The Cyber Resilience Index: Advancing Organizational Cyber Resilience

The World Economic Forum and Accenture developed the Cyber Resilience Index (CRI) and the Cyber Resilience Framework (CRF) to address a global gap in organizational cyber resilience. The CRF establishes six core principles—ranging from risk assessment and security fundamentals to governance and culture—which serve as the qualitative foundation for the CRI. The CRI then quantitatively measures performance across 64 indicators to provide organizations and sectors with maturity ratings and benchmarks. The goal is to move beyond a narrow focus on security response toward a holistic, systemic approach to resilience that enables organizations to maintain operations despite disruptive cyber events.

• There is a significant perception gap between business executives and cyber leaders regarding organizational resilience; while 92% of business executives believe cyber resilience is integrated into risk management, only 55% of cyber leaders agree.
• A large majority of cyber leaders lack confidence in their organization's resilience, with only 19% feeling confident that their organizations are cyber-resilient.
• Cyber resilience in ecosystems is hindered by four primary factors: a narrow focus on response and recovery, a lack of common understanding of complete capabilities, difficulty in measuring and communicating value to leadership, and a lack of transparency regarding shortcomings and disruptive events.
• The Cyber Resilience Framework (CRF) is an industry-agnostic guide consisting of six key principles: regularly assessing and prioritizing cyber risk; establishing and maintaining core security fundamentals; incorporating cyber-resilience governance into business strategy; encouraging systemic resilience and collaboration; ensuring design supports cyber resilience; and cultivating a culture of resilience.
• The Cyber Resilience Index (CRI) quantitatively measures an organization's maturity by aggregating 64 performance measures mapped to the CRF's sub-practices, using a min-max method to scale scores between 0 and 100.
• The framework emphasizes that cyber resilience must extend beyond technical systems to include teams, organizational culture, and daily operations to allow organizations to take healthy risks and innovate.

APA

World Economic Forum (2022). The Cyber Resilience Index: Advancing Organizational Cyber Resilience. https://www3.weforum.org/docs/WEF_Cyber_Resilience_Index_2022.pdf

Chicago

World Economic Forum. The Cyber Resilience Index: Advancing Organizational Cyber Resilience. 2022. https://www3.weforum.org/docs/WEF_Cyber_Resilience_Index_2022.pdf.

Wikipedia

{{cite report |author=World Economic Forum |title=The Cyber Resilience Index: Advancing Organizational Cyber Resilience |date=July 2022 |url=https://www3.weforum.org/docs/WEF_Cyber_Resilience_Index_2022.pdf |access-date=23 October 2026 |via=Climate Insights Directory}}

BibTeX

@techreport{worldeconomicforum2022cyber, author = {{World Economic Forum}}, title = {{The Cyber Resilience Index: Advancing Organizational Cyber Resilience}}, institution = {World Economic Forum}, year = {2022}, month = jul, url = {https://www3.weforum.org/docs/WEF_Cyber_Resilience_Index_2022.pdf}, urldate = {2026-10-23}, note = {Indexed by Climate Insights Directory} }