Minimum viable company (MVC)

That was yesterday. Disruption is not an if question anymore but when. Cyber-attacks take down whole enterprises. Cloud usage and software elements malfunction without prior notice. Geopolitically sensitive supply chains. Unpredictable weather and energy disturbance can disrupt electricity, fuel supplies, and operational facilities on a large scale.

These conjoining blowouts arrive faster and hit harder than organisations can endure. Looking at the ability to respond to a major incident, six per cent of organisations claim to be ‘very capable’ across all substantial aspects.

Your organisation depends on a core set of services and processes to keep running when disruption hits. Our minimum viable company (MVC) approach strengthens your business resilience by helping you identify the capabilities, processes and dependencies that are essential to delivering your most critical services. It connects business continuity, cyber resilience, operational resilience, technology, data and third-party dependencies into one practical framework. By defining what must remain operational and designing recovery options in advance, you can limit disruption, protect stakeholder trust and recover within agreed outage tolerances.

Minimum viable company is the smallest set of capabilities that must remain operational to keep the organisation running through severe disruptions. This model has three components, which allows organisations to deliver critical strategic outcomes during a crisis.

1. Vital outward-facing solutions and services
2. Vital behind-the-scenes activities and procedures
3. Essential underlying components

Managers prefer to know wether the organisation is resillient enough to withstand a disruption when it appears. Additionally, this means questioning if spending on resilience can generate tangible returns instead of being viewed solely as a cost. Through revenue protection, capital preservation, reduced regulatory risk, maintained trust, and accelerated recovery, resilience investments demonstrate their value. The concept of a MVC plays a crucial role in addressing these challenges during the most severe disruptions.

Your leadership faces a clear question: what does ‘viable’ really mean for your organisation when you focus on any type of crises that matter most. This starts with deciding what must stay up and running, instead of treating every system and service as critical.

Together, we map out a clear timeline of your essentials: the most important services, customer commitments, internal workflows, technology and third-party connections, regulatory requirements, acceptable impact levels, and recovery priorities. This gives you a clear understanding of how your MVC functions within the Dutch and broader European landscape, and highlights the areas where you should focus your efforts first.

Designing solutions for your MVC turns business resilience ambitions into practical capabilities. This means bringing together your existing strengths across business continuity, disaster recovery, cyber security, supply chain, physical security and wider operational resilience, and aligning them with the dependencies that support your most critical services. The result is an integrated resilience approach that enables the organisation to absorb disruption, adapt its operations and continue delivering what matters most.

The right answer for you might be a manual workaround, a substitution, an alternative supplier, or a trusted ‘technology lifeline’ you can switch to when your primary environment is at risk or cannot be trusted. Every design choice should bring together business, technology, data, third-party, and operational requirements so they act as a cohesive whole.

Different parts of your business may require different MVC setups. That could include a minimum viable factory for asset-heavy operations, or a minimum viable business for specific lines of service. We’ll work with you to develop and test these options, ensuring they are practical, resilient, and ready to support you when it counts most.

Defining your MVC is only the starting point. To determine whether it will hold up in practice, it is essential to assess your MVC against the scenarios that are most relevant and impactful for your organisation. These may include digital sovereignty challenges, cyber incidents, third party risk management failures, or other disruptions specific to your operating environment and risk profile. Applying these scenarios helps reveal vulnerabilities, dependencies and difficult choices before a crisis occurs, enabling you to strengthen the capabilities needed to keep critical operations running under pressure.

A resilient MVC also depends on how effectively you manage technology and third-party dependencies. Digital sovereignty helps clarify where control lies over critical data, infrastructure and access, while Third Party Risk Management provides insight into the suppliers, service providers and digital platforms your essential operations depend on. By identifying concentration risks, strengthening oversight and developing viable alternatives and contingency plans, you can help keep your organisation operational when a critical provider or technology environment becomes unavailable or can no longer be trusted.

Digital sovereignty and strategy 

What do digital sovereignty, cloud strategy, data ownership and technological resilience mean for your organisation? 

Read more about digital sovereignty and cloud strategy 

Third party risk management 

How well do you understand and manage the suppliers, service providers and digital platforms your critical operations depend on?

Explore more about third party risk management

You want to be confident that your MVC’s cyber and resilience setup can withstand serious, real-world threats. Together, we’ll put your plan to the test against tough but realistic scenarios that match today’s threat landscape.

Through these tests, you’ll see clearly how all parts of your organisation, people, systems, data, locations, and partners, depend on each other in practice. At the same time, your leadership team gets the chance to rehearse real decision-making, so when it matters most, you’re ready and united.

These tests also help validate critical dependencies, including third-party providers and key technology services, refine MVC playbooks and recovery sequencing, and identify improvement opportunities before a real disruption occurs. This helps ensure your recovery approach is practical, coordinated, and effective when it matters most.

Your MVC framework sits at the centre of how you govern and continuously strengthen Business Resilience across your organisation. Clear ownership, regular scenario testing, executive oversight and a fixed update cycle keep the MVC aligned with changes in your business, operating model and risk profile. Key Resilience Indicators give your board a concrete view of whether critical capabilities remain current, tested and understood, and whether the organisation can continue operating within agreed tolerances and risk appetites.