Best Practices for Organizational Resilience in the International Space Station (ISS) Program

The International Space Station (ISS) is a multifaceted international sociotechnical system with a U.S. Operating Segment that is managed by the NASA ISS Program. This program is responsible for making high-stakes decisions for operations and safety in both flight and ground operations. Following a close call during an extravehicular activity (EVA), in which an astronaut experienced impaired visibility and breathing, the Mishap Investigation Board (MIB) identified “normalization of deviance” as a reason that early signals were missed in identifying that the situation was taking a turn for the worse. The MIB recommended the ISS Program “institute requirements and behaviors that combat the tendency towards complacency.” In 2016, the ISS Program requested an independent assessment by the NASA Engineering and Safety Center (NESC) Human Factors Technical Discipline Team (TDT) to provide guidance.

Conventional solutions to addressing complacency and normalization of deviance have remained elusive. Resilience engineering represents an emerging approach to risk management that focuses on an organization’s ability to continuously recalibrate (i.e., accommodate change and recognize subtle cues signifying impending disruptions, changes, or pressures). This assessment employs principles of resilience engineering to determine where the ISS Program exhibits properties of a resilient organization and where there are opportunities to increase resilience.

Traditional organizational assessments utilize risk management approaches focused on reactive responses to risks identified through hazard analysis or following an accident investigation. The conventional method for managing risk and safety systems seeks to control and reduce variability in organizational performance, in part by instituting forms of restriction and compliance. While a tightly monitored system with more procedures and processes may prove effective in reducing or stabilizing some types of errors and accidents, it does not possess flexibility, transparency, or the ability to anticipate system changes or disruptions. A resilient organization is able to effectively adjust its functioning prior to, during, or following expected or unexpected disturbances, so that it can sustain required operations. In contrast, a brittle system operates at unsafe margins and fails to recognize warning signals or adjust in time to continue proper function.