Climate Resilience for Startups: How to Map Risks and Maintain Operations
A flood that closes the street to the office, a three-day blackout, a critical supplier halted, a client demanding climate risk data in a contract. This guide shows how to map physical and transition risks, assess the exposure of people, infrastructure, and the supply chain, integrate climate into the continuity plan, and test the response before the event arrives.
Almost no startup has a climate risk plan, but almost all have already lost days of operation due to the weather. It was the storm that flooded the street to the office, the blackout that lasted three days after a gale, the hardware supplier that couldn't deliver because the highway gave way, the heatwave that knocked out the building's air conditioning and sent the team home. Each of these episodes enters the company's memory as isolated bad luck. Climate resilience is precisely the decision to stop treating them as bad luck and start treating them as a risk category with a name, an owner, an indicator, and a plan.
Science has already removed the doubt about the direction. The IPCC report shows that extreme events of rain, heat, and drought have become more frequent and more intense in various regions, and this trend continues in the coming decades under all realistic emission scenarios. For those running a company, the useful reading is not climatological: it's actuarial. The frequency of the event that previously justified the expression "once in a lifetime" has changed, and plans built on the old frequency are underestimated.
At the same time, the subject is no longer voluntary. With IFRS S2, companies are now required to describe physical and transition climate risks, time horizons, and the resilience of their own strategy—and the adoption of the standard by publicly traded companies has pushed these questions into supplier forms. Startups selling to large enterprises are starting to answer about continuity and climate in procurement processes, not in sustainability reports.
💡 The biggest mistake founders make: confusing climate resilience with an environmental agenda. Reducing emissions is mitigation, looking to the future of the planet. Resilience is adaptation, looking at the survival of the company itself in the next twelve months. They are complementary agendas, but those who treat the latter as if it were the former end up with a beautiful report and no alternative when the street floods.
What is climate resilience for a startup?
Climate resilience is the ability to continue delivering the service, protect people, and quickly return to normal when the climate—or society's response to the climate—interrupts a business dependency. It has three layers: absorbing the shock without stopping, adapting the operation when the shock repeats, and transforming the model when the old condition no longer returns. A mature startup in this topic is not one that is never hit; it's one that knows in advance what it will do when it is.
The most common confusion is thinking that a software company has no physical exposure. Software doesn't flood, but people live in neighborhoods that flood, offices are located on streets that flood, energy and internet depend on infrastructure exposed to wind and heat, data centers need water and electricity, and hardware, logistics, and field service suppliers are entirely in the physical world. The risk doesn't disappear with digitalization: it shifts to dependencies the company doesn't control and often doesn't even list.
The most practical structure to organize all this is the one proposed by the TCFD and consolidated by IFRS S2: governance (who is responsible for the topic), strategy (what risks and opportunities exist, in what horizon), risk management (how they are identified, assessed, and treated), and metrics and targets (what is measured and what the target is). You don't need to publish a report to use these four pillars—they work equally well as an agenda for a four-person quarterly meeting.
Absorb
Continue operating during the event, with redundancy already contracted and tested: alternative energy and connectivity, distributed teams, replicated data, customer service that does not depend on a single address or a single person.
Adapt
Change the operation when the event becomes recurrent: review location, contracts, delivery times, inventory policy for critical items, seasonal risk calendar, and force majeure clauses with clients and suppliers.
Transform
Review the model itself when the old condition doesn't return: a new market, a new production process, a product that now solves the client's adaptation problem. This is where risk becomes a concrete commercial opportunity in exposed sectors.
Building a startup for climate risk, early warning, or operational continuity?
It is an emerging market with demand already contracted: insurers need to price risk by address, agribusinesses need forecasting and alerts, industries need to measure the water exposure of plants and suppliers, and any company answering a large client's form needs to organize continuity and climate data. Those who turn dispersed public data into a simple decision have real space.
In the Shinier Accelerator, you structure this idea with a method: defining the persona, requirements, validating purchase intent, pricing, roadmap, and budget—each step with a guided tool and an expert reviewing the result.
What physical and transition risks can interrupt operations?
The separation between physical risk and transition risk is the TCFD's most useful contribution to a small company because the two require completely different responses. Physical risk is damage and interruption caused by the climate itself, and is divided into acute—a point event like a flood, gale, hail, or heatwave—and chronic, which is the slow change in average conditions, such as rising temperatures, shifting rainfall patterns, and structural water scarcity in a basin.
Transition risk is the effect of the response to climate: new regulation, taxation and carbon pricing, disclosure requirements like IFRS S2, increased energy costs, environmental clauses in contracts, investor pressure, shifting customer preferences, and the obsolescence of carbon-intensive technologies. It rarely brings down the operation overnight, but it erodes margins, closes commercial doors, and, ultimately, invalidates the business thesis.
For startups, there is a third group that usually remains invisible on both lists: dependency risk. This is when the company is physically secure, but its cloud provider, logistics operator, contracted factory, concentrated client, or the city where half the team lives is exposed. The impact arrives all the same; it just doesn't show up in any spreadsheet because the asset doesn't belong to the company.
Extreme rain and flooding
Inaccessible office, damaged equipment, impossible commuting, power and link outages. It is the most frequent event in many cities and the one that appears least in continuity plans.
Extreme heat
Drop in productivity, health risks to field teams, HVAC overload, peak electrical demand, and rolling regional blackouts during heatwaves.
Drought and water stress
Water restriction in plants and data centers, higher energy costs in hydroelectric grids, direct impact on agribusiness clients and chains that rely on process water.
Wind, hail, and tides
Disruption of electrical and fiber networks, roof and antenna damage, closure of roads and ports, with cascading effects on logistics and contracted deadlines.
How to map exposure of people, infrastructure, and suppliers?
Mapping exposure is an exercise in addresses and dependencies, and it fits on a single-page spreadsheet. The question is always the same for each item: if this point stops for three days, what stops happening in the business, how much does it cost, and what alternative is already available? Without that third column, the map is just an inventory of fears.
For the geographic part, you can go far with public and free data. The WRI Aqueduct provides water, drought, and flood risk by coordinate, including future scenarios; civil defense and meteorological bulletins indicate risk areas and historical events in the municipality; and IPCC regional scenarios help understand the direction of change in the region where the company and its suppliers operate. Cross-referencing these three sources with the address list usually takes less than a day's work.
On the human dimension, the map needs to go down to the neighborhood level. A distributed team is not synonymous with a protected team: if seven out of ten people live in the same metropolitan area, a single event can take them all offline simultaneously. It's worth recording who depends on public transport, who has unstable power, who cares for dependents—sensitive data, handled with consent and without unnecessary detail—because that's what defines whether the work-from-home plan works in practice or just on paper.
| Exposed dimension | What to check | Alternative to have ready |
|---|---|---|
| People | Geographic concentration of the team, reliance on transport, stability of home power and internet, field teams exposed to heat and rain | Remote roster with own equipment, power and connectivity stipend for critical roles, protocol for suspending external work |
| Office and physical assets | Street flood elevation, flooding history, height of outlets and servers, insurance coverage, generator and UPS | Alternative address or contracted coworking, minimum mobile operation kit, revised policy with coverage for climate events |
| Digital infrastructure | Cloud regions used, data replication, tested restorable backups, reliance on a single provider or link | Active multi-region, periodic restoration testing, secondary link and mobile routing for essential functions |
| Critical suppliers | Operation address, water and flood exposure, their own continuity plan, replacement lead time, existence of an approved second supplier | Second approved supplier, safety stock of items without substitutes, contractual clause for interruption notification |
| Clients and revenue | Revenue concentration in exposed regions or sectors, climate seasonality of demand, contractual continuity requirements | Geographic and sector diversification of the portfolio, pre-agreed unavailability communication, realistic SLA |
| Regulation and market | Climate disclosure requirements from clients and investors, carbon pricing, energy cost, environmental requirements in procurement | Organized emission and continuity data, standardized answers to forms, annual review of contracts and energy costs |
People first
No continuity decision comes before team safety. A clear protocol for suspending travel and external work, with delegated authority for those on-site to decide without waiting for approval.
Infrastructure with no single point
One provider, one region, one link, a never-tested backup: each singularity is a point of failure. Redundancy only counts as redundancy after it has been exercised in a real test.
Mapped chain
The five suppliers without which the service stops must have a known address, a declared replacement time, and an approved substitute before the event happens.
How to integrate climate risk into the continuity plan?
The worst way to handle climate is to create a separate plan. ISO 22301 already offers the correct structure for business continuity, and climate enters it as a family of disruption scenarios alongside cyber incidents, supplier failure, and loss of key personnel. This matters because a single plan gets triggered; two parallel plans compete for attention at the worst possible moment and neither is used.
The starting point is the business impact analysis: listing the processes that sustain delivery, defining the maximum tolerable period of disruption and the acceptable volume of data loss for each, and only then designing the response. This inversion is what separates continuity from improvisation—the alternative is scaled by the time the business can afford to be without the process, not by what the technology team considers elegant.
Then come four elements that are often missing in startups: named roles with alternates, because the person responsible might be exactly the one without power; an alternative communication channel defined in advance, with a contact list accessible offline; objective criteria for triggering the plan and for returning to normal, so no one has to interpret the severity in the heat of the moment; and a record of what happened, so the next review doesn't rely on memory.
Before the event
- Impact analysis with maximum tolerable period of disruption per process.
- Updated exposure map of people, addresses, infrastructure, and suppliers.
- Contracted redundancies: second link, power, cloud region, alternative supplier.
- Roles, alternates, and alternative communication channels defined and disclosed.
- Seasonal risk calendar with review before the rainy and heat seasons.
During and after
- Objective trigger criteria and local authority to suspend commuting.
- Standardized communication for team, clients, and suppliers in the first few hours.
- Operation in reduced mode with a previously agreed and prioritized scope.
- Record of decisions, costs, downtime, and contractual effects.
- Post-event review with adjustments to the plan and redundancies within thirty days.
What scenarios and indicators should be monitored?
Scenario analysis sounds scary by name, but in a startup, it's a structured two-hour conversation a year. IFRS S2 asks the company to assess the resilience of its strategy against different climate futures; for this, three scenarios described in business language are enough. A rapid transition scenario, with regulation and carbon pricing arriving early and contractual requirements tightening; an intermediate one, where everything advances slowly and unevenly; and a high physical impact scenario, where extreme events become recurrent in the operating region.
For each scenario, three questions: what changes in cost, what changes in demand, and what changes in our ability to deliver? The answers turn into concrete decisions—moving addresses, approving a second supplier, reviewing an energy contract, creating a product line for clients who need to adapt. The goal isn't to get the prediction exactly right; it's to discover which decisions make sense in more than one possible future.
Indicators, in turn, need to be few and reviewed on a fixed schedule. A resilience metric has a useful characteristic: almost all of them already exist somewhere else in the company, whether in finance, engineering, or procurement. The table below gathers those that fit into a startup's quarterly dashboard.
| Indicator | How to measure | Why it matters |
|---|---|---|
| Hours of downtime due to climate causes | Record of incidents with classified root cause, accumulated per quarter | Translates climate into an operational number comparable to any other failure |
| Revenue exposed in high-risk regions | Percentage of revenue coming from clients or operations in high water or flood risk areas | Shows risk concentration that no commercial metric reveals |
| Critical suppliers without an approved alternative | Absolute count over the list of five to ten essential suppliers | It is the indicator that fastest reduces vulnerability when addressed |
| Actual backup restoration time | Timed full restoration test, at least biannually | An untested backup is a hypothesis; testing turns the hypothesis into a reliable deadline |
| Coverage of alternative power and connectivity | Percentage of critical functions with a tested plan B for power and internet | Defines whether the remote operation works during a prolonged blackout |
| Energy intensity and tariff exposure | Consumption per unit of delivery and percentage of cost sensitive to adjustment or carbon | Connects physical resilience to transition risk at the margin |
| People concentrated in the same region | Percentage of the team in a single metropolitan area | Predicts the scenario where one event takes out a large part of the team at the same time |
How do cloud, remote work, and redundancy reduce vulnerabilities?
The good news for digital startups is that the three most effective resilience levers are cheap and already within reach. Cloud eliminates the server in the room that floods and allows operating in more than one geographic region. Distributed work eliminates the single address and keeps the company running when a city stops. Contracted redundancy turns an incident into an inconvenience: a secondary link, backup power for critical functions, a second approved supplier, replicated data.
The bad news is that each lever creates a new dependency, and that is where most plans fail. Cloud in a single region just changed the address of the point of failure—and data centers also depend on power and water for cooling, making them sensitive to heatwaves and water stress in the basin where they reside. Working from home shifts the responsibility for power and internet to people's homes, where there usually isn't a UPS or a redundant link. A backup that has never been restored is not a backup: it is a file with an expectation.
The simple criteria for deciding where to invest is to look at the maximum tolerable period of disruption defined in the impact analysis and compare it with the actual recovery time of each dependency. Where the actual is greater than the tolerable, there is a justified investment. Where it is lesser, there is no reason to spend more—and this discipline is what keeps the resilience plan within the budget of an early-stage company.
- Operate in at least two cloud regions for services that sustain revenue.
- Time a full backup restoration every six months and record the time achieved.
- Ensure alternative power and connectivity for functions that cannot stop.
- Keep contacts, emergency credentials, and the plan accessible offline.
- Approve a second supplier for each critical item before you need it.
- Avoid concentrating the entire team in a single metropolitan area when hiring.
Checklist for testing extreme event response
An untested plan is just a document. The exercise below fits into two hours a quarter, with a pre-chosen scenario—a flood at the main address, a 72-hour blackout, the unavailability of a cloud region, or the halt of the most critical supplier. The rule for the exercise is singular: no discussing what we *would* do; each participant actually executes their part and records the time spent.
Simulation
- Choose a scenario and a realistic time, including outside business hours.
- Declare the event via the alternative channel, without using the usual tools.
- Trigger roles and alternates and confirm who assumes each decision.
- Operate in reduced mode for the duration of the exercise, with prioritized scope.
Technical verification
- Restore a full backup and time the actual period until the service runs.
- Switch to the secondary cloud region and validate end-to-end transactions.
- Switch to the backup link and power for critical functions.
- Confirm access to contacts, credentials, and documents without relying on the main network.
Closure
- Compare actual recovery time with the maximum tolerable time for each process.
- List the three most serious failures and assign an owner and deadline for each correction.
- Update the exposure map and plan with what was learned.
- Log the exercise: this evidence is what answers client forms.
Resilience is a management decision, taken before the event
Nothing described here requires a large corporate budget. It requires the discipline to list addresses and dependencies, define how long each process can remain halted, contract the few redundancies that close the most expensive gaps, and test once a quarter. The difference between the company that suffers and the one that keeps operating is almost never the size of the investment: it's the existence of an alternative that someone had already exercised.
And there is a commercial return that often surprises. A startup that can show an exposure map, a continuity plan, and an exercise log answers large client forms in hours instead of weeks, negotiates better terms and insurance, and sustains the conversation about climate risk with investors without improvising. Well-executed resilience protects the operation and, along the way, becomes a selling point.
Referências
- IPCC. Sixth Assessment Report (AR6). This is the benchmark because it consolidates the state of climate change science and, more importantly for those running a company, presents risks by region, system, and warming scenario. The report shows that extreme events—rain, heat, and drought—have already become more frequent and intense in various regions, turning climate resilience into a planning premise rather than a speculative exercise about the year 2100. Consult the IPCC AR6
- IFRS FOUNDATION. IFRS S2 Climate-related Disclosures. This is the benchmark because it's the standard defining what needs to be disclosed regarding climate: governance, strategy, risk management, and metrics and targets, with an explicit requirement to describe physical and transition risks, their time horizons, and the strategy's resilience against scenarios. For large companies adopting this, the vocabulary cascades down the supply chain: those selling to large enterprises now have to answer questions written in IFRS S2 language. View IFRS S2
- TCFD. Recommendations. This is the benchmark because it created the four-pillar structure that IFRS S2 later incorporated and remains the most didactic way to organize the topic: governance, strategy, risk management, and metrics and targets. For a startup, the practical value lies less in the reporting format and more in the discipline of separating physical risk from transition risk and assigning each a time horizon and an owner. View TCFD recommendations
- WRI. Aqueduct Water Risk Atlas. This is the benchmark because it allows you to estimate, for free and by geographical coordinate, the water risk of any address: water stress, drought risk, and riverine/coastal flooding risk. It is the fastest tool to answer the question that opens any exposure analysis—are the office, the critical supplier, and the data center located in regions with what level of water risk today and in future scenarios? Explore WRI Aqueduct
- ISO 22301. Business Continuity Management. This is the benchmark because it provides the continuity method that the climate topic was missing: business impact analysis, definition of maximum tolerable period of disruption, response plans, roles, communication, and—crucially—periodic testing. Climate enters this standard as a family of disruption scenarios; using its structure avoids creating a parallel plan that no one knows how to trigger. Consult ISO 22301