Community resilience is national resilience

My day job is complex assurance for large programmes. A good deal of my learning comes from somewhere else entirely: co-founding a community interest company, serving as a trustee at a local Citizens Advice, and previously serving as an elected education governor. Different rooms, same lesson — resilience is distributed far more widely than our national conversation assumes.

The thinnest part of the chain

A small advice charity holds debt letters, immigration paperwork, housing disputes and safeguarding notes. A school holds children's records and free-school-meal status. A community group holds the phone numbers of people who would be at genuine risk if their contact with that group became public.

These organisations carry sensitivity comparable to a mid-sized enterprise, on a fraction of a per cent of the capability. Typically there is no security function, no asset inventory, one person who is good with computers, and a volunteer base using personal devices because that is what exists.

The consequence of a breach here is not a share price. It is a person losing the one service they trusted.

Why the standard playbook does not transfer

Hand a charity a control framework and you will get polite agreement and no change. Not through lack of will — through arithmetic. Frameworks assume a budget cycle, a change process, and someone whose job it is to read them. Advice designed for organisations with those things is, for everyone else, a list of reasons to feel inadequate.

What has actually worked, repeatedly, is much smaller and more specific.

• Multi-factor authentication on email and the case management system, set up in the room, that day, with the volunteers present.
• One named person who knows who to call — and a printed card with the number, because the incident may be the reason the laptop is unavailable.
• A recovery answer for the two or three records that would genuinely stop the service, tested once rather than documented forever.
• Removing accounts of people who left, which is dull, free and repeatedly the thing that mattered.
• Permission to say no to a donated system nobody can maintain.

Trust is the asset

People approach a local advice service or a school at the point where they have run out of other options. That willingness to walk in and disclose something difficult is the asset being protected, and it is more fragile than any database. Once it is gone in a community, it does not come back on a project timeline.

This is why inclusion is not a soft add-on to resilience. If guidance only works for people with confident English, a modern device and stable housing, it excludes precisely the people whose exposure to harm is highest.

What I would ask of the profession

• Volunteer specifically, not generally: one clinic, one migration, one incident plan — finished.
• Translate, ruthlessly. If a trustee cannot act on your advice unaided, it is not advice yet.
• Design for churn. Volunteers rotate; controls that depend on one enthusiast fail quietly.
• Measure whether the service stayed available, not whether the maturity score moved.

National resilience is often discussed as critical infrastructure and large enterprise. Both matter. But the day-to-day resilience most people actually rely on sits in organisations run by trustees and volunteers who have never once been offered help by someone like us. Offering it is some of the highest-leverage work available in this profession.