The theory that public-sector agencies should rely on the private-sector resilience of owners/operators of critical infrastructure as a disaster-recovery strategy is both valid and useful. The question, though, is this: How does or should that reliance work in the real world? Unfortunately, it can be a chicken-or-egg scenario – i.e., what comes first, the resilience or the reliance?
