Safety Isn't Moving Everything Back to Taiwan: Real Resilience Is How Fast You Recover After Something Breaks

When a critical material depends entirely on a single foreign source, building local capacity obviously has value. The problem is that jumping straight from "protect a critical capability" to "bring all production back home" simply trades one kind of concentration risk for another.

The OECD’s 2025 Supply Chain Resilience Review models a shift toward more domestic supply chains that could reduce trade and growth without consistently improving stability under disruption. GDP stability declines in more than half of the economies analyzed. ^[1] This is a model comparison, not a record of losses already incurred or a verdict against every localization investment. It is a reason to compare diversification, risk management, and international coordination alongside domestic production.

The reason is practical. If raw materials, factories, electricity, logistics and technicians are all concentrated in the same geography, an earthquake, water shortage, power outage, pandemic or cyber incident can hit the entire chain at once. Moving capacity closer does not automatically make the dependency disappear — it only changes its shape.

So localization should answer two questions: which capability is unacceptable to lose if it is interrupted? And would the market automatically supply an alternative during a crisis? The first identifies the safety-priority items; the second determines whether it is worth paying a higher cost to build a domestic minimum capacity, stockpile, or government guarantee.

NIST’s glossary definition of “information system resilience” includes sustaining essential capabilities under adverse conditions and recovering within a time frame consistent with mission needs. ^[2] Its separate buildings and lifelines research considers transportation recovery times, investment choices, and disruption losses together. ^[3] The scopes differ: one concerns information systems, the other buildings and infrastructure. Neither sets a universal recovery deadline for manufacturers.

Drawing on those ideas, this article proposes two numbers for policy and business discussions. This is our editorial adaptation, not a NIST certification standard for companies.

The first is the minimum service level: when the shock hits, which functions absolutely must continue? For healthcare that might be emergency care and medication delivery; for telecoms, critical nodes and emergency communications; for a business, receiving payment, core order processing and customer service. It is not enough to write "maintain operations" — the minimum capacity has to be spelled out.

The second is the target recovery time: how long until the system moves from minimum function back to an acceptable normal level of service? Different processes may be measured in minutes, hours, days, or longer; actual targets depend on customer commitments, tolerable losses, and test results. That difference directly determines whether you need real-time backup, remote backup, an alternative supplier, or just a manual workaround.

Without these two numbers, a resilience budget easily turns into "buy a bit more, feel a bit safer."

Inventory buys time, but it does not guarantee that goods are actually reachable during a disruption. If warehousing, cold chain, electricity, roads, payments and allocation data all fail at once, a large inventory number does not equal service capacity.

Backup systems provide an alternate path, but they do not guarantee the switch actually works. Has the second supplier been certified? How far behind is the data at the second data center? Has the backup generator been load-tested? Do people even know who has the authority to flip the switch?

Localization reduces a specific external dependency, but it does not guarantee the local system has no shared single point of failure. If raw materials, equipment, electricity and technicians still rely on the same region or the same cloud service, a rising localization ratio may simply hide the risk more deeply.

All three kinds of investment have to come back to the same question: how much does it raise the minimum service level, and how much does it shorten recovery time?

That question changes the procurement order. The first thing worth investing in is not necessarily the most expensive equipment, but whatever link shortens the unacceptable downtime the most.

A single unit can complete its own backup checklist and the whole system can still go down together. Power affects communications; communications affect payments and dispatch; payments affect logistics; logistics affects healthcare and food supply. Every link may say it has a backup, yet several of them may share the same substation, the same identity-verification service, or the same handful of people who can actually make the repair.

This is the part of resilience most easily underestimated: overall recovery depends on the order in which systems restart, shared dependencies, and which tasks can run in parallel. A hard-to-replace link may delay the whole process.

So government and corporate drills should not only ask "did we finish," but also "who does our plan assume will recover first?" If the hospital assumes power comes back first, logistics assumes payments come back first, and government assumes private-sector cloud services come back first, then all the plans added together may leave no one going first.

If "don't fully re-localize" gets translated into "don't localize at all," that is a different mistake in the opposite direction. Healthcare, energy, communications, critical components and dual-use military-civilian capability may not have time, in a crisis, to wait for the market to re-match supply and demand. For these items, building a domestic minimum capability, a strategic stockpile, or a government guarantee can be entirely the right call.

The real disagreement is not over whether to pursue safety, but over which layer that safety should be bought at. Bringing all capacity back home may shorten shipping distances, but it can also turn earthquakes, blackouts, water shortages and talent shortages into a shared single point of failure; keeping part of the domestic capability while also diversifying international sources costs more in management complexity and cross-border coordination. Neither option is free.

Policy therefore cannot use "localization ratio" as its only metric. It should also list, side by side: minimum domestic supply capacity, the number of alternative sources, the certification time needed to switch, shared dependencies, the cost of inventory rotation, and recovery time under different scenarios. Only by putting cost and recovery effect side by side can anyone judge whether a given localization investment actually reduces risk — or simply renames it.

From continuity of operations in Kaohsiung to healthcare and essential supplies in New Taipei, the 2026 official accounts identify concrete activities to follow. ^[5][6] But the material reviewed here consists of news announcements, not complete test results, a sample of businesses, or records verifying completed improvements. The following proposed indicators are a way to assess subsequent progress.

The next step does not require publishing sensitive vulnerabilities, but it does require publishing institutional-level improvement results: what recovery time windows have been set for critical services? Have cross-county and cross-agency handoffs been completed? How many of the problems found in the last drill were fixed within deadline? Does the same bottleneck keep recurring?

Publishing only participant counts, vehicle numbers and the number of drills held shows society the scale of the activity. Publishing functional targets, gaps, the responsible agency and improvement deadlines is what lets society see the actual capability.

This gives SMEs a practical starting point too: take one important order and break recovery capability into questions that can be checked individually.

The following discussion tool was designed by this publication, drawing on the functional-recovery ideas above. It is not a NIST or government certification form, and it does not replace customer validation, a business-continuity plan, or an actual exercise. ^[2][3]

Describe the order in one chain: what the customer needs → essential supplies and processes → the delivery deadline → conditions that could change the arrangement. Labels such as “an overseas customer” or “a key component” are enough; no confidential details are required.

Then choose one disruption: a late supplier, equipment downtime, blocked transport, or a new customer validation requirement. This is a planning assumption, not a prediction.

Take the most important missing evidence into a discussion with purchasing, production, or the customer contact. A supplier that has only been contacted should not be recorded as ready to take over. Revisit the worksheet when delivery dates change, customers add validation conditions, or a test fails. Leaving the current arrangement in place can also be a useful decision, provided its reasons and review triggers are recorded.

If the constraint is component origin or customer specifications, continue with “The Three-Layer Dividend of De-Risking from China” to consider whether the gap is origin documentation, validation capability, or another source of supply. If public support is relevant, “The Tariff-Relief Implementation Gap” offers dated snapshots rather than live application guidance. See the Geopolitical Economy topic for related reading.

After completing the worksheet, choose one assumption that most needs testing: whether the alternative supplier can take over, who can approve the switch, or whether data can be restored. Arrange a small test suited to the operating environment and compare estimated time with actual time. If the gap is large, record the bottleneck before deciding whether to improve documentation, change a process, or add backup capacity.

Government can apply the same approach: without exposing sensitive weaknesses, track whether previously identified problems were fixed and whether a repeat exercise demonstrates improvement. A company can bring the record into its next order or purchasing discussion and check whether its recovery target still fits.

Inventory, domestic capability, and backup systems should find their purpose through this process. Assessment, testing, correction, and retesting help turn budgets and equipment into recovery capability that can actually be used.