Today I officially launched Take the Punch™. It’s the business-facing side of the Operational Survival work I’ve been developing here. The first product is the $495 Operational Survival Checkup™ for small businesses. The idea is pretty simple: most businesses have some kind of Plan B for when technology goes down. I want to help them find out whether that Plan B will actually work before they have to depend on it. A business owner should come out of the Checkup knowing where they’re solid, where they could get into trouble, and the Top 3 things I’d fix first. But there’s another reason I’m doing this. I don’t want Calm Under Attack™ to become a bunch of pretty frameworks that sound good in a classroom. I want this work tested against real businesses. Can we help an owner see a problem they didn’t see before? Can we give them something practical enough to use when technology goes sideways? Does the Checkup leave them better prepared than they were an hour earlier? And just as important: what do we learn every time we do one? That field experience will feed directly back into the practitioner training I’m building for CUA. Eventually, I want trained practitioners to be able to take this work into organizations and help them become better prepared for the day critical technology isn’t available. Take the Punch™ is where we prove the work holds up in the real world. The website went live today: TakeThePunch.com Now we need some businesses to punch. 😁🥊

If you've been in this group for a while, you probably noticed I moved some furniture around. 😄 Calm Under Attack™ has been evolving as I've worked through the Operational Survival methodology with real business scenarios. One question keeps pulling the work forward: What absolutely has to keep working when critical technology doesn't? I've also started looking at the methodology from another angle. There are experienced IT, cybersecurity, business continuity, risk, and resilience professionals who already know what technology disruption looks like in the real world. They've dealt with outages, incidents, failed recoveries, ugly dependencies, workarounds that worked, and some that absolutely did not. I'm exploring whether Operational Survival could become a professional capability those practitioners can use with organizations — and potentially a specialized service they can offer. So I've changed this community into the Calm Under Attack™ Lab. This is where I'm going to share cases, test ideas and tools, and ask you to challenge the methodology based on what you've seen in the real world. I've put a new Welcome post at the top of the group that explains where I'm headed and has a question I'd really like your take on. Go give it a read when you have a minute — and please answer the question at the bottom. I don't need polite answers. If you think I'm onto something, tell me why. If you think there's a hole in it, I want that too. That's what the Lab is for. — Chris

We have a new member @Mohammed Montaser Motaleb 👋 Welcome to the community. Glad you found us! We're building a practical approach to a simple question: When critical technology fails, can the business keep operating? Feel free to look around, jump into a discussion, or tell us a little about yourself and what brought you here. Glad to have you with us!

I'm doing a short study on what actually happens to small and mid-sized businesses when the technology they rely on suddenly isn't available. Internet goes down. A cloud application is unavailable. Phones stop working. A technology provider has an outage. Maybe it's a cyber incident or a power outage. Can the business keep operating? And if so, how? That's what I'm trying to learn. You don't need to be a cybersecurity or IT person to participate. I'm looking for the perspective of people who actually own, lead, manage, or operate businesses. The survey takes about 8–10 minutes: Small Business Technology Disruption Study – Fill out form If you know a business owner or leader who might be willing to participate, I'd appreciate you passing it along to them too. Thank you!

Cybersecurity has sometimes earned a reputation as the Department of No. Can we use this new tool? No. Can this vendor connect remotely? No. Can we use this cloud service? No. Except the business still has work to do. And if people can't get what they need through the approved process, some of them will find another way. Maybe someone buys a SaaS application on a credit card. Another team starts using an unapproved messaging platform. A spreadsheet quietly becomes part of a critical workflow. Someone automates a process with a tool IT doesn't know exists. Welcome to the Department of Shadow IT. From an operational survival perspective, this creates a problem we don't talk about enough: invisible dependencies. The systems inventory says one thing. The business may actually operate another way. Maybe the continuity plan still lists a manual workaround that disappeared years ago. Maybe a supposedly noncritical application feeds the spreadsheet someone needs every morning. Maybe an entire department now depends on a cloud service that never made it into the business impact analysis. Everything works fine—until something doesn't. Then somebody says: “Wait. We can't do that without ______.” 💬 Food for thought: What technology has your organization quietly become dependent on that might not appear in your official inventory, business impact analysis, or continuity plan?