<p>How effectively a company can quantify the impact may also depend on its ability to identify the collateral benefits of various investments in security and resilience. An investment in radio-frequency identification (RFID), for example, can improve not only security by tracking and monitoring cargo movements but also shipment visibility. And better visibility can translate to lower inventory requirements and improved service levels. Shippers and carriers that are developing "standards of care" for how to handle and protect shipments certainly will benefit from avoiding freight loss and damage. But they also will benefit from the resulting reduction in claims administration and lower insurance premiums. Investments in training on supply network risk and awareness have already produced a significant benefit for the city of Toronto. One may argue that officials in Toronto responded to the SARS (severe acute respiratory syndrome) outbreak early largely because they were alert for bioterrorism attacks--even though the outbreak was not an act of bioterrorism </p><p><b>Feeling Lucky? </b> </p><p>Managers have a wealth of options available for designing a supply network that is both secure and resilient. But any effort will likely fall short unless an adequate business case is made for investing in network security and resilience. And the business case cannot be made successfully unless the impact of a disruption is quantified to some degree. Critical to making the business case and quantifying the impact is recognizing that the company is dependent on external entities for network security and resilience--and not just on internal business operations. </p><p>A key lesson from our study, in fact, centers on the weakness of focusing solely on internal operations by considering only the likelihood of a terrorist attack or major disruption on your company. Because the probability of such an event is very low, some may feel lucky and not work to make their supply network secure and resilient. But the more prudent perspective is to recognize that your supply chain may be disrupted by events or sources that are completely external to your organization. </p><p>Ultimately, what determines whether or not a company takes action may actually come down to its organizational capabilities to learn and be motivated from past experiences, rather than the availability of new technologies or risk assessment methodologies. In all but one case, the survey respondents with the most progressive security and resilience initiatives had already suffered significant loss from a previous disruption.13 Each of these companies has since developed business continuity plans and more secure and resilient operations. So companies ought to ask themselves whether they prefer to plan for disruption and build the requisite organizational capabilities or to ask themselves every day, "Do I feel lucky?" </p><p>The "Response to Terrorism" Study James B. Rice, Jr., Federico Caniato The "Supply Chain Response to Global Terrorism" project, conducted by the MIT Center for Transportation & Logistics, has examined the response to terrorist attacks from several different perspectives: the manufacturing and distribution industry response, the risk management and insurance industry response, and the U.S. government response. The project also studied how companies have responded to past disasters in the hopes of identifying useful analogies that could inform and enrich the Center's work.1 </p><p>The organizations selected for the interviews were medium to large companies with operations in the United States and with supply chain subsidiaries or branches overseas. Semistructured interviews were conducted with a sample of 20 companies spanning a range of industries from high tech and aerospace to pharmaceuticals and consumer packaged goods. The sampling was based on an informal method that combined self-selection and convenience criteria--that is, those firms expressing an interest in the study and those with which the Center had an existing relationship. </p><p>Additional information on the research project study can be accessed at the project Web site, </p><p>http://web.mit.edu/scresponse</p>