# R — Build resilience, risk intelligence and readiness

## Power 19 — Emergency Preparedness, Business Continuity & Downtime Rehearsal

**Stable ID:** `PWR-19`  
**Install state:** `Available Inactive`  
**Activation rule:** visibility is not authority; pass CHART, preview the exact workflow, name the human owner and activate only by an explicit receipt.

**Purpose.** Prepare and rehearse command, continuity, downtime, recovery and after-action questions using synthetic scenarios and official plans.

**Required inputs.** clearly synthetic scenario; current approved emergency/continuity plans; facility and service scope; roles; dependencies; communication and recovery owners; facilitator.

**Operating sequence.** declare exercise; use official command structure; map essential functions, dependencies, manual workarounds, decision thresholds, accessibility, communications, recovery and after-action learning.

**Power-specific output.** Synthetic Exercise Plan, role-and-dependency map, injects, observation guide, recovery checklist and after-action draft.

**Human checkpoint.** authorized incident command, emergency management, clinical, facilities, IT and executive humans direct any real event.

**Prohibited actions.** no real-time monitoring, emergency declaration, mass notification, resource dispatch, clinical instruction, external message or replacement of official plans.

**Finish state.** Save only an approved artifact with owner, partition, source/version, fact-versus-interpretation labels, human decision owner, expiry, retention, correction, export and deletion. Otherwise discard the preview. The power returns to `Available Inactive`; no agent or schedule remains running.

## Power 20 — Cybersecurity, Privacy & Third-Party Risk Navigator

**Stable ID:** `PWR-20`  
**Install state:** `Available Inactive`  
**Activation rule:** visibility is not authority; pass CHART, preview the exact workflow, name the human owner and activate only by an explicit receipt.

**Purpose.** Turn cyber, privacy, data-flow and vendor-risk questions into an owned review without operating as a security tool or making legal determinations.

**Required inputs.** system/use case; data classes; data-flow diagram; vendor and hosting facts; identity/access model; retention; integrations; incident route; approved control frameworks.

**Operating sequence.** classify data with human owners; minimize collection; map trust boundaries; check access, logging, encryption, resilience, incident, subcontractor and exit questions; record unknowns and compensating controls.

**Power-specific output.** Privacy/Security Intake, data-flow map, control-question set, risk register, vendor evidence request and go/no-go decision queue.

**Human checkpoint.** privacy, security, legal, compliance, procurement and system owners complete formal assessment and authorization.

**Prohibited actions.** no vulnerability scan, penetration test, credential use, production access, authorization-to-operate, HIPAA determination, incident containment or vendor approval.

**Finish state.** Save only an approved artifact with owner, partition, source/version, fact-versus-interpretation labels, human decision owner, expiry, retention, correction, export and deletion. Otherwise discard the preview. The power returns to `Available Inactive`; no agent or schedule remains running.

## Power 21 — Incident, Issue, Corrective-Action & Learning System

**Stable ID:** `PWR-21`  
**Install state:** `Available Inactive`  
**Activation rule:** visibility is not authority; pass CHART, preview the exact workflow, name the human owner and activate only by an explicit receipt.

**Purpose.** Prepare systems-focused review and corrective-action governance without deciding cause, blame, reportability, privilege or discipline.

**Required inputs.** synthetic scenario in Private mode or exact authorized official-system context; issue owner; known facts; policy; review body; evidence rules; immediate safety route.

**Operating sequence.** route urgent matters first; preserve official reporting; separate facts, interpretation and hypotheses; map process and contributing conditions; require human cause analysis; design owned actions, measures and stop rules.

**Power-specific output.** Issue Brief, official-boundary card, learning questions, corrective-action proposal, owner/measure ledger and closure criteria.

**Human checkpoint.** authorized safety, compliance, legal, HR, clinical and executive humans determine reporting, investigation, cause, disclosure and closure.

**Prohibited actions.** no real event narrative in Private mode, autonomous report, blame, root-cause declaration, privilege claim, retaliation, discipline, regulator contact or record change.

**Finish state.** Save only an approved artifact with owner, partition, source/version, fact-versus-interpretation labels, human decision owner, expiry, retention, correction, export and deletion. Otherwise discard the preview. The power returns to `Available Inactive`; no agent or schedule remains running.
