Beyond the four days — cases for the book · Energy
The disaster-recovery plan was excellent. It had been audited twice. It failed in an afternoon — not because anything in it broke, but because the world it assumed stopped existing.
The company — a mid-sized industrial group operating across a dozen countries — had done what every sensible company did: concentrated its systems with world-class external providers. Customer records in one cloud. Contracts and financial systems in another. Identity and access through a federated service. Every choice individually rational, every provider individually excellent. Recovery, in every scenario the plan covered, routed outward — to infrastructure the company did not own, in jurisdictions it did not control.
Then the geopolitics moved. A sanctions package, aimed at someone else, landed on the region where two of its providers were legally anchored. Data-localization rules tightened in its largest market. And in the space of one quarter, the arrangements that had been the company's safety net became its exposure: the jurisdiction its continuity depended on had become the source of the discontinuity.
The CIO's report to the board was one sentence long: "Our recovery plan assumes a friendly world, and the world has stopped being reliably friendly."
The deeper audit found the pattern everywhere. The company could not prove its own contractual history without a provider's cooperation. It could not operate its plants' coordination layer through a connectivity denial longer than hours. Its trust in counterparties ran through central platforms that a single legal order could switch off. And its most critical records were verifiable only as long as one particular authority chose to keep them verifiable.
Nothing was broken. The company had simply built itself on conditions it did not control — and the conditions had changed.
The board split into two familiar camps. One wanted to bring everything home — full sovereignty, own data centers, independence at any cost. The CFO priced that camp out of the room within a week. The other wanted to wait: "This is a political storm. Storms pass."
The CIO argued for a third posture, and gave it a name: continuity custody. Not owning everything — choosing, deliberately, which capabilities the company must retain custody of under stress, and architecting exactly those. Critical records verifiable by cryptographic proof, not by any provider's goodwill — replicated across anchors under different sovereignty, so no single authority could switch the company's history off. Operations designed to degrade gracefully: pre-authorized action sets and cached credentials that keep plants and teams working, within bounds, through a denial — with mandatory reconciliation after. Partnerships coordinated bilaterally, verifiable by both sides, with no central platform in a position to veto the relationship. And a short, hard list of actions that no system may ever execute autonomously, enforced in the architecture, not in a policy document.
"And the cost?" the chairman asked.
"Adopted now, in calm — eighteen months and a budget you will not enjoy," the CIO said. "Adopted during the next crisis — it cannot be done. This is the kind of insurance that is only for sale before the fire. The companies that wait for the volatility to arrive discover the time to adopt is no longer available."
The chairman looked around the table. "So the real decision is not technical. It is a judgment about the world: whether the last quarter was an exception — or the new baseline."
Nobody in the room believed it was an exception.
Anchor: federated continuity (receipts that survive jurisdictional conflict · multi-anchor verification · graceful degradation · bilateral coordination without central authority · hard-coded exclusions); "adopt before the need is acute — retrofit does not scale." Keep the room off vendor debates; the case is about posture, not products. Question 1 works best written silently first, then compared — the lists are always longer than people expect.
A question for the table, a disagreement, what you would have done. The case lead reads every comment; the ones the table takes up enter the chapter as questions from the room, with your name.