice in disaster management.

The proper functioning of critical infrastructures (CIs) is vital for society¿s welfare. A disruption in one of them may lead to a crisis that affects not only the CI where the triggering event occurs but also the whole society. Therefore, it is fundamental to increase the whole system¿s resilience level. This paper defines resilience as the capacity of a system to prevent a crisis occurrence, to reduce the consequences from failure, and to recover rapidly and efficiently. Although there is much information about the definition of resilience, literature still lacks to provide a detailed holistic prescription about what activities should be carried out to improve the resilience level of the CIs and the society as a whole. This paper defines twelve policies that help to enhance the resilience level of all the stakeholders involved in crisis management, using information gathered from experts and examining several case studies.

The severe consequences of a Critical Infrastructure (Cl) crisis demand continued research directed toward proactive and reactive management strategies. Despite the best efforts of governments and communities, the diversity of stakeholders, conflicting demands for resources, and a lack of trust among organizations create complexities that limit the effectiveness of the response. This paper identifies four specific problems that appear to reoccur when Us are challenged: heterogeneity, multiple and inconsistent boundaries, resilience building and knowledge transfer and sharing. A combination of collaborative modeling and software simulation methodologies is proposed in order to identify the interrelationships among diverse stakeholders when managing the preparation for and reaction to a Cl crisis. This approach allows experts to work together and share experiences through the modeling process which can lead them to a better understanding of how other organizations work and integrate different perspectives. In addition, simulation models enable domain experts to understand the consequences of certain policies in the short and long terms, thus improving the crisis managers' knowledge for future crisis situations. This paper presents a practical case of a hypothetical crisis in the Cl sector and the approach used in order to deal with the four problems identified above. (C) 2013 Elsevier Inc. All rights reserved.

A major industrial accident is an unpredictable event which triggers a disruption in a Critical Infrastructure (CI). This disruption can spread through other sectors, affecting not only the CI where the triggering event takes place but the whole society as well. In the case of major industrial accidents, system resilience consists of both the resilience of the CI (internal resilience) and resilience of society (external resilience). Resilience is the system¿s ability to reduce the probability of failure, the consequences from failure and the response and recovery time. However, little is known about how to achieve a high resilience level. In this paper, using the information gathered from experts and examining several major industrial accidents, we derive twelve policies that enhance the system¿s resilience level. The definitions of these policies are clarified through real case examples where the consequences of their use or lack of use are explained.

Resilience building has become one of the most promising strategies for crisis managers to improve the security and proper functioning of critical infrastructures (CIs). Therefore, crisis managers will benefit from both general and detailed guidance for building and maintaining CI resilience levels. This paper aims to contribute to this purpose by presenting a framework that helps crisis managers improve the resilience level of CIs based on internal and external aspects of the CI that are often overlooked. This framework proposes sixteen resilience policies that have been suggested as influential in developing resilience. The influence and relative effectiveness of each policy in promoting the resilience of the system is postulated. The framework was reviewed and validated through an expert panel and a Delphi process providing grounded support for the evaluation and prioritization of the resilience policies. The results show that internal policies are the most influential ones when avoiding a crisis occurrence and external policies are most helpful when bouncing back to the usual state.

Las crisis son fenómenos complejos, de diversa naturaleza, la mayoría de las veces inevitables y cuya gestión resulta muy complicada. Por ello, para facilitar el proceso de gestión, es necesario realizar un profundo análisis de los posibles impactos que puedan ser consecuencia de una crisis. En el presente artículo se procede a analizar las diversas metodologías para la clasificación de impactos que se utilizan actualmente para, posteriormente, hacer una crítica constructiva sobre las dificultades que en dichas clasificaciones se encuentran. Finalmente se describen una serie de recomendaciones para mejorar el proceso de clasificación de impactos en situaciones de crisis.

Large crises management, affecting CIs needs multidisciplinary knowledge including technical, economical, social, political, legal and managerial knowledge. Being these crises international a huge variety of agents is involved in their response. This situation concludes in a set of stakeholders who only have fragmented knowledge. In the presence of dispersed and incomplete knowledge, and of fragmented and disrupted crisis management, the collaborative approach group model building (GMB), where modelling experts unify fragmented, tacit knowledge from domain experts, is a valuable option. However, GMB has been little used in CIP. We have done so in the context a European project on crisis management of large-scale power cut crises. Particulars in CIP ¿ variety of time horizons, different national perspectives, and challenges to create an international approach, among others ¿ require adaptations in the GMB approach. This paper describes such adaptations and provides insights for better future collaborative modelling

Introducción: Los grandes accidentes industriales son eventos impredecibles que se desencadenan con una interrupción en una Infraestructura Crítica (IC). Esta perturbación se extiende posteriormente a varios sectores, afectando a la IC en la que la crisis comienza pero también a toda la sociedad. Resiliencia es la capacidad de una infraestructura o un sistema para reducir la probabilidad de fallo, las consecuencias del fallo y el tiempo de respuesta y recuperación. Sin embargo, se sabe poco acerca de cómo conseguir un nivel adecuado de resiliencia. Método: Mediante la revisión bibliográfica de grandes accidentes industriales y entrevistas con expertos en gestión de crisis se han definido dos tipos de resiliencia. Cada uno de ellos se divide en varias dimensiones. Además se han identificado políticas de mitigación para aumentar el nivel de resiliencia del sistema. Resultados: En el caso de grandes accidentes industriales, la resiliencia del sistema se divide en dos: la resiliencia de la IC (resiliencia interna) y la resiliencia de la sociedad (resiliencia externa). A su vez, se definen doce políticas de mitigación que ayudan a mejorar el nivel de resiliencia del sistema, tal y como se muestra en diferentes casos reales analizados.

Crisis is a wide concept which may include a diverse set of events and behaviour patterns. Thus, crisis management requires complementary approaches that provide a more complete perspective. This paper describes a useful methodology to analyse crises from a multiple perspective approach that contributes to acquire a more deep understanding about crises and their management. The first approach focuses on the peak of the crisis paying attention to how to respond to the crisis¿triggering event and to the cascading effects that amplify the crisis impact. The second approach adopts a long¿term perspective, identifying the relationship between the policies implemented on the pre¿crisis phase and the subsequent impacts on the crisis peak and post¿crisis phases. The third approach researches on the learning process from one crisis to the next one.