- New research from Optro reveals a concerning disconnect
- 19 per cent of UAE organisations have a formal disaster recovery plan
- 38 per cent have established recovery time objectives and recovery point objectives
New research from Optro reveals a concerning disconnect between how resilient UAE organisations believe they are and how they actually perform during disruption.
According to the study, just 19 per cent of UAE organisations have a formal disaster recovery plan in place, the lowest figure recorded globally and significantly below the global average of 31 per cent.
Meanwhile, only 38 per cent have established recovery time objectives (RTOs) and recovery point objectives (RPOs) for all critical business processes, while just 22 per cent have fully mapped critical business processes to the technology systems, third parties and supply chain dependencies required to support them.
This is contrasted by confidence levels, which remain high.
Nearly three-quarters of respondents expressed confidence in their organisation’s ability to meet established recovery objectives during a major disruption, while 79 per cent said they were confident in their ability to demonstrate operational resilience compliance to regulators.
In reality, organisations that experienced a significant disruption during the past 12 months failed to recover within their established RTOs, with more than a third exceeding their recovery targets by more than twice the planned timeframe.
“The findings reveal a dangerous resilience gap. Many organisations have confidence in their preparedness, but confidence alone does not reduce downtime, protect revenue or accelerate recovery,” said Richard Chambers, Senior Advisor, Risk and Audit at Optro and former CEO of The Institute of Internal Auditors. “Operational resilience is ultimately measured during moments of disruption, and the data suggests many organisations are discovering weaknesses only after an incident has already occurred.”
“Recent events across the region have reinforced a reality that disruption can emerge from many directions and often with little warning,” Chambers added. “Whether organisations are dealing with geopolitical uncertainty, third-party failures, cyber incidents or operational outages, resilience cannot be assumed. It must be tested, validated and continuously improved. The organisations that recover fastest are rarely those with the most confidence. They are the ones that regularly challenge their assumptions through exercises, audits and independent reviews long before disruption occurs.”
