The method · release 2026.08 · revised 26 August 2026
Every question, every weight, and the clause it answers to.
The Resilience Score is a weighted sum of 15 fixed answers across six domains. Nothing is inferred and nothing is hidden. An accountant, an insurer or a NIS2 auditor can reproduce this number by hand from the tables below.
Score formula
points lost on a question = round(weight × (1 − answer value))
score = 100 − Σ points lost
Question weights sum to 100. Each question is rounded once, so the points shown against every question add up exactly to the points missing from the score. Answers older than 90 days are marked stale and the score decays visibly until they are refreshed.
Domains and their share of 100
| Cash and liquidity | 22 |
| Clients and revenue concentration | 18 |
| IT and cyber | 18 |
| Suppliers and dependencies | 16 |
| People and key persons | 14 |
| Documentation and rehearsal | 12 |
| Total | 100 |
The 15 questions, in order
- 01ISO 22301 8.2 · NIS2 21(2)(c)
If revenue stopped tomorrow, how long would you keep paying salaries and suppliers from cash on hand?
Cash on hand and granted credit only. Not receivables you hope to collect.
Weight 8 · answer value · points lost More than 6 months 1.00 0 3 to 6 months 0.66 −3 1 to 3 months 0.33 −5 Less than 1 month, or unknown 0.00 −8 - 02ISO 22301 8.2.2 · NIS2 21(2)(c)
How often is a cash-flow forecast produced and read?
A forecast nobody reads counts as no forecast.
Weight 7 · answer value · points lost Weekly, rolling 13 weeks 1.00 0 Monthly 0.60 −3 Occasionally, when it gets tight 0.30 −5 Never 0.00 −7 - 03ISO 22301 8.3 · NIS2 21(2)(c)
Do you hold a granted, unused credit line or overdraft?
Granted in writing, drawable this week, without a new approval.
Weight 7 · answer value · points lost Yes, at least one month of fixed cost 1.00 0 Yes, but smaller than that 0.50 −4 Requested, not granted 0.25 −5 None 0.00 −7 - 04ISO 22301 8.2.2 · NIS2 21(2)(d)
What share of revenue comes from your largest client?
Last twelve months, invoiced. Group related entities together.
Weight 10 · answer value · points lost Under 10% 1.00 0 10% to 25% 0.66 −3 25% to 50% 0.33 −7 Over 50% 0.00 −10 - 05ISO 22301 8.2 · NIS2 21(2)(d)
How late do your largest clients pay, against agreed terms?
The gap between terms and the date the money lands, not the DSO you quote.
Weight 8 · answer value · points lost On terms, within 5 days 1.00 0 Up to 15 days late 0.60 −3 15 to 45 days late 0.30 −6 Over 45 days late, or unknown 0.00 −8 - 06ISO 22301 8.4 · NIS2 21(2)(a)
When did you last restore real data from a backup and check it worked?
A backup that has never been restored is an assumption, not a backup.
Weight 7 · answer value · points lost In the last 3 months 1.00 0 In the last 12 months 0.60 −3 Backups exist, never restored 0.30 −5 No backups, or unknown 0.00 −7 - 07ISO 22301 8.4 · NIS2 21(2)(h)(j)
Which accounts require a second factor to sign in?
Email, banking, accounting and any administrator account.
Weight 6 · answer value · points lost All of them 1.00 0 Banking and email only 0.60 −2 Some accounts 0.30 −4 None, or unknown 0.00 −6 - 08ISO 22301 8.4.3 · NIS2 21(2)(b)
At 22:00 on a Friday, your systems are down. Who answers?
A name and a number, with an agreed response time.
Weight 5 · answer value · points lost A provider under contract, with a response time 1.00 0 A named person inside the company 0.60 −2 Somebody would be found 0.30 −4 Nobody knows 0.00 −5 - 09ISO 22301 8.3 · NIS2 21(2)(d)
How many suppliers critical to delivery have no qualified alternative?
Qualified means you have bought from the alternative, or tested it.
Weight 9 · answer value · points lost None, alternatives are qualified 1.00 0 One, an alternative exists but is untested 0.66 −3 One, with no alternative 0.33 −6 Several, with no alternatives 0.00 −9 - 10ISO 22301 8.2.2 · NIS2 21(2)(d)
Do you know which suppliers would stop your operations within 48 hours?
Written down, dated, and reviewed in the last twelve months.
Weight 7 · answer value · points lost Yes, documented and reviewed this year 1.00 0 In our heads, not written down 0.50 −4 Partially documented 0.25 −5 No 0.00 −7 - 11ISO 22301 7.2 · NIS2 21(2)(g)
If your most critical person left tomorrow, what happens?
The person whose absence stops billing, delivery or production.
Weight 7 · answer value · points lost A deputy is named and the work is documented 1.00 0 A deputy is named, nothing is documented 0.60 −3 We would cope, slowly 0.30 −5 That part of the business would stop 0.00 −7 - 12ISO 22301 8.4.2 · NIS2 21(2)(g)
If the owner were unreachable for two weeks, could payroll and payments still run?
Bank authority, not goodwill.
Weight 7 · answer value · points lost Yes, a second signatory and a written procedure 1.00 0 A second signatory, no written procedure 0.60 −3 An informal arrangement 0.30 −5 No 0.00 −7 - 13ISO 22301 8.5 · NIS2 21(2)(c)
What state is your continuity plan in?
NIS2 Article 21(2)(c) requires documented continuity and crisis management.
Weight 5 · answer value · points lost Written and updated in the last 12 months 1.00 0 Written 1 to 3 years ago 0.50 −3 Fragments, in several places 0.25 −4 None 0.00 −5 - 14ISO 22301 8.5 · NIS2 21(2)(f)
When did you last rehearse a crisis?
A rehearsal produces a dated record of decisions. A conversation does not.
Weight 4 · answer value · points lost In the last 12 months, with a record 1.00 0 Once, over a year ago 0.50 −2 Discussed, never run 0.25 −3 Never 0.00 −4 - 15ISO 22301 8.4.3 · NIS2 21(2)(c)
Could you reach your staff, clients and bank with company systems down?
A contact list stored only on the network is unreachable in a ransomware event.
Weight 3 · answer value · points lost Yes, held offline and current 1.00 0 It exists, but only on our systems 0.40 −2 Partially 0.20 −2 No 0.00 −3