War, resilience,

decision making:
lessons learned by entity from Kyiv, Ukraine

Anastasiia Konoplova, CISA, CRISС,CDPSE, CISA, CRISС,CDPSE Trainer, owner&CEO of LLC UAG (UA
resident, continuity since 1999), ISACA Kyiv Chapter President 2018-2020, master of economics
(economic cybernetics), experience in assurance and consulting in risk, information technology
management and information security management systems since 2005.
More about professional activity:
Profile: https://www.linkedin.com/in/anastasiia-konoplova-9342b57b/
Public activity: https://www.slideshare.net/AnastasiiaKonoplova
Blog: https://www.facebook.com/llcuag

24.02.2022 -28.03.2022 Reputation: https://ec.europa.eu/futurium/en/Women4Cyber

Tools, we used
Criteria: applicability to reality (quite chaotic)
1. Frame: BANI world
Idea, 2020 Perception, 2022

https://stephangrabmeier.de/bani-versus-vuca/ https://www.weforum.org/reports/global-risks-report-
https://medium.com/@cascio/facing-the-age-of-chaos-b00687b1f51d 2022/data-on-global-risks-perceptions#report-nav
2. Planning within frame: complexity science

Science: https://www.art-sciencefactory.com/complexity-map_feb09.html
Applied for policy making: https://publications.jrc.ec.europa.eu/repository/handle/JRC123629
Applied in project management: https://www.agilealliance.org/agile-practice-guide/
Described model: https://thecynefin.co/about-us/about-cynefin-framework/
3. Decomposition to do: WEF resilience framework for complex organizations

• Redundancy
•The most expensive approach, because it requires non-performing assets
•Modularity
Structural •Modules are loosely coupled: separate them too much and you no longer have a system, couple them too tightly and you
resilience lose the adaptive capacity
•Requisite diversity
•Requires addressing the hard question of which diversity is fit for purpose for this problem at this time

•Multi-scale interactions
•It is perhaps most obvious in the geographic structure of individuals, families, neighbourhoods, cities, provinces and
countries. The health of the connections at and between each scale is a potent contributor to the resilience of a system.
Integrative •Thresholds
•The past of every organization shows discontinuities, but its future plans are always smooth. The fact that threshold effects
resilience generally cannot be forecast does not mean they should be ignored
•Social cohesion
•Such as the social capital an organization has to fall back on in times of crisis

•Distributed or polycentric governance

•Centralizing authority may seem efficient, but it often comes at the expense of resilience.
•Foresight
Transformative •Which is not the same as forecasting. Systemic effects generally cannot be extrapolated from past data, but require different
techniques to engage with the uncertainty of multiple futures.
resilience •Experimentation and innovation
•Building capacity for change in an organization requires the capacity to explore the edges of the system. This implies having
people with the time and resources to go outside the usual organizational boundaries, into possibly uncomfortable territory.

Source for this infographic: https://reports.weforum.org/global-risks-2018/resilience-in-complex-organizations/

Insights from the Science of Complexity: http://www3.weforum.org/docs/WEF_GAC_PerspectivesHyperconnectedWorld_ExecutiveSummary_2013.pdf
More about five components of resilience: 1) robustness, 2) redundancy, 3) resourcefulness, 4) response and 5) recovery: http://www3.weforum.org/docs/WEF_GlobalRisks_Report_2013.pdf
Scheme created by Anastasiia Konoplova, 19.04.2020
Solution, we applied
Criteria: ethics, limited resources, long-term impact
1. Selecting scenarios: risk reports and environment analysis

Was it unpredictable?

No, it wasn`t.
Locally nor globally.

It was a decision, to consider

scenario or not.

It continues to be the decision.

2. Prepare to act: working on maturity and developing triggers

Solution to be prepared for whatever

1. Recognize defaults, what is the 2. Act from that perspective in
most important, truly every situation
• Personally: • Gather data, check data, recognize lack of
consciousness, mindset, consistency data
• In community/team: • Interpret data to classify situation
strength of culture and links • Take decision
• In entity: • Act
maturity (top level of process maturity
models)

In critical (life and death) situations work instinctive defaults. Not compromise, not considerations.
Any inconsistency influences severity of consequences in case of emergency.

Bank of England has already issued similar methodology for the business, effective from 31.03.2022, full force from 2025:
https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/operational-resilience-sop
3. Tracking and checking results: lessons learned

Current outcome in war, short-term (~1 month)

Works Fails

• Pre-set clear trigger for actions • Interest-based commitments

– when to do, what to do (not values-based)
• Experience of decision making in • Compromise decisions wherever
crisis situations • Postponed problems
• Established trustable • Security theater
relationships with partners
• Feeding fears instead of
• Force-major in contracts, literally
checking facts
• Digitalized operations
• Redundant backups: plans, data,
tools, finance
4. Continue to be prepared

What to consider to be prepared for consequences of war

• Updated map of hostilities
• https://groshi.edopomoga.gov.ua/
• International news digest from Ukraine (influence policy)
• https://t.me/alert_ukraine
• Facts on infrastructure on battlefield (ua; look at maps of working train
stations)
• https://t.me/UkrzalInfo
• Mostly facts-based military analytics ()
• https://medium.com/@x_TomCooper_x
• Rational scenarios analytics (en; considers selected signals, doesn`t
consider non-rational mechanisms of decision making)
• https://globalguessing.com/tag/russo-ukrainian-war/
• Satellite (Sentinel) monitoring on military bases around Ukraine
• https://texty.org.ua/projects/105463/unveiled-threat-russian-military-bases-satellite-
monitoring/
Takeaway
1. Uncertainty is beatable.

2. You can manage your decisions in each situation.

3. Consistency with values defines outcome

If you want to help Ukraine: https://www.comebackalive.in.ua/