# Resilience Guard GmbH > Swiss boutique advisory firm for organisational resilience, business continuity, enterprise risk, crisis management and cyber resilience. Founded 2014, headquartered in Steinhausen, Canton of Zug, with a subsidiary in Naples, Italy. Serves regulated and critical-infrastructure organisations across Switzerland, the EU and the UAE. Three lines of business: practitioner-led consulting, DRI International accredited training, and the Resilience Arena assurance platform. Resilience Guard GmbH (UID CHE-474.755.435) is led by founder John Zeppos, FBCI, CBCP, CCRP, a two-time winner of the BCI Global Award for Business Continuity Manager of the Year (2012 and 2014). The practice is deliberately small at twenty one specialists and has delivered 120+ engagements. It is the accredited DRI International training provider for Switzerland, Liechtenstein, Scandinavia, Greece and Cyprus, and has contributed to sixteen EU Horizon 2020 and Horizon Europe research projects. Work is anchored on ISO 22301, ISO 27001, ISO 31000, ISO 22316, ISO 22361, ISO 22398, ISO 28000 and ISO 42001, and on the regulatory regimes that now govern European resilience: NIS2 (Directive EU 2022/2555), DORA (Regulation EU 2022/2554), the CER Directive (EU 2022/2557) and KRITIS, EASA Part-IS (Regulations EU 2022/1645 and EU 2023/203), and the Swiss Information Security Act (ISG, SR 128). Two proprietary frameworks underpin delivery: the 7A Risk Management Framework, a board-level exposure-versus-confidence risk model, and DAEDALUS, an airport resilience framework with a certification scheme. Contact: +41 41 562 73 10, info@resilienceguard.ch, Turmstrasse 18, CH-6312 Steinhausen, Canton of Zug, Switzerland. ## Start here - [Homepage](https://www.resilienceguard.ch/): Firm overview, the three service lines, credentials and sector coverage. - [Consulting overview](https://www.resilienceguard.ch/consulting): The consulting practice, its four domains, and the Assess, Analyse, Design, Embed, Assure engagement method. - [Trainings overview](https://www.resilienceguard.ch/trainings): Full catalogue of accredited certifications, executive masterclasses and crisis simulations. - [Resilience Arena platform](https://www.resilienceguard.ch/platform): Swiss-engineered SaaS for crisis simulation, deterministic scoring and audit-ready compliance evidence. - [Contact](https://www.resilienceguard.ch/contact): Direct access to senior practitioners. Response within 24 hours. Working languages English, German, French, Italian, Greek. - [Book a consultation](https://www.resilienceguard.ch/book-a-consultation): Thirty-minute confidential scoping call with a senior practitioner, free of charge. ## Consulting services - [Business continuity management](https://www.resilienceguard.ch/services/business-continuity-management): ISO 22301 BCMS design, business impact analysis, recovery strategies, RTO/RPO/MTPD setting, exercised plans and audit readiness. A focused BIA runs weeks; a full programme runs a few months. - [Business continuity and crisis exercises](https://www.resilienceguard.ch/services/business-continuity-exercises): Tabletop, functional, gamified decision, cyber crisis and full-scale exercises, each producing documented evidence for ISO 22301, NIS2, DORA and KRITIS. - [Crisis management](https://www.resilienceguard.ch/services/crisis-management): Crisis command structures, escalation protocols, crisis communications and reputation management, aligned to ISO 22361. - [Organisational resilience](https://www.resilienceguard.ch/services/organisational-resilience): ISO 22316 and BS 65000 aligned resilience assessment, benchmarking and maturity roadmaps. - [Risk management](https://www.resilienceguard.ch/services/risk-management): ISO 31000 enterprise risk frameworks, risk appetite, horizon scanning, risk registers and board education. - [Cyber resilience](https://www.resilienceguard.ch/services/cyber-resilience): Anticipate, withstand, respond and recover capability spanning ISO 27001, the NIST Cybersecurity Framework, NIS2 and DORA. - [Information security](https://www.resilienceguard.ch/services/information-security): ISO 27001 aligned information security across physical and electronic domains, using a defence-in-depth control model. - [Supply chain security and third-party risk](https://www.resilienceguard.ch/services/supply-chain-security): Extended enterprise mapping, concentration risk analysis, provider assurance, contractual resilience obligations and joint exercises. Anchored on NIS2 Article 21 and DORA Pillar 4. - [AI governance and resilience](https://www.resilienceguard.ch/services/ai-governance-and-resilience): ISO 42001 aligned AI oversight across model, system integration, process lifecycle and board layers. EU AI Act aware. Uses the 7A exposure-confidence matrix for AI risk assessment. - [NIS2 compliance](https://www.resilienceguard.ch/services/nis2): Readiness assessment, implementation roadmap, policy development, training and ongoing monitoring for essential and important entities. - [DORA compliance](https://www.resilienceguard.ch/services/dora): ICT risk management, incident reporting, threat-led penetration testing, third-party oversight and regulatory alignment for financial entities. - [7A Risk Management Framework](https://www.resilienceguard.ch/services/7-risk-management-framework): Proprietary board-level risk operating model. Separates a Risk Exposure Index from a Confidence Index across seven capabilities: Anticipate, Assess, Analyze, Act, Advise, Audit, Assurance. - [DAEDALUS airport resilience framework](https://www.resilienceguard.ch/services/daedalus-airport-resilience): Proprietary airport resilience architecture unifying risk, operational resilience, crisis, continuity and cyber. Three editions, two-stage certification, three-year certificate with annual surveillance. Diagnostic phase runs six to eight weeks. ## Training and certification - [DRI accredited training](https://www.resilienceguard.ch/trainings/dri-accredited-training): Accredited DRI International provider for Switzerland, Liechtenstein, Scandinavia, Greece and Cyprus. Prepares candidates for CBCP, CFCP and ABCP credentials. - [BCLE 2000 business continuity](https://www.resilienceguard.ch/trainings/business-continuity-management-training): DRI's flagship business continuity course. Four instruction days plus a half-day examination, 32 continuing education activity points, covering all ten DRI Professional Practices and ISO 22301. - [CRLE 2000 cyber resilience](https://www.resilienceguard.ch/trainings/cyber-resilience-accredited-dri-training): DRI cyber resilience course bridging BCM and cybersecurity across prepare, protect, detect, respond and recover. 4.5 days, 32 CEAPs. - [CIRP professional certification](https://www.resilienceguard.ch/trainings/cirp): Resilience Guard Academy's own critical infrastructure resilience certification. Foundation one day, Advanced two days, Expert three days, plus a Workforce Awareness Programme. Mapped to ENISA ECSF, ISC2 CISSP CBK, ISACA domains, IAPP, BCI GPG 7.0 and DRI Professional Practices. Answers the NIS2 Article 20 management and workforce training obligation. - [7A framework training and certification](https://www.resilienceguard.ch/trainings/7a-risk-management-framework-training-and-certification): Three levels. Foundation approximately one day, Professional two to three days, Lead and Assessor a governed six-stage qualification with a three-year credential. - [Crisis management masterclass](https://www.resilienceguard.ch/trainings/crisis-management-masterclass): One-day executive intensive grounded in ISO 22361, closing with a live tabletop. Delivered in English, German and Italian. - [Crisis exercising](https://www.resilienceguard.ch/trainings/crisis-exercising): The five exercise formats and the design, facilitation, observation, debrief and action-planning lifecycle. - [Top-team crisis simulations](https://www.resilienceguard.ch/trainings/crisis-management-simulations): Half-day facilitated board-level simulation with scored evaluation and a prioritised action plan. - [Operation HELVETIA](https://www.resilienceguard.ch/trainings/operation-helvetia): Proprietary ninety-minute crisis decision deck. 72 decision cards, six business functions, one cascading ransomware attack on a Swiss critical infrastructure operator. ## Industries - [Banking and financial services](https://www.resilienceguard.ch/industries/banking-financial-services): DORA, FINMA including Circular 23/1, PRA and FCA expectations, ICT and third-party concentration risk. - [Technology and telecoms](https://www.resilienceguard.ch/industries/technology-telecoms): NIS2, always-on SLAs, data centre and cloud concentration risk, Swiss ISG. - [Healthcare](https://www.resilienceguard.ch/industries/healthcare): Clinical system dependency, ransomware exposure, supply fragility, NIS2, FADP and GDPR. - [Government and public sector](https://www.resilienceguard.ch/industries/government): Swiss ISG, BACS reporting duties, legacy system interdependencies, continuity of essential services. - [Energy](https://www.resilienceguard.ch/industries/energy): Electricity, gas and heat providers, operational technology and grid infrastructure, NIS2, Swiss ISG. - [Manufacturing](https://www.resilienceguard.ch/industries/manufacturing): Production concentration, supplier dependency, cyber-physical convergence, customer audits. - [Transport and logistics](https://www.resilienceguard.ch/industries/transport-logistics): Network dependencies, scheduling system criticality, cross-border complexity, critical infrastructure duties. - [Maritime and shipping](https://www.resilienceguard.ch/industries/maritime-shipping): IMO Resolution MSC.428(98), the ISM Code, chokepoint risk, vessel cyber exposure. - [Retail and e-commerce](https://www.resilienceguard.ch/industries/retail): Peak trading concentration, payment platform failure, supply chain fragility, FADP and GDPR. - [Tourism and hotels](https://www.resilienceguard.ch/industries/tourism-hotels): Guest safety incidents, seasonal revenue concentration, booking system dependency. - [Construction](https://www.resilienceguard.ch/industries/construction): Site incidents, supply chain concentration, project system attacks, liquidated damages exposure. - [Food and drink](https://www.resilienceguard.ch/industries/food-drink): Cold chain dependency, recall readiness, HACCP integration, retailer compliance demands. ## Regulatory guidance - [European resilience compliance calendar 2024 to 2026](https://www.resilienceguard.ch/insights/european-resilience-compliance-calendar): Consolidated timeline of DORA, NIS2, CER, Part-IS and Swiss ISG milestones from January 2024 to July 2026. - [Swiss Information Security Act](https://www.resilienceguard.ch/insights/swiss-information-security-act): ISG, SR 128. In force 1 January 2024. Cyberattack reporting to BACS within 24 hours of discovery, full report within 14 days, duty active from 1 April 2025, sanctions from 1 October 2025, fines up to CHF 100,000. - [KRITIS and the CER Directive](https://www.resilienceguard.ch/insights/kritis): Directive EU 2022/2557, the German BSI Act and the planned KRITIS-Dachgesetz. Eleven in-scope sectors. National strategies due 17 January 2026, entity identification due 17 July 2026. - [EASA Part-IS](https://www.resilienceguard.ch/insights/part-is): Regulations EU 2022/1645 and EU 2023/203. Aerodrome operators and apron management in scope from 16 October 2025, the wider aviation population from 22 February 2026. - [Resilience glossary](https://www.resilienceguard.ch/insights/glossary): Thirty-five defined terms spanning BCM, crisis, cyber and regulatory vocabulary, including BIA, RTO, RPO, MTPD, MBCO, impact tolerance, CTPP, TLPT and register of information. - [Frequently asked questions](https://www.resilienceguard.ch/faq/): Eleven questions on BCM fundamentals, BCM versus risk management versus disaster recovery, phasing, timelines, standards and certification. ## Evidence and research - [Case studies](https://www.resilienceguard.ch/insights/case-studies): Fifteen anonymised client engagements across insurance, telecoms, data centres, pharmaceuticals, public sector, energy, manufacturing, chemicals and mining, transport, maritime, retail, hospitality, construction, food and beverage, and technology distribution. - [Research portfolio](https://www.resilienceguard.ch/research): Sixteen EU Horizon 2020 and Horizon Europe projects: 7SHIELD, SPARROW, HERON, euPOLIS, HEART, HARMONIA, BLOSSOM, AURORA, ISMED-CLIM, SOLUCIR, OCEANIDS, HYPERION, YADES, THETIDA, WATSON and PHASE IV AI. - [Publications](https://www.resilienceguard.ch/press-publication): Peer-reviewed journal articles in the Bulletin of Earthquake Engineering, Environmental Hazards, Earthquake Engineering and Structural Dynamics, and Proceedings of SPIE. - [Blog](https://www.resilienceguard.ch/blog): Nineteen practitioner analyses on NIS2, DORA, FINMA, NCEMA 7000, AI governance, supply chain incidents, geopolitics and the resilience profession. - [Insights hub](https://www.resilienceguard.ch/insights): Entry point to blog, case studies, publications and research. ## About the firm - [About Resilience Guard](https://www.resilienceguard.ch/about): Firm profile, leadership, governance and the practitioner-core operating model. - [John Zeppos, founder](https://www.resilienceguard.ch/about/John_Zeppos): Founder and Group Managing Director. FBCI, CBCP, CCRP. Twenty-plus years international consulting. Two-time BCI Global winner for Business Continuity Manager of the Year, 2012 and 2014. CIR Highly Commended 2011. Judging panels: BCI Global Awards 2013, IRM Global Awards 2012, 2013 and 2014. - [Team](https://www.resilienceguard.ch/about/team): Twenty one specialists, nine named leads across leadership, commercial and delivery, and governance and operations. - [Advisory board](https://www.resilienceguard.ch/about/advisory-board): Independent challenge body, maximum three seats, three-year terms. Professor David Alexander, University College London, chairs. Doug Cook MBE CSyP FSyI is a member. - [Mission and values](https://www.resilienceguard.ch/about/mission-values): Six values: practitioner-led, independence, rigour, discretion, partnership, endurance. - [Awards and recognition](https://www.resilienceguard.ch/about/awards): The verified award record and judging panel roles. - [Software partners](https://www.resilienceguard.ch/software/partners): Resilience Arena plus Citalid for cyber risk quantification, for which Resilience Guard is authorised distributor for Italy, Greece and Cyprus, and Riskonnect for BCM programme management. - [Careers](https://www.resilienceguard.ch/about/careers): Speculative applications only. Four human selection steps, no applicant tracking system. ## Optional - [Sustainability](https://www.resilienceguard.ch/about/sustainability): Environment, people, society and field, and governance commitments. Qualitative, no published metrics. - [Code of conduct](https://www.resilienceguard.ch/about/code-of-conduct): Six binding principles and a non-retaliation concern process. - [Gender equality](https://www.resilienceguard.ch/about/gender-equality): Commitments across hiring, pay, progression and everyday conduct. - [Imprint](https://www.resilienceguard.ch/imprint): Legal disclosure. Resilience Guard GmbH, UID and VAT CHE-474.755.435 MWST, Turmstrasse 18, CH-6312 Steinhausen, Canton of Zug. Naples subsidiary at Via Benedetto Brin 63, Piano 2, 80142 Naples, Italy. Swiss law, jurisdiction Steinhausen. - [Privacy policy](https://www.resilienceguard.ch/privacy-policy): Data protection and cookie policy. - [Full corpus for language models](https://www.resilienceguard.ch/llms-full.txt): Expanded machine-readable description of the firm, its frameworks, services, curriculum and regulatory positions.