<p>One aspect of supply-network security merits particular attention--employee screening and hiring practices. The leading companies have developed a core competency of preventing the "enemy from within" from being hired in the first place. </p><p>But even among the most security-conscious companies, effective screenings need to extend beyond the hiring process to include ongoing tracking and assessment of each employee and third-party provider with security access. This requires careful record keeping to alert the company to potential threats from anyone with enough knowledge and access intent on defeating the security system. While this may seem extreme, if such a procedure had been in place, it may have prevented a previously trusted third party from releasing nearly one million liters of raw sewage into local rivers from a wastewater plant in Australia. The offender was a contractor who installed the wastewater control system and who was subsequently turned down for a position at the wastewater plant. In retribution, he used his knowledge of the system to penetrate the plant and release the sewage.2 </p><p>The hiring and screening process poses special challenges for transportation companies. With motor carriers, for example, the security of their operations can be dictated by the driver's activities and attitude. Yet background information on driver job applicants can be difficult to access. In some cases, records are kept at county levels within states, making it difficult and costly to identify drivers with poor track records in advance of hiring. A proposed federal Transportation Workers Identification Card (TWIC) may provide a common database for assessing a driver's security level, but this is a long way from implementation. In the meantime, companies need to be as vigilant as they can in conducting background checks during the hiring process. </p><p><b>Actions to Improve Resilience </b> </p><p>Just as some initiatives focus squarely on security, others are directed toward resilience. In materials science, resilience is the physical property of a material that can return to its original shape or position after a deformation that does not exceed its elastic limit. In today's business environment, resilience is widely used to characterize an organization's ability to react to an unexpected disruption, such as one caused by a terrorist attack or a natural disaster, and restore normal operations.3 </p><p>Beyond enabling a company to maintain operations following a disruption, resilience potentially can be a competitive advantage if you can respond more favorably to disruption than the competition. This might mean being ready to capitalize on opportunities to serve your competitors' customers if your competitors cannot. </p><p>Even in cases where the disruption affects the competitors equally, companies can compete on their resilience capabilities. This was evident in the respective responses of Nokia and Ericsson to the loss of a supply of radio-frequency chips (RFC) in early 2000. While both competitors depended solely on Philips Electronics for RFCs and were thus equally affected by a fire in the main Philips RFC plant, their responses could not have been more different. Nokia immediately sensed the disruption and responded aggressively, dedicating 30 employees to work with Philips and other suppliers to maintain a steady RFC supply. Ericsson, on the other hand, did not sense the seriousness of the disruption and ultimately mounted only a modest effort to restore supply. The net effect was that Nokia achieved its sales plans, while Ericsson missed a critical new product introduction that amounted to an estimated $400-million-revenue loss. Ericsson ultimately exited from the business of making cellular phones.4 </p><p><b>Resilience through Flexibility and Redundancy </b> </p><p>Of all the ways to create resilience, two methods hold the greatest potential. One involves flexibility, the other redundancy. Each approach has different cost and service characteristics that are important considerations when designing a supply network for resilience. </p><p>Flexibility entails creating capabilities within the organization to respond. These capabilities are mainly developed through investments in infrastructure and resources before they actually are needed. Initiatives to improve flexibility would include, for example, developing a multi-skilled workforce, designing production systems that can accommodate multiple products and real-time changes, and adopting sourcing strategies that permit transparent switching of suppliers. By using flexibility, the company redeploys some existing capacity in one area to make up for lost or delayed capacity in another area. This involves some costs for designing rapid change operations that accommodate multiple products and for developing a multi-skilled workforce. </p><p>Redundancy, by contrast, entails maintaining capacity to respond to disruptions in the supply network, largely through investments in capital and capacity prior to the point of need. Redundancy is central to such efforts as managing inventory, maintaining production lines or facilities in excess of capacity requirements, committing to contracts for material supply (buying capacity whether it is used or not), and maintaining a dedicated transportation fleet. </p><p>An important distinction between flexibility and redundancy is that the latter involves capacity that may or may not be used; it is this additional capacity that would be used to replace the capacity loss caused by a disruption. Flexibility, on the other hand, entails redeploying previously committed capacity. This implicitly involves making tradeoffs among producing different products or serving different customers, which would not be the case with redundancy. </p><p>Ultimately, a company will likely adopt a mixture of these flexibility and redundancy alternatives, depending on different cost and service characteristics as well as on specific business and industry factors. </p><p><b>Additional Responses to Create Resilience</b> </p><p>In addition to the approaches just described, respondents to our survey reported pursuing many other actions to enhance resiliency in their supply network. The range of these responses, not all of which are new, suggests that no single approach fits all situations. Exhibit 1 lists those responses, categorized by failure mode--that is, by disruption in supply, transportation, facilities, communications, or human resources. It's important to focus on the failure mode for this reason: While there are unlimited sources of disruption, there are relatively few failure modes. Addressing the failure mode, therefore, facilitates action and gets the organization moving toward an appropriate response. </p><p>For each response listed in the exhibit, we present the respective advantages and disadvantages. Ultimately, a company needs to pursue those particular responses that make the most sense for them based on a range of operational and market factors. There is no one single "silver bullet" response. </p><p>Note that many of the responses listed in the exhibit revolve around the decision to sole source or dual source for capacity.5 Equally strong arguments exist for both approaches. In the end, the company will need to trade off the risk mitigation and cost factors of multiple sources and locations vs. forging closer, more responsive sole-source relationships. </p><p><b>Activities to Achieve Security and Resilience </b> </p><p>To this point, we've discussed actions to increase either the security or the resilience of the supply network. But beyond these actions, certain responses can provide dual benefit to security and resilience, although not necessarily in equal measure to both. These responses are more likely to gain wider support because they typically have more tangible benefits associated with them and thus have a broader appeal across the organization. </p>