Ep. 35: Minimum Viable Company (MVC) Explained

Full transcript

David Stainback: Hello everyone, and welcome to the Emerge Stronger Through Disruption podcast series. I'm Dave Stainback, co-leader of PwC’s Global Centre for Crisis and Resilience, or GCCR for short. And I'm coming to you today from our office in Atlanta, Georgia. I'm also joined by Bobbie Ramsden-Knowles, my GCCR co-leader.

Great to be with you as always, Bobbie. 

Bobbie Ramsden-Knowles: Thanks Dave, and hi everybody. As many of you know, the aim of this podcast series is to really help explore the challenges facing businesses in what we all know as an environment of constant crisis and change, and to discuss how successful business leaders can emerge stronger through disruption.

So Dave, what's on the agenda for today? 

David Stainback: Yeah, so today we're diving into the concept of a Minimum Viable Company or MVC, what that means, and why it's resonating with a growing number of organisations. 

Bobbie Ramsden-Knowles: Excellent. And I'm really excited about this one because certainly what I'm hearing, it's a really important topic for a lot of organisations right now.

So you might have seen, we actually published very recently a white paper on Minimum Viable Company, and it's actually spurred a lot of interest. I've been having lots of discussions and questions from executives and boards about what is Minimum Viable Company, so it'd be really good actually to explore that and address some of those questions here today.

For those who are new to the podcast, I'm actually based in the UK and what we've seen for the third consecutive year is actually the number of highly significant cyber attacks on British businesses has increased. And at the same time, we're also seeing increasing reports from intelligence services think tanks around the increasing amount of disruption that we're seeing, and that actually this unstable period that we've been in is going to continue across the globe.

So, being ready to both deal with disruption, but for me, also get ahead of your competitors in a disruption has never been more important, which is why I think there is so much interest in Minimum Viable Company.

David Stainback: Totally agree. So let's begin by level setting for those listeners who aren't familiar with the concept.

Simply put, Minimum Viable Company means identifying the essential services, processes, and functions that need to remain operational to keep the organisation financially, operationally, and strategically viable in a crisis. So what does that mean? Typically, we think about three overall components of an MVC to consider.

The first is, what are those external facing services that are essential to keep up and running? Secondly, what are the critical internal processes and activities that are necessary to support those external services and to maintain that financial liquidity? And then lastly, based on those two items, what is the underlying core infrastructure or what we often call Tier Zero infrastructure that you need to function?

So your MVC is the minimal external and internal processes, and infrastructure that you need to be a going concern in a crisis, and also to maintain regulatory compliance and essentially your license to operate. And finally, I would say your MVC will likely be delivered through manual workarounds as you're executing on it, while also executing on plans to rapidly recover that critical IT.

Bobbie Ramsden-Knowles: Exactly Dave. And one of the other questions I'm getting quite often, more frequently at the moment is, “Is MVC, just another name for Operational Resilience (OpRes)?”. So I think we need to tackle that one as well. 

David Stainback: Yes, totally. That is a major question percolating around resilience circles, so gimme your thoughts, Bobbie.

Bobbie Ramsden-Knowles: So if I think about it, I think the key essential thing is that organisations have got to align the two, right? So MVC provides what we would say the foundational survival capability, and then operational resilience builds on that to enable you to meet all your external obligations. I think a truly resilient organisation has to be able to continue to deliver all of its most critical services in any scenario.

Right? But, for many companies, they might not be in that position yet. So actually they have to prioritise protecting the most critical things that they do. And that might be a product they sell or a market that they operate in. And it's about how can they survive because they haven't got that true operational resilience just yet.

And I think there's a few sort of factors I consider within that. So firstly, not all critical services are equal, so you really need to think about where does the biggest harm arise to your company, your customers, when you lose that service. And the important part is actually how do you sequence the recovery of that service to minimise damage?

So Minimum Viable Companies should set out the optimal sequencing for recovery of your critical services to make the MVC operational. And that has got to include the specific recovery sequencing for a whole range of scenarios, and that's from ransomware, but it could be a nation state-sponsored attack to a critical national infrastructure failure, and many more disruption scenarios.

The other interesting point is around do you actually have your underpinning dependencies mapped? So I know when we've spoken before, when we've helped organisations review their approach to operational resilience, sometimes we find that they have focused on the critical services. But they haven't necessarily looked at the underpinning processes and dependencies that they need to be able to deliver those services.

Now, operational resilience needs to make sure that it has identified those enabling and Tier Zero capabilities like you just referenced. But sometimes they are forgotten. I think actually Minimum Viable Company highlights the absolute need to do that. The fact you've got to have both the critical services, dependencies, and that Tier Zero infrastructure, as you said.

The other point, I think it's really important, particularly when you're looking at Minimum Viable Company and why it does differ from operational resilience to some degree, is that timeframe. So Minimum Viable Companies defined with this very, I would say specific, fairly short timeframe in mind because it's designed to deliver the absolute vital, critical outcomes for a limited period and is not intended to be permanent.

And then finally, I would also say I think there is an interesting difference between financial services and other sectors. As we all know, the fact that the regulations of financial services has been around for a while and that has driven a lot of the activity around building operational resilience, whereas many other sectors haven't had that same regulation.

And so what I've seen is that they're actually going straight to designing, defining the Minimum Viable Company. And actually I think that's a good place to start and I would advocate that approach where they haven't yet even got on that operational resilience journey.

David Stainback: Yeah, those are all great points, Bobbie and I totally agree.

And so just kind of put it back to you, in my words, MVC is answering the question, what's the smallest version of the company that must continue operating for the firm to survive and retain its strategic value? It's like you said, it's about the short-term enterprise survival, strategic continuity, and capital preservation.

Really that backbone that keeps your firm going through severe stress. 

Bobbie Ramsden-Knowles: Yeah, exactly. So to help frame it visually for everyone, I think if you think of MVC and operational resilience as sort of two layers within a company's resilience framework, and the MVC is your company's survival core. So as you say, Dave, it's that minimal set of capabilities and services and infrastructure that you need to keep the organisation alive and viable.

It's that strategic floor for survival, whereas operational resilience sits above that floor encompassing the broader range of services are still critical, but typically a broader range of services. And just go back to my original point that I opened with, it's essential we have to align the two, when an organisation has already started their operational resilience journey.

David Stainback: Well said, Bobbie. I like that framing. And my takeaway then is that in its simplest terms, operational resilience is still the overall goal. Don't stop moving towards that target. MVC is just a narrower interpretation of criticality to truly those most basic things required for survival. And it includes that playbook and sequencing, as you discussed, to really action that MVC in a true crisis.

With that baseline established on differentiating Minimum Viable Company from operational resilience, let's dive a little bit deeper into MVC specifically and how companies should be approaching it. As you mentioned at the outset, the current risk environment is a compelling reason to begin to understand and prepare your MVC.

Based on that, Bobbie, what are some of the immediate actions that you think organisations need to take to really get off on that journey? 

Bobbie Ramsden-Knowles: Yeah, of course. So right now I'd say from a PwC perspective, we're looking at sort of four stages, if you like, define your MVC, design it, deploy, and then run it. And I'll just give you an insight to sort of the four stages that we currently see.

So within define, I think that's where you are starting that executive conversation, we need to identify the outcomes that underpin the viability of their company, and maybe they will be driven by different factors, whether that's customer, you know, revenue, reputation, legal obligations, or your employee welfare, health and safety.

They can all drive criticality in different ways, and of course it will be different depending on your sector and your organisation. Then drive down towards the list of absolutely critical services that make up your Minimum Viable Company, and ideally you would draw on your operational resilience work here, right?

If you've already completed some of that, particularly you wanna leverage the critical dependencies that you've identified for those services. But if not, that's absolutely fine as well. But you'll need to go through this initial phase really to determine what actually is critical for the organisation that has to be determined at the top, and then to really understand and start to map those end-to-end processes and their dependencies as well.

And the final important element here is to find that time, as we said earlier, for what length would you require your MVC? I'd also start to see that conversation playing out in that initial Define phase if you like.

And then we move on to Design and we starting to re-look at, you've got your scope of the Minimum Viable Company that's been defined, and we then need to design solutions.

Or indeed, we might leverage existing solutions as well, where possible. This is about finding solutions which are gonna help enable the MVC to be stood up and deliver those required outcomes within the agreed timeframe that the executive set. And the right solution is gonna clearly vary based on the dependencies underpinning those critical processes and the timeframe for restoration.

So some examples: you might have a workaround. So for some processes there'll be a manual workaround that may deliver the required level of service for an acceptable period of time. Or in other cases you might decide actually we need a substitute. So you might move a process to an alternative supply that is the best short-term solution for you.

Thirdly, and probably where you put a lot of investment. This is, I would say, is a big decision for an organisation is what we call the ‘life raft’. In other cases, is where it's necessary to stand up entire processes and technology platforms in an alternative environment while the enterprise and factories and other parts of the estate are rebuilt.

David Stainback: Completely agree. The Design phase also really includes determining the recovery sequence to activate the MVC when that crisis hits. Sometimes I'll, I'll just point out that we see the Design effort being led by the technology organisation, and sometimes we see it being led by the business, but our recommendation is that it really needs to be a top-down effort that includes the right business and technology stakeholders co-sponsoring and leading that work from the outset.

Bobbie Ramsden-Knowles: Yes, exactly. And when defining and designing your MVC, as we said right from the top, is critical to consider how that relates to your operational resilience obligations as well. So you are gonna wanna ruthlessly prioritise the minimal set needed for survival in order to protect your customers and the markets.

And this is where you're looking at your sequencing that helps establish a clear plan of what's to activate day one, day two, day three in your crisis response. And I think the design phase also increase really looking at that recovery sequencing and also the decision rights to operationalize MVC effectively for your manual workarounds, your technology enabled life rafts that will keep you functioning until you've got to that full recovery.

David Stainback: So we've talked about Design, we've talked about Define, talked to me about what's happening in the Deploy phase. 

Bobbie Ramsden-Knowles: Yes - so you've got solutions are developed and then they'll go through an approval process, already anticipate and have certainly seen with organisations through a governance forum, and then move into deployment.

And this could be as simple as designing a manual workaround, or it might be at the point that you've made a decision to actually onboard an alternative critical supplier, or you're going into something far more complicated as building a tech-enabled cyber recovery capability or a life raft, which can be launched in a crisis.

Now this is really the phase where you're making sure that the elements you designed are actually in place. And I find that in the execution part of the execution phase requires really strong program management to push teams to coordinate track progress against the milestones that various components are set in place and everything happens on time.

Now, when you get to the run, once solutions are into production, they need to be monitored. We need to maintain them, we need to keep them updated. We need to be able to test them as well. And this is where I say existing resilience programs should be leveraged. For me. how do we actually make sure we've got a sustainable resilience capability?

And this Run phase is really a core part of that. Fundamental to it is making sure that we have a regular program of updating, and testing, and exercising these solutions that we have designed. And then you've gotta monitor, right? So I think that's also where there's a really important role for actually setting key resilience indicators (KRIs).

I know there's often been a lot of discussion about KRIs over the last couple of years, but I think this is where they're gonna become very, very critical going forward because they can be used to monitor the ongoing resilience of the Minimum Viable Company. For example, how recently plans were tested, the outcome of those tests, the rigour with which the findings have been implemented as well.

And in the Run phase, we also want to make sure that we've got that continuous monitoring as well as the testing that I just referenced there, so that you have confidence that if and when you need that MVC, it's ready to go and it's effective.

I think that there's some organisations we are starting to see, and they're looking at some more advanced, I would say, technology solutions like digital twins and virtual models. And clearly, you know, that is a way to go if you like, but I do think organisations need to really take that step back and work out what is the right investment that they want to make in line with their appetite right now.

David Stainback: Thanks, Bobbie, and that's a great overview of enabling Minimum Viable Company. And as you and I know, it's a lot of work, but given the environment that we're in of constant disruption, we're seeing more and more companies make that investment and begin to go down this path. I think that the benefit of MVC is that, even for senior executives and C-suite and board members with little background or prior focus on resilience, the concept of MVC is very easy to understand, and frankly, it even speaks to our own basic survival instincts as humans, right? It's just applied in a different context to a business.

Bobbie Ramsden-Knowles: Great point, Dave.

So let's take it up a level and address why are a growing number of organisations focusing on MVC? What's the really true value of it? 

David Stainback: Yeah, I would say that simply put, having an MVC defined and an accompanying activation plan means that you can respond more quickly in a crisis and therefore minimise recovery time and financial impact.

So you're in execution mode when the crisis hits, rather than trying to design it and define it during the crisis itself. It becomes a critical emergency capability just needed when the disruption strikes that really reduces recovery time and financial impact. And I'd add that the primary reason that we're seeing organisations be able to build a business case for investing in MVC is because of the number of very large cyber events that you alluded to earlier that are just happening to businesses across the globe.

In many cases, those are lasting a very long time. CEOs and Boards are seeing these headlines and making the strategic decision that they do not want to be the ones that are next. And while taking on MVC and a strong operational resilience program more broadly, they can be costly and they can take time.

The justification's obvious when watching these headlines. 

Bobbie Ramsden-Knowles: Completely. And as you and I see every day, and we talk to many organisations across sectors, that they're absolutely starting to move into this space and really take on this effort. 

I think one thing that's worth noting is organisation also linking Minimum Viable Company up to cost optimisation programmes. They're looking at how does that also fit into their transformation efforts, for example. So I think we shouldn't just think about Minimum Viable Company from a value protection point. We should also think about the value it can create because not only because of the disruption risk a transformation brings, but because as you start to outsource or you change your business processes, it's actually a really good time to look at how do those business processes do they fit into your Minimum Viable Company?

And therefore, what do we need to do to be able to protect those things? For example, if you're going through a big outsourcing programme and you lost that outsource and a disruption, what's your strategy around that? We are certainly starting to see a lot of companies use MVC to redesign, how they think about that cost-out program, that outsourcing change, or how they're driving efficiency.

I think for me, Minimum Viable Company is, we're almost at the start of organisations starting to think about how it fits into their resilience programme. But I also think where we're gonna see it go is how they transform and change and drive efficiency, and get value out of the business as well. 

David Stainback: Yes, great point.

And the last point that I'll make is to reemphasise that that clear, top-down ownership of MVC as an initiative and resilience more broadly is so critical. To achieve these outcomes, strong executive leadership and cross-functional collaboration are absolutely essential. We've seen many cases where that doesn't exist and the programmes eventually fade away.

Defining MVC isn't just a technology or a risk exercise. It requires business, technology, co-leadership, clear decision rights and really a no-fault culture to enable rapid recovery in advance. So MVC and operational resilience capabilities, they must continuously be adapted and tested with clear governance to keep pace with all of these evolving risks and business changes that we're seeing every day.

So given that macro environment that all of our businesses are operating in, the likelihood of needing to stand up a Minimum Viable Company at some point is unfortunately just very realistic. Acting now is what we're seeing and why we're seeing so many organisations do it is because it can enable your company to really maintain continuity, preserve that market integrity, and protect customer trust. 

So you just feel more ready, right? And your leadership and your board can feel more ready. So with that, I think this is a really great place to wrap up this discussion. I know we've gone really deep on this topic, but it's a very important one. 

Bobbie Ramsden-Knowles: Agreed. Thank you, Dave. That was a really good discussion as always, and I'm sure we'll be back talking on the podcast about MVC at a later date, but hopefully that was a useful intro on the subject for our listeners.

David Stainback: Yes, and to our listeners, thank you for tuning in. 

In upcoming episodes of Emerged Stronger Through Disruption, we'll continue to tackle the topics that keep business leaders up at night. We'd love to hear ideas from our listeners about the topics you'd like us to address, so please just get in touch with both Bobbie and me via LinkedIn.

And in the meantime, remember to subscribe to Emerge Stronger wherever you get your podcasts. Until next time, stay resilient and be prepared for whatever challenges come your way.

VO: Copyright 2026 PwC. All rights reserved. PwC refers to the PwC network and or one or more of its member firms, each of which is a separate legal entity. Please see www dot PwC dot com slash structure for further details. This content is for general information purposes only and should not be used as a substitute for consultation with professional advisors.

© 2026 PwC. All rights reserved. PwC refers to the PwC network and/or one or more of its member firms, each of which is a separate legal entity. Please see www.pwc.com/structure for further details. This content is for general information purposes only, and should not be used as a substitute for consultation with professional advisors.