Why working from home failed when Texas froze

The week

In the early hours of February 15, 2021, the Electric Reliability Council of Texas, known as ERCOT, ordered utilities to shed load. An extreme cold wave had settled over Texas and much of the central United States. For a state far more used to heat than ice, it was a shock to almost every system people rely on.

ERCOT runs most of the state’s power grid, the network of power plants and lines that keeps supply and demand in balance second by second. “Shedding load” means deliberately cutting power to some customers so the whole grid does not collapse. It was necessary because generation was failing across gas, coal, nuclear and wind sources at once. ERCOT later told state legislators that the grid had come within minutes of an uncontrolled collapse, which could have left the state dark for far longer.

The causes were linked to one another. Equipment at power plants froze. Natural gas production and processing fell as wellheads and pipes froze, so gas-fired plants that were still running could not get enough fuel. Some gas facilities were themselves on circuits that utilities cut during the rotating outages, which reduced fuel supply further. Because ERCOT’s grid has only limited connections to the rest of the country, it could import little power to make up the shortfall.

The plan was for rotating outages, with neighborhoods taking turns to lose power for short periods. Instead, those outages stretched into days. Millions of Texans lost power in freezing temperatures, in homes that were never designed to hold heat for long without it. Neighboring grid operators, including the Southwest Power Pool, also ordered rotating outages in parts of the central states that week.

The effects cascaded, one failure triggering the next. Water systems lost pressure as pipes froze and treatment plants lost power, and boil-water notices covered millions of people. Some hospitals struggled with water supply and heat, the two things they can least do without. Roads were impassable in many areas. And because cell towers and home internet equipment need electricity, mobile and home internet service failed where power was out.

Industry felt it too. Semiconductor plants in Austin, including Samsung’s, shut down when utilities asked large users to cut consumption. Their restart took weeks, at a time when chips were already scarce. Wholesale power prices in ERCOT were held at the market’s $9,000 per megawatt-hour cap for days under an order from the state’s utility commission. The resulting bills were more than some electricity retailers and cooperatives could pay.

The disruption spread beyond the state’s grid. Northern Mexico suffered blackouts as natural gas supplies from Texas fell. Public services strained under the weather as well. COVID-19 vaccination clinics across Texas closed, and vaccine shipments across the country were delayed by the storms. In the Houston area, county health officials rushed to give out vaccine doses after a storage site lost power, so the doses would not spoil. Many bank branches, clinics and government offices across the state closed for days, and schools that had reopened shut again.

The human cost was severe. Hundreds of deaths were later attributed to the storm. The grid operator ended emergency conditions around February 19, but recovery in many homes and businesses took far longer. President Biden approved a major disaster declaration for Texas on February 20, and federal tax deadlines for Texans were later pushed back.

For organizations, the week arrived at an awkward moment. After nearly a year of pandemic remote work, many had come to treat “work from home” as the answer to almost any disruption. Texas tested that answer, and found the limits of it.

By February 2021, most organizations had spent eleven months proving that knowledge work could be done from home. It was a genuine achievement. Laptops were shipped, video calls became routine, and work that once seemed to require an office carried on from kitchen tables.

Continuity plans had absorbed that experience. Business continuity planning is the discipline of deciding, in advance, how an organization will keep its most important work going when something goes wrong. After 2020, many plans boiled down to a single sentence: if the office is unavailable, people work remotely.

Texas showed the limit of that assumption. When a regional grid fails, the office and the home fail together, along with the roads between them, the water in both and the networks that connect them. Remote work is a sound fallback for a building outage. It is a weak one for a regional event.

The storm exposed four kinds of correlated dependency that single-fallback plans missed: people, facilities, communications and suppliers. Two sections first explain the underlying problem: why backups fail together, and why the usual testing cycle hides it. The four dependencies follow in turn. The final three sections cover who bears the cost when continuity fails, how to test all four dependencies at once, and the question that ties them together.

The argument applies across sectors, though the rules differ. Banks and credit unions answer to examiners using federal interagency guidance. Broker-dealers have their own continuity rule. Hospitals that take Medicare answer to federal emergency preparedness requirements. Public agencies answer to continuity directives and, in the end, to the public. The sections below note where those differences change the answer.

When the backup fails with the original

Most continuity plans are built around a simple idea: if one thing breaks, use another. If the main office floods, use the backup site. If one internet provider fails, switch to the second. That works well when the two options fail independently, meaning that a problem with one tells you nothing about the other.

Correlated failures are different. They happen when a single cause knocks out several things at once, including the backup. A spare house key left with a neighbor protects against losing your keys, and does nothing if a storm floods the whole street.

A regional event is the classic correlated failure. The same cold that froze power plants also froze water pipes, closed roads and drained the batteries on cell towers. The office, the employee’s home and the backup site down the road were all hit by the same storm. A plan that relied on moving work from one of those places to another had, in effect, a spare key kept in the same flooded street.

Distance is not independence

Many organizations measure the separation between sites in miles. A primary office in Houston and a recovery site in Dallas are about 240 miles apart, which looks like comfortable diversity. Both, though, draw power from the same ERCOT grid. Because that grid has only limited links to its neighbors, a statewide shortage reaches both cities at once.

The better measure is shared upstream dependency. Two sites are independent only if they rely on different grids, different water systems, different network routes and different labor pools. Engineers call a single cause that defeats several safeguards a common-mode failure. Continuity plans rarely use the term, but they need the idea.

Correlation inside the infrastructure

The grid itself showed how hidden correlation works. The federal review by FERC and NERC found that freezing equipment and natural gas fuel shortages drove most of the generation losses. Some gas production and processing sites lost power during the rotating outages, because nobody had flagged them as critical loads. Cutting power to save the grid reduced the fuel the grid needed.

Organizations have similar loops. A backup data center may depend on the same identity service as the primary. A generator may depend on a fuel vendor whose own depot is in the outage area. A crisis call bridge may depend on corporate logins. Each loop looks harmless until the event that triggers it.

The case that this was a rare event

The strongest objection is that Uri was exceptional, and no organization can plan for everything. Plans must stop somewhere. A firm that tried to survive every conceivable regional catastrophe would spend more on resilience than on its business.

The answer is that Uri was severe but not unforeseeable. Texas had suffered rotating outages in a February 2011 cold snap, and a federal review that year recommended better winterization of plants. Severe weather, hurricanes and wildfires routinely take out whole regions. The test is plausibility, not novelty. A scenario that has happened in the same place within a decade belongs in the plan.

The useful question for any plan is therefore what would take out both the main option and the fallback at the same time. For many organizations in February 2021, the honest answer was a bad winter storm.

Plans tested one scenario at a time

In most organizations, a small team or a part-time coordinator owns the process. Each department is asked to list its critical activities, estimate how long each could be paused before real harm results, and name what it needs to keep going: people, systems, locations, suppliers. That exercise is often called a business impact analysis.

From there, the team writes recovery strategies. Common ones include moving staff to another office, switching computer systems to a backup data center, having staff work from home, and relying on a vendor’s own plan. The strategies are written up, approved, filed and, at best, tested once a year. The tests usually run one scenario at a time: a building fire one year, a cyberattack the next.

Where the blind spot comes from

There is nothing wrong with that structure. The weakness is in the scenarios. Each strategy is usually tested against the event it was designed for. Remote work is tested against an office closure, and passes. The backup data center is tested against a failure of the main one, and passes.

Rarely does anyone run a scenario in which the office, the homes, the roads, the local networks and the nearby vendors all fail together. That scenario cuts across every department’s plan at once and has no single owner. The facilities team owns the building, IT owns the data center, HR owns the people and procurement owns the vendors. Nobody owns the region.

The business impact analysis compounds the problem. Because each department completes it separately, the shared dependencies never appear in one place. Five departments may each list “staff work remotely” as their strategy. None of them sees that all five depend on the same few hundred households in one metropolitan area.

How the pandemic shaped the plans

The pandemic made this blind spot worse in one specific way. It gave remote work a year-long, real-world test, and remote work passed it convincingly. That success made it the default answer. Few plans paused to note that the pandemic had taken people out of offices while leaving their homes fully powered and connected. A regional storm does the opposite.

Many organizations had also closed or shrunk offices during 2020, sometimes including the sites that once served as alternates. A plan that relied on “the other office” sometimes pointed to a building that no longer had desks, network equipment or staff with keys.

What the rulebooks already said

Regulators had not asked for single-scenario testing. The interagency handbook used by bank and credit union examiners, revised in 2019, framed continuity around resilience and testing that reflects realistic disruptions. FINRA’s continuity rule for broker-dealers requires plans to address alternate physical locations for employees and communications with them. Hospitals and other providers that take Medicare must base their emergency plans on an all-hazards risk assessment and test them with exercises. Federal agencies follow continuity directives that assume a disruption can affect a whole area.

The gap, then, lay mostly in practice rather than in the rules. The documents asked for realistic, combined scenarios. The tests organizations actually ran were narrower, because combined scenarios are harder to stage and less comfortable to fail.

People: staff were victims of the storm too

Continuity plans tend to treat staff as a resource to be relocated. In Texas, staff were dealing with burst pipes, no heat, no water and, in some cases, danger to their families. Many could not work, and should not have been asked to.

For organizations with large regional teams, such as a bank’s operations center, a health system’s revenue cycle office or a state agency’s call center, that meant losing a whole function at once. A revenue cycle office is the team that handles a hospital’s billing and insurance claims. An operations center is where a bank processes payments, exceptions and account changes. These functions are unglamorous, but customers notice quickly when they stop.

Spreading the critical roles

Plans that held up had already spread critical roles across regions. Cross-trained staff in other states or time zones could take over work queues within hours, because they used the same systems and procedures. Follow-the-sun designs, where work passes between teams in different time zones over the course of a day, were often built for efficiency. They turned out to be continuity designs.

Spreading roles has costs. Cross-training takes time from productive work, and duplicate teams in a second region raise payroll. A cheaper middle course is to identify the few queues that cannot wait, such as payment exceptions, claims with deadlines or benefit eligibility decisions, and build second-region coverage for those alone.

Take a regional health system with its entire billing team in one city. If that city loses power for five days, claims with filing deadlines start to slip. Training a small group in another of the system’s offices to handle just the deadline-driven claims costs a fraction of duplicating the whole team. It also covers the work that actually cannot wait.

What changes by type of organization

The right answer depends on the shape of the organization. A national bank or a large broker-dealer usually has staff in several regions and can move queues with a change to a routing table. A community bank or a credit union with every employee in one county cannot. Its realistic options are a partner institution, a service bureau or a core processor that can take on specific tasks, agreed and tested in advance.

Health systems face a different constraint. Clinical staff cannot work remotely at all, so the people question becomes one of keeping enough staff on site. Hospitals often house staff overnight during severe weather. That needs beds, food, water and child care arrangements planned before the storm, not during it.

Public agencies have rules of their own. Federal employees can be granted weather and safety leave, and states and counties have their own leave policies and union agreements. Those rules determine whether a manager can tell staff to stop working without loss of pay. Agencies should know the answer before the event, because the uncertainty itself keeps people trying to log in.

Duty of care comes first

In a regional disaster, the first operational task is to account for staff and their safety. Organizations that could reach employees by text, confirm their status and tell them plainly not to work were better placed to rebuild coverage than those that waited to see who logged in. A roll-call capability that works without the corporate network belongs in every plan.

That last instruction, telling people plainly not to work, deserves emphasis. In a crisis, conscientious employees will try to keep going. A clear message from leadership that their safety comes first removes guilt, prevents people taking risks to find power or connectivity, and gives managers an honest picture of who is actually available.

Pay and support belong in the same plan. Hourly staff who cannot work face lost wages at the moment they face repair bills. Organizations that decide in advance how pay, leave and emergency assistance will work in a regional disaster spend less time on it during the event. Their staff also return sooner.

Facilities: sites depend on more than electricity

Many critical sites have generators. Fewer had planned for days without municipal water, which some data center cooling systems and every hospital depend on. A data center is a building full of computers that run an organization’s systems. It generates enormous heat, and some designs use water to carry that heat away. Fewer still had planned for fuel deliveries over closed roads, or for staff unable to reach the site for several shifts.

A dependency table

A practical exercise for each critical facility is a dependency table. It lists power, water, fuel, staff access, network carriers and key suppliers. For each, it estimates how long the site can run without it, alone and in combination. Generators address one row of that table. A regional event can empty several rows at once, and the shortest combined figure is the one that matters.

For a typical processing center, it might look like this:

• Power: generator with fuel for three days.
• Fuel resupply: depends on trucks using roads that may be closed.
• Water: cooling and restrooms depend on the city supply, with no storage on site.
• Staff access: most staff live within thirty minutes, by roads that ice over.
• Network: two carriers, but both cables run along the same street.

On paper, the site has three days of power. In a regional freeze, it may have a few hours of water, a skeleton staff and network carriers that share a single point of failure. The real figure is the shortest one.

Data centers you do not own

The table applies to computing an organization rents as well as owns. A colocation facility or a cloud region in the affected area faces the same grid, water and staffing constraints as any other building, even if the provider has deeper reserves. Several large cloud providers operate data center regions in Texas.

The practical step is to know which region or facility hosts each critical system, and where its recovery copy runs. A recovery region chosen for low latency is often nearby, which can mean the same grid. Cloud resilience settings are only as independent as the geography behind them. Checking the location of the secondary is a short task, and it answers the question this article keeps asking.

Cold as a hazard to the building itself

Uri added a hazard many plans ignored: the building’s own pipes. When heating fails, water in pipes freezes and bursts. Fire sprinkler lines in unheated spaces are especially exposed. A burst line can flood a server room or an operations floor that had power the whole time. Freeze protection, insulation of exposed lines and a plan for draining systems in an extended outage belong in the facilities row of the table.

Generators bring their own cold-weather problems. Diesel can gel in extreme cold unless it is treated or the tank is heated. Batteries lose capacity. Generators that start reliably in monthly summer tests can struggle at temperatures the site rarely sees. Testing under realistic conditions, or at least checking the manufacturer’s cold-weather requirements, closes that gap.

Hospitals and public facilities

Hospitals face the most demanding version of the table. Federal emergency preparedness requirements for providers that take Medicare expect plans for alternate energy sources and for subsistence needs, including water. Sterilization, dialysis and heating all need water, and a hospital without pressure may have to transfer patients. Several Texas hospitals faced water shortages that week.

Public facilities have their own priority list. A 911 center, a jail and a water plant cannot close. A county office that issues permits can. Government continuity planning ranks essential functions for that reason, and the dependency table should follow the same ranking rather than treating every building alike.

Small investments that pay off

The table also shows where small investments pay off. Water storage, fuel delivery contracts with priority clauses, sleeping arrangements for essential staff, and a second network carrier with a different physical route are all modest expenses compared with losing the site.

Priority clauses deserve skepticism. In a regional shortage, every customer of a fuel distributor may hold a priority clause, and trucks still need open roads. A contract with a distributor based outside the region, or on-site storage that covers the likely duration of road closures, is more reliable than a promise of priority.

Communications: the home network is part of the grid

Remote work depends on home broadband and mobile networks. These depend on the power grid. Home routers need electricity. Neighborhood network equipment needs electricity. Cell towers need electricity, and when the grid fails they rely on batteries and generators that run for limited periods.

As outages lengthened, connectivity failed for many people who still had charged laptops and the will to work.

How the layers fail

The failure runs in layers. First, home routers go dark the moment power is lost. Staff then switch to phone hotspots, which work while the nearest cell tower has battery or generator power. Towers typically carry batteries sized to bridge hours rather than days, and not every site has a generator. As outages extend, coverage thins. The towers still standing carry heavier traffic from everyone else who has lost home broadband.

Then the devices run down. Laptops and phones need charging, and staff without power at home drive to find it on icy roads. Every step adds risk to the employee and removes a little more capacity from the plan.

What a plan should assume

Home connectivity cannot be assumed during regional events. Organizations should know which critical roles can be done from an alternate site with independent power and connectivity, and how staff would get there. They also need emergency communication channels that do not depend on corporate email, chat or identity systems being reachable, and staff who know in advance which channel to use.

“Identity systems” are the services that check who you are when you log in. If they live in a data center that has lost power, or if staff cannot reach them, then every tool that needs a login stops working at once. That includes the chat channel the plan said to use. A simple text message tree or an external notification service, tested in advance, avoids that trap.

Cloud-hosted identity services reduce one risk and leave another. The service itself may run far from the storm, but signing in still needs a working device and, often, a phone for the second factor. If the phone has no signal, the login fails anyway. Plans should include a sign-in method that works with whatever connection a person can find.

Options for critical roles

For the handful of roles that must stay reachable, there are tools beyond the commercial network. The federal government runs priority calling services that let eligible personnel in critical infrastructure, including finance and health care, get their calls through congested networks. Public safety agencies can use FirstNet, the dedicated nationwide public safety broadband network. Satellite phones and two-way radio cover the worst cases.

Each tool has a cost and a training burden. A satellite phone in a drawer, with a dead battery and nobody who remembers the dialing procedure, is no better than none. A small number of devices, assigned to named people and tested every quarter, works better than a large cache nobody uses.

Suppliers: your vendors share your weather

Organizations outside Texas were affected too. Vendors, outsourcers and service providers with operations or staff in the region faced the same constraints. A firm headquartered elsewhere could still lose a processor, a call center or a support team concentrated in the affected area.

Third-party reviews, the checks organizations run on their suppliers, often ask whether a vendor has a continuity plan. They rarely ask where the vendor’s people and facilities actually are, or whether those overlap with the client’s own exposures. Concentration in one grid region, metropolitan area or weather zone is a correlated risk that a vendor’s plan may not reveal.

A hypothetical bank

Suppose a bank headquartered in the Midwest has its own staff spread across three states. It feels well diversified. But its outsourced call center, its card processor’s support team and its document scanning vendor all happen to operate from the same metropolitan area. A single regional event could take out all three at once, and the bank’s own plan would never show it.

Asking for locations of the teams that deliver critical services, and checking them against your own sites, takes a spreadsheet and a few questions.

Suppliers you did not know you had

The same week showed how far supplier effects travel. When Austin’s semiconductor plants shut down, the effect reached manufacturers far from Texas who had never listed a Texas supplier. The chips came through distributors and component makers, several layers removed. These indirect suppliers are often called fourth parties. They rarely appear in a vendor inventory.

The power market showed a financial version of the same effect. Prices held at the cap for days left some electricity retailers and cooperatives with bills they could not pay, and some went bankrupt within weeks. For a lender, the exposure was to customers rather than vendors. Borrowers in the region faced repair costs, lost revenue and, in some cases, enormous energy bills at the same time.

What to ask and what to put in contracts

Due diligence can address location directly. Ask each critical vendor where the teams and facilities that deliver your service are, which grid and region they rely on, and where they would move the work. Ask for the results of their last test, not the existence of a plan. Federal banking agencies’ 2023 guidance on third-party relationships gave banks a framework for this kind of review, and the same questions suit any sector.

Contracts can then require notice when a vendor moves delivery to a new location, and commit the vendor to recovery in a separate region for the most critical services. Vendors will price those commitments. Paying more for real geographic separation is a legitimate choice for a few services, and an unnecessary one for most. The point of the exercise is to make that choice deliberately.

Who notices when continuity fails

Continuity can sound like an operational detail. The consequences of getting it wrong are anything but:

• Customers and residents experience a regional disaster as a time when they most need help, whether that is a payment, a claim decision or a benefit. Services that stop then are remembered.
• Staff judge their employer by how it treats them in a crisis. Plans that put duty of care first earn loyalty; plans that expect people to log in from a freezing house do the opposite.
• Regulators in many sectors expect organizations to keep important services within tolerable limits of disruption, and to show how.
• Cost is lower for planned resilience than for improvised recovery. A modest investment in second-region coverage or water storage is cheap compared with days of lost service.

Where the burden falls

The burden is uneven. Customers in the affected region need services most at exactly the moment local providers are least able to deliver them. A family whose pipes burst needs access to savings, an insurance claim and perhaps a benefit payment, all in the same week. An organization whose own staff are in the same storm has to serve customers who are suffering the same thing.

That is why regional institutions face the hardest version of this problem. A credit union or a county government cannot move its customers. It can move some of its work, through partners, service bureaus or mutual aid agreements with peers in other regions. Arranging those agreements in calm weather is far easier than in a crisis.

The limits of the argument

The argument has limits worth stating. For an organization whose staff are spread across the country, remote work handled Uri well. Most of its people had power, and the few in Texas were covered by colleagues elsewhere. Remote work remains the right default for many disruptions, and the pandemic proved it. The weakness lies in relying on one fallback for every scenario, and in assuming staff are dispersed when they are concentrated.

A five-day storm on a tabletop

All four dependencies can be tested in one exercise. Assume a whole region loses power, water and connectivity for five days, and apply it to staff, sites, networks and vendors together. The aim is to find which critical services have no answer at all, and to decide deliberately whether to accept that or invest in another region.

How the session runs

In practice, such an exercise might run as a half-day tabletop session, a structured discussion around a table rather than a live test. A facilitator describes the storm hour by hour.

On day one, power fails across the region and the office runs on its generator. Leaders have to say who is working and from where. On day two, home internet fails for most staff and the water supply to the office stops. The group identifies which queues are now unattended and who in another region picks them up. On day three, the generator needs fuel, the roads are closed, and a key vendor in the same city announces it has suspended service. Now the group must decide what customers see and what they are told.

Who should be in the room

The right participants are the people who own the separate pieces: facilities, IT, HR, procurement, communications and the heads of the critical business functions. A senior executive should chair it, because some gaps can only be closed with a budget decision. For a bank, the business continuity officer and the third-party risk lead belong there. For a hospital, the emergency management director and the head of nursing do. For an agency, the continuity coordinator and the program heads for essential functions do.

What it produces

Each step exposes a dependency that a single-scenario test would miss. The output is a short list of gaps, each with an owner, a rough cost to close it and a recommendation. Some will be cheap and quick, such as an external text message service for roll calls. Others, like a second-region team, will need a budget decision.

A few simple measures make the follow-up concrete. How long would a roll call of all staff take without the corporate network? Which critical queues have a named second-region owner? Which critical vendors have disclosed their delivery locations? Tracking those three over a year shows whether the plan is improving.

Deciding to accept a gap is a legitimate outcome. Not every service needs a second region. What matters is that leaders make that choice knowingly, with a clear view of how long the service could be down and who would be affected, rather than discovering it during the storm.

The plans that fail this exercise tend to share a few habits:

• Writing one fallback, usually remote work, and applying it to every scenario.
• Testing site outages and network outages separately, never together.
• Counting generator fuel but not water, roads or staff.
• Relying on corporate email or chat to reach staff when those depend on the systems that are down.
• Asking vendors whether they have a plan, but never where their people sit.
• Expecting affected staff to keep working.

What our fallbacks have in common

1. If our largest office region lost power, water and internet for five days, which critical services would stop entirely?
2. Which work queues cannot wait, and who in another region could take them over within hours?
3. How would we reach every employee if corporate email, chat and logins were unavailable?
4. Where are the teams that deliver our critical vendor services physically located, and do they overlap with our own sites?
5. Which gaps have we decided to accept, and does the board know?

Each question tests one of the four dependencies, and the last tests governance. A board that receives honest answers once a year, with the gaps and their costs listed, has done most of what can reasonably be asked. The answers will change as offices open and close, vendors move work, and staff relocate, which is why the question set belongs on an annual cycle.

The questions also travel well across sectors. A credit union, a health system and a state agency will give very different answers. All three will find the same pattern if their fallbacks share a grid, a city or a weather system.

With hindsight

The political consequences in Texas came quickly. ERCOT’s board dismissed its chief executive in early March 2021, and several board members and the chair of the state’s utility commission resigned. An electric cooperative and an electricity retailer filed for bankruptcy within weeks, citing the bills the storm left them.

Texas passed legislation in June 2021 that restructured the grid operator’s board and required weatherization of power plants, natural gas facilities and transmission. Weatherization means preparing equipment to keep working in extreme cold, through insulation, heating and similar measures. Most board members became independent, and failures to comply with weatherization rules became subject to penalties of up to $1 million. The law also created a public alert for when power supply may not meet demand. It set up a council to coordinate state agencies and industry during extreme weather. Weatherization for natural gas facilities fell to the Railroad Commission, the state agency that regulates oil and gas, and its rules took effect in stages.

Federal energy regulators and the North American Electric Reliability Corporation, the body that sets reliability standards for the continent’s grids, published a detailed report on the event later that year. It identified freezing equipment and natural gas fuel supply problems as the main causes and recommended mandatory cold weather standards. NERC adopted new cold weather standards for generators in the years that followed. Load shedding on Uri’s scale did not recur in Texas in the winters immediately after.

Correlated regional failures recurred elsewhere. Winter Storm Elliott strained grids in the eastern United States in December 2022, and the Tennessee Valley Authority and Duke Energy ordered rotating outages. The federal review of Elliott again found generators failing in the cold and natural gas supply falling short, much as in Uri. Texas itself came through later cold snaps without statewide rotating outages, though officials still issued conservation appeals. In July 2024, Hurricane Beryl left more than two million customers in the Houston area without power, some for over a week.

Hurricane Helene in September 2024 produced the clearest health care example. Flooding shut Baxter’s plant in North Cove, North Carolina, which by the company’s account made roughly 60 percent of the IV solutions used in the United States. Hospitals across the country had to conserve fluids for months. In western North Carolina, power, water, roads and cell service failed together, and Asheville’s water system took weeks to restore. In April 2025, a blackout across Spain and Portugal showed the same pattern in two national grids at once.

The specific cause changes; the pattern of many things failing together in one place does not.

By 2026, operational resilience expectations in financial services, and a growing focus on resilience in health care and government, emphasize tolerances for disruption to important services under severe but plausible scenarios. British regulators gave firms until March 2025 to show they could stay within such tolerances. The European Union’s Digital Operational Resilience Act has applied since January 2025. In the United States, the banking agencies had already set out sound practices for operational resilience in late 2020.

Organizations are expected to identify the services that matter most to customers and the public, and decide how much disruption to each is tolerable. They must then show that they can stay within those limits even in a bad but realistic scenario.

Uri remains a clear example of why those scenarios must include the workforce and its homes as well as systems and buildings. A plan that keeps the data center running but assumes every employee has heat, water and internet at home is not a plan for a regional event.

The question to ask is what your fallbacks have in common. If the answer is a shared grid, a shared city or a shared weather system, then they are not independent, and the plan needs a second answer located somewhere else. That question costs nothing to ask, and in February 2021 it would have changed a great many continuity plans.