Designing Resilience Through Enterprise Architecture: Higher Education’s Strategic Advantage

When cybersecurity became much more important to higher education institutions, many IT leaders started talking about security by design. For example, they didn't create a solution and then ask, "How should it be protected?" Instead, they thought about protecting the value of that solution from the beginning by asking these questions: "Who is going to use it?" "How will it run on the network?" "What applications will it touch?" That is security by design.

Resilience should be approached the same way. Institutional leaders often think about resilience through the lens of recovery, asking, "How do we keep running as an institution?" The answer is familiar: business continuity plans, disaster recovery, and the ability to bring systems back after an adverse incident. Those steps are important and necessary, but they're insufficient. Resilience is not defined by how an institution reacts. It is defined by whether disruption meaningfully alters the ability of a college or university to deliver on its mission.

Higher education leaders should stop asking how to recover faster and start asking how to design institutional operating models that enable institutions to continue advancing despite change. It moves the focus from "respond and recover" to simply "execute."

Resilience: It's More Than Recovery

Resilience is the ability to absorb change without compromising institutional operations. It's not exclusive to the IT organization; it's an institutional capability that happens when mission priorities, business processes, governance, data, and technology architecture work as one. Resilience is not something to be measured after disruption. It is something that should be designed before it.

Consider a real-world example of what this looks like under pressure. During the COVID-19 pandemic, a highly digital academic environment demonstrated what resilience by design looks like. Because business processes, student experience, network readiness, and application design had already been considered together, the institution could redesign a residence hall registration process quickly and with less friction. The technology response worked because it was not isolated from the institutional operating model. By contrast, teaching and assessment processes that simply layered technology on top of older methods proved less adaptable. The distinction matters because resilience does not come from digitizing old work. It comes from redesigning how the work should function.

That contrast is the heart of resilience by design: it is more than recovery and more than adjusting to external forces. It is seizing opportunity when it presents itself and moving quickly into new pathways without hurting the operation, while maintaining trust and consistency.

So, the leadership question must change. Stop asking, "Can we recover?" Start asking, "Can we continue to move forward?"

Why This Matters: Trust as the Return on Resilience

Public trust is not built only through reputation. It is reinforced through repeated institutional reliability: students can register, faculty can teach, researchers can work, staff can serve, and leaders can make decisions with confidence. According to a 2025 Gallup poll, public confidence in higher education rose from 36 percent to 42 percent in 2025, but it remains well below the 57 percent reported in 2015.^Footnote1 That gap matters because every fragile handoff, delayed service, inconsistent process, or unreliable digital experience becomes part of how students, families, legislators, and communities judge institutional value.

The Problem Hiding in Plain Sight: Fragmentation

If resilience is about institutional capability rather than recovery, the next question is this: What prevents institutions from becoming resilient? Most institutions today are investing heavily in technology. They are modernizing core academic and administrative platforms, migrating to the cloud, improving cybersecurity posture, addressing enrollment challenges, adjusting budgets, expanding data capabilities, and adopting artificial intelligence (AI). These are the right investments. The problem is that they are frequently happening independently of one another. In many institutions, the result is that technology becomes more complex without becoming more coherent. Systems are modernized but not integrated. Data is expanded but not governed. New capabilities are introduced but not always aligned to the operating model or institutional priorities.

Fragmentation leads to poor experience. A student's life cycle spans multiple divisions—from enrollment and student affairs to academic affairs and alumni engagement—with each potentially using different systems, communication styles, and points of contact. No matter how good each division is, frustration and friction caused by fragmentation lead to a breakdown of trust and credibility, ultimately undermining the user experience.

Here's what makes fragmentation so dangerous: it remains largely invisible until there is a disruption. Then it slows every decision, increases every cost, and amplifies every risk.^Footnote2 Institutions respond with individual heroics—extraordinary effort from extraordinary people who shouldn't have to carry that weight—and then continue forward with no structural improvement and no lasting resilience.

The Design Gap: What AI Really Exposes

There's an old saying: Technology doesn't make a bad process better; it just shows you the problems more quickly. AI exposes them dramatically faster. Early AI conversations often focused on hallucinations, but the deeper institutional issue is readiness: the quality, structure, governance, and accessibility of the data and processes AI is being tasked with supporting.

AI isn't mature or structured enough to answer the questions being posed. That's why higher education institutions must own their data estate.^Footnote3 Owning it means accountability: knowing what the data means, where it lives, and how it's accessed and used, so institutions can keep it in good repair.

The sector data tells the same story. In the 2025 EDUCAUSE AI Landscape Study, 57 percent of institutions view AI as a strategic priority, yet only 39 percent have acceptable-use policies, just 9 percent believe their cybersecurity and privacy policies adequately address AI risks, and only 2 percent report new funding to support AI costs.^Footnote4 AI isn't revealing a shortage of tools; it's revealing gaps in data governance, funding, workforce readiness, policy, and operating models.^Footnote5 The lesson is not that we should slow down. It's that opportunity often moves faster than an institution is able to adapt, largely because resilience isn't designed into every core function.

Resilience by Design: Redesigning Enterprise Architecture

To bridge that divide, institutions must see enterprise architecture differently. In higher education, enterprise architecture should function as institutional architecture: the shared design discipline that aligns mission priorities, operating models, governance, data, process, and technology into a coherent system that can evolve over time.

Architecture doesn't own the mission; it helps guide decisions that make the mission more durable, agile, and ready for what's next. And it only works when academic, administrative, and technology functions are designed through shared vision and shared goals. These planning efforts are interdependent, not separate. Addressing fragmentation cannot be the responsibility of the IT organization alone—the "why" has to inform the delivery.

Achieving resilience by design requires simultaneous focus across three horizons.

Horizon One: Foundations of Trust for Mission Continuity

Reliable mission delivery begins with trusted foundations—cybersecurity, identity and access management, data protection, reliable infrastructure, technology life-cycle management, data governance, and business continuity. This is not simply about reducing risk; it is about creating a dependable baseline from which the institution can operate with confidence.

Horizon Two: Operational Agility to Accelerate the Mission

Once foundations are stable, institutions can focus on reducing friction. Modernization should create capacity, not merely replace technology. Redesign processes, rationalize applications, integrate data, and automate so that technology supports institutional flow instead of institutional complexity. Ask the hard questions:

• Where do people experience friction?
• Where are duplicative processes?
• Where do handoffs create delays?
• What effort can be removed?

Horizon Three: Institutional Adaptability to Shape the Future

Efficiency alone does not create resilience. Institutions must also be able to adapt. The defining trait of a resilient institution is not predicting every disruption but, rather, adapting without repeated reinvention. That adaptability requires modular architectures, API-first designs, reusable services, shared governance, data maturity, workforce readiness, change management discipline, coordinated plans, and integrated funding because the disruptions will keep coming: AI evolution, policy shifts, enrollment volatility, funding changes, and cyber threats. Remember that resilience without agility preserves the status quo; resilience with agility enables the institution to evolve.

Turning Principle into Practice: Six Actions Leaders Must Take Now

Resilience by design is not a technology project. It is a leadership discipline. Here is where to start:

• Treat architecture as a strategic function. Elevate it beyond technical governance, and align decisions with institutional priorities. The goal: better decision-making.
• Map mission-critical journeys. Focus on enrollment, advising, learning, research administration, hiring, and financial operations. Ask and identify friction, dependency, and risk. The goal: Pinpoint wasted steps and areas where fragmentation hinders experience and creates risk.
• Prioritize integration as much as innovation. New capabilities create value only when connected; interoperability matters as much as functionality. The goal: scalable, solution-agnostic outcomes.
• Design for continuity and change. Extend planning beyond disaster recovery toward mission continuity, understanding single points of failure and strategic adaptability. The goal: reduce risk and enable a timely response to opportunities.
• Align governance around outcomes. Governance should not be about control for its own sake. It should align academic, administrative, and IT decision-making around institutional priorities, risk tolerance, funding, data, and mission outcomes. The goal: governance that empowers institutional leaders to act on what matters most.
• Reduce reliance on heroics. Build repeatable processes, automation, documentation, clear ownership, and shared knowledge to avoid disruption when there is a staff or leadership transition. The goal: lasting institutional capability that doesn't depend on extraordinary individual effort.

The bottom line is a move from individual pockets of excellence to institutional capability.

A Leadership Discipline: Preparing for What's Next

These six actions ultimately require a leadership mindset shift. Disruption is no longer episodic. It is continuous. The institutions most likely to thrive will align mission and technology, design governance intentionally, simplify complexity, build adaptability into their architecture, and create shared accountability with leaders moving together in harmony.

That is an architectural challenge, but it is also a leadership challenge. Institutional leaders and CIOs have an opportunity to reframe resilience not as an insurance policy, but as a design principle. The work begins when academic, administrative, and technology leaders align around shared vision, shared goals, and shared accountability for mission outcomes.

If that's the conversation your team is ready to have, explore CDW's higher education technology solutions and talk with an expert.

Stop asking, "How do we recover faster?" Start asking, "How do we design an institution that can continue advancing despite change?"

Resilience is not achieved when systems restore quickly. It is achieved when the institution can continue to educate, discover, serve, decide, and adapt without losing momentum. Resilience is designed, not delivered.

Thank You

Notes

1. Gallup, "U.S. Public Trust in Higher Ed Rises from Recent Low,"Gallup News, July 16, 2025; Jeffrey M. Jones,Gallup, "U.S. Confidence in Higher Education Now Closely Divided," Gallup, July 8, 2024.Jump back to footnote 1 in the text. ↩
2. Brian Uhelski and David Barron, "CTEM in Higher Ed: Why Prioritization Matters for Reducing Threat Exposure," Research Hub, CDW, May 1, 2026.Jump back to footnote 2 in the text. ↩
3. John Rathje,"Data Governance Is Just the Beginning: Why University IT Leaders Must Also Master These Data Disciplines," EdTech Magazine, June 17, 2026.Jump back to footnote 3 in the text. ↩
4. Jenay Robert and Mark McCormack, 2025 EDUCAUSE AI Landscape Study: Into the Digital AI Divide, EDUCAUSE, February 17, 2025.Jump back to footnote 4 in the text. ↩
5. "Establishing Modern Governance on a Data-Rich, Resource-Limited Campus," CDW Research Hub, August 19, 2025.Jump back to footnote 5 in the text. ↩

John Rathje is an Industry Strategist for Higher Education at CDW.