Organizational resilience has emerged as a multidimensional and contested concept, variously understood as an outcome, a process, or a strategy. This paper conceptualizes resilience as a strategic approach to managing systemic and non-routine risks and uncertainties, positioning it as a higher-order construct relative to crisis management and business continuity. The study operationalizes resilience through four interlinked capacities—anticipatory, absorptive, restorative, and adaptive—and distinguishes between first-order resilience (planned responses to known risks) and second-order resilience (coping with unforeseen disruptions through improvisation, flexibility, and learning). This study develops a composite analytical model that combines these four capacities with Gibson and Tarrant’s “herringbone model,” which differentiates between hard aspects (formal processes, systems, and procedures) and soft aspects (culture, leadership, learning, and adaptability). This framework provides both a conceptual and practical basis for evaluating organizational resilience and contributes to establishing resilience as a core concept within security studies. By integrating capacities and aspects, this study provides a novel approach for assessing resilience in organizations and highlights the importance of moving beyond anticipation toward more adaptive and holistic resilience strategies.