Organisations say they keep something offline as though distance from the network automatically creates resilience. A drive in a safe is a location. Offline continuity is a mode of authority.
In that mode, people must still establish identity, decrypt records, decide which version is valid, approve exceptional action, communicate through an independent channel and record what changed. If those powers remain online, the copy in the safe is only an archive.
The six offline powers
- Locate: authorised people can find the material without exposing it publicly.
- Open: keys and credentials survive the event that disabled normal systems.
- Understand: the content includes context, ownership and a reliable capture date.
- Decide: emergency authority is defined and bounded.
- Act: critical institutions can receive and verify an instruction.
- Reconcile: offline decisions can be safely returned to the live system.
Missing any one power can make the whole arrangement ceremonial.
The reconciliation trap
Teams focus on getting through the outage. They ignore the moment systems return. Two versions of payment instructions, ownership records or access lists then compete. A proper offline mode records every decision in a tamper-evident ledger and defines which system wins on reconnection.
The position
Reserve offline capability for the minimum institution that must survive: identity and authority records, critical contacts, recovery procedures, key legal documents, essential payment pathways and the means to authenticate them. Test it under realistic constraints, including the absence of the person who designed it.
Offline is successful only when the institution can exercise legitimate power without its normal network and later prove exactly what it did.