Mandatory Regime

A mandatory regime removes the question of whether to build the capability at all and replaces it with the question of how well it is built. It exists because for some organisations, such as government bodies, banks and operators of critical infrastructure, failure harms the public, so the state does not leave continuity to goodwill. For leadership this settles the budget debate at its root: the capability is a condition of operating, like licences or safety. What remains within management's control is the quality and depth of the implementation.

The clearest Gulf example is NCEMA 7000, mandatory for UAE government entities and critical infrastructure, with implementation monitored at national level. In banking, CBUAE requirements carry the same binding force for licensed institutions. Voluntary standards such as ISO 22301 coexist with these regimes and often serve as the practical method for meeting them, since the management-system logic is compatible. Mandatory obligations are fixed in laws, decrees and licence conditions, and sanctions for failure range from findings and restrictions to consequences for the licence itself.

The recurring mistake is minimal, formalistic implementation: an organisation appoints a coordinator, produces the required documents and considers the regime satisfied, while recovery has never been exercised once. Compliance on paper survives until the first inspection or the first real disruption, whichever comes sooner. A mandatory regime is better read as a free specification of what a serious capability looks like. How mandatory and voluntary instruments combine is examined in ERGP module M5, Regulatory requirements for resilience.