Shared Taxonomy: Resilience Data as a Cross-Functional Unifier

Why Taxonomy Matters

In the first article in this series (Practice Is the New Proof: The Evolution of Resilience Exercising), we examined how resilience exercises are evolving into a meaningful source of operational evidence. Done well, they help organizations assess whether teams can coordinate effectively, make informed decisions, and recover critical operations under pressure.

Their value, however, depends on a shared view of the business. When Operations, IT, Risk, Compliance, Security, and third-party stakeholders rely on different terminology, data, and priorities, exercises can replicate the same fragmentation that slows response during a real disruption. BDO’s Techtonic States research reflects the scale of the issue: 42% of executives say their organizations lack the skills and infrastructure needed to navigate disruption effectively. In practice, exercises often reveal that gap through inconsistent information, unclear dependencies, and competing views of what matters most.

No single function can restore critical business services on its own. During disruption, leadership teams need aligned answers to four business-critical questions: 

1. What is impacted? 
2. What happens next? 
3. What is the financial exposure? 
4. What should we prioritize? 

A resilience exercise should test whether the organization can answer those questions quickly and confidently. A shared data foundation makes that possible.

The Challenge with Fragmented Ownership

Many organizations still devote considerable time to debating who owns resilience, who leads response efforts, which framework applies, and whose data should inform decisions. That friction can delay action, complicate accountability, and resurface each time structures or responsibilities shift.

This is often a sign of siloed resilience maturity. Functions are operating from different versions of the same business, and leaders must first reconcile conflicting information before they can assess impact, exposure, or recovery priorities. A common data foundation helps move the conversation forward by creating a shared view of critical services, dependencies, impacts, and recovery priorities. In exercises, that means participants can work from a common operating picture instead of interpreting the scenario through functional silos.

Building a Data-Centered Foundation

A data-centered approach reframes resilience around operational reality rather than organizational boundaries. It starts with stronger alignment across functions around critical business services and shared business priorities. It also requires organizations to identify authoritative data sources, understand where critical information resides, and evaluate data quality, ownership, and currency.

From there, the focus shifts to connecting information across business services, processes, applications, infrastructure, third-party providers, facilities, data, and people. Data becomes a strategic resilience asset when it is governed, connected, and maintained as the business evolves.

The Role of a Common Taxonomy

A common taxonomy gives connected data structure and consistency. It links critical business services to the processes, technologies, third parties, facilities, data, and teams that support them, forming the basis of a governed service-and-dependency model.

This can help organizations reduce ambiguity, normalize inconsistent information across functions, trace internal and external dependencies, and align impact tolerances with recovery priorities. It also supports better coordinated planning, exercising, response, and recovery. When these relationships are actively governed, leaders are better equipped to quantify disruption exposure and make more informed, evidence-based prioritization decisions.

“The value of a resilience exercise depends on the enterprise context behind it. When teams work from a governed service-and-dependency model, they can test the same four questions leaders must answer during disruption: What is impacted? What happens next? What is the financial exposure? What should we prioritize?”

Rich Cooper, Sr VP, Global Markets Transformation, Fusion Risk Management

From Shared Data to Better Exercises

A common taxonomy gives exercise participants a consistent operating context and supports more realistic scenario design. Exercises can be built around actual business services, internal and third-party dependencies, impact tolerances, and recovery priorities, keeping the focus on how the business operates rather than where functional boundaries exist.

That enables teams to trace cascading effects, assess operational and customer impacts, identify breakdowns in ownership or information flow, and evaluate whether recovery capabilities can perform as intended. After the exercise, findings can be tied directly to the services, dependencies, plans, and capabilities that need attention.

Technology plays a vital role in maintaining relationships between business services and their dependencies as conditions change. This creates a stronger foundation for scenario design, impact analysis, and recovery decision-making. AI can help accelerate analysis, but its value depends on trusted enterprise context connected to critical services, dependencies, and business priorities. Fusion Risk Management supports this approach through its Enterprise Resilience Decision System, which uses a continuously curated and governed service-and-dependency model to connect critical business services with the supporting processes, technologies, third-party providers, facilities, data, and teams involved.

Regulatory Expectations

Regulatory expectations continue to reinforce the need for this kind of operational evidence. While requirements vary, organizations are increasingly expected to understand their critical services and dependencies, define acceptable disruption thresholds, and demonstrate that recovery capabilities can operate within them. A shared taxonomy provides a more consistent basis for generating evidence through exercises.