ESRM Program · Operations Cluster
Organizational Resilience
Find out how much your company depends on a few people, and fix it.
$2,500 fixed-fee assessment 3–4 weeks Credited toward the vCSO program
Measured against ISO 22316. Led by Don Oxman, CPP, CISSP, CISM. Licensed by Texas DPS. In business since 2013.
Most companies depend on a handful of people.
Organizational resilience is one of thirteen domains in our Enterprise Security Risk Management (ESRM) program, and part of the Operations cluster with Business Continuity, Crisis Management, and Supply Chain Security. It looks at the whole company: a Fort Worth distributor where one controller knows how the cash moves, or an owner who approves every order.
Resilience rarely has an owner. Leadership assumes the continuity plan covers it, and the plan's author assumes leadership has the bigger picture. Key people have no backup, and some decisions can only be made by one person. Those gaps tend to surface during a resignation or a bad quarter. We find where the company leans too hard on one person, and fix it.
Where companies tend to break under strain
Key-person dependency
One person holds the passwords, the banking relationships, or the customer knowledge. If they leave or get sick, the business learns how much it relied on them.
Unclear decision rights
When the owner is unreachable, nobody is sure who can approve an emergency expense, close a site, or speak for the company, so decisions wait.
Concentration risk
A single large customer, lender, landlord, or software platform that the business could not replace on short notice if the relationship ended.
Growth outpacing process
New locations, acquisitions, and new hires get added faster than policies, training, and controls can keep up, which leaves gaps nobody planned for.
Plans that don't connect
Continuity plans, IT recovery plans, and insurance policies written by different people at different times, with no one checking that they fit together.
Culture & fatigue
A team that hides bad news, or one already stretched thin before anything goes wrong, will have trouble holding up through a long disruption.
Five questions for leadership
- If your most important employee left tomorrow, what would stop working within a week?
- Is it written down who can make emergency decisions when the owner or CEO is unavailable?
- Would losing your largest customer or key supplier put payroll at risk?
- Do your continuity plans, IT recovery plans, and insurance coverage agree with each other?
- After something goes wrong, do the lessons learned actually change how you operate?
If you answered “no” or “not sure” to any of these, that is where we would start. Most of these gaps cost little to fix before an incident and a great deal to fix after one.
How an Engagement Works
Every ESRM domain starts with the same fixed-fee assessment. If you decide to continue, we credit the fee toward the program, and organizational resilience becomes part of your vCSO engagement alongside whichever other domains you need.
Organizational Resilience Assessment
- Interviews with the owner or CEO, the CFO or controller, HR, and your operations leaders.
- Structured review: a 15-question risk profile, a 25-point practices checklist, and a maturity score from 1 (Initial) to 5 (Optimized).
- Dependency map: the people, customers, suppliers, and systems the business would struggle to replace.
- Gap analysis against ISO 22316, the international standard for organizational resilience.
- Written report and prioritized roadmap, walked through with your leadership team. The report is yours whether or not you continue.
The fee is credited in full toward the program if you start within 90 days.
The vCSO / ESRM Program
- Assess (Q1): we start from your assessment findings and the dependency map.
- Build (Q2): succession and cross-training plans for critical roles, written emergency decision authority, and a resilience policy for leadership.
- Leadership exercise: a scenario session where your leadership team works through losing a key person, customer, or site.
- Growth reviews: before you commit to an acquisition, new site, or major contract, we look at the dependencies it adds.
- Operate (Q3+): we stay on as the named owner, tracking resilience measures and reporting to leadership or your board each quarter.
Month to month. Cancel with 30 days’ notice. About the vCSO program →
Leadership Resilience Sessions
- Scenario session on a disruption your leadership team is worried about.
- Leadership resilience workshop on making decisions under pressure.
- Succession review for the owner, executives, and other critical roles.
- Pre-acquisition session on the dependencies a deal would add.
Why Total 360
The whole company in view
Most consultants review one plan at a time. We look at how your people, plans, vendors, and leadership decisions hold up together, which is where weak spots usually hide.
Sized for owner-run firms
We build resilience around how a mid-sized Texas company actually runs, with plans your leadership team can keep current without a full-time risk department.
Experienced leadership
Led by Don Oxman: M.S. in Security Management, CPP, CISSP, CISM. U.S. Army and AT&T background. In business since 2013 and licensed by Texas DPS.
Common questions
What does a organizational resilience assessment cost?
$2,500, as a fixed fee. It usually takes three to four weeks from kickoff to the readout. If you start the vCSO program within 90 days, the full fee is credited toward it.
What do we get at the end of the assessment?
A written report with your maturity score from 1 (Initial) to 5 (Optimized), the gaps we found against ISO 22316, the international standard for organizational resilience, and a prioritized roadmap. We walk your leadership team through it, and the report is yours whether or not you continue.
Do we have to sign up for the full program?
No. The assessment stands on its own. If you continue, organizational resilience runs inside the vCSO program at $2,500 to $7,500 a month depending on scope. It is month to month, and you can cancel with 30 days’ notice.
Can we buy leadership resilience sessions without the program?
Yes. They are available to any client. Billed per session, quoted in advance.
Will you replace the people and providers we already use?
No. We work alongside your IT provider, attorney, insurer, and other advisors. We set the standard, help them meet it, and check that the work gets done.
Start with a 30-minute Risk Discussion
No deck and no sales pitch. Tell us what worries you most about the business and who it depends on. We’ll give you an honest read on the weak spots and send a scoped proposal within five business days.
Schedule a Risk Discussion Or call 817-677-0515 · info@total360security.com