From Resilience-by-Design to Assurance: Making the Five (5) A’s Work as One Tourism Security System

Part 2 of 2 parts

In the first part of this article, we examined the original end-to-end tourism security concept and narrowed it to the Five (5) A’s: Attractions, Accessibility, Accommodation, Activities, and Amenities. The argument was deliberately kept simple. Tourism security does not need an ever-growing list of A’s; it needs a deeper understanding of the elements already included in the tourism experience. The issue, therefore, is what happens when these five systems are under stress, and it has become particularly relevant in 2026 as the Philippines serves as ASEAN Chair with the theme “Navigating Our Future, Together”. The 48th ASEAN Summit, held in Cebu in May, placed the country’s tourism, hospitality, transportation, communications, security, and emergency systems directly into an international operating environment, and the government has officially improved the tourism sector’s position within the national organizational structure for ASEAN 2026. This is not merely an event-management problem; it tests the country’s ability to get the Five A’s to work together.

Tourism Security Is a Systems Problem

A tourist seldom faces a single risk. Take a fairly common sort of disruption: a severe weather event hits an airport and causes flights to be delayed. Passengers then start searching for other transport as hotels face early arrivals and people left behind, and online booking sites show changing availability. Demand rises at restaurants, hospitals prepare for possible weather-related injuries, and tour operators cancel activities as conflicting information spreads on social media. A government advisory is released, and shortly afterward a fake social media account publishes a false statement saying that the destination is unsafe. Within hours, what began as a weather issue suddenly becomes a problem involving transportation, accommodation, information, communications, business continuity, and reputation.

It is a systems problem and cannot be handled by a single agency or security team once the disruption has already cascaded.

The Five A’s Must Be Connected Before the Crisis

Tourism resilience depends on the relationships among the Five A’s: attractions require accessibility; accommodation relies on both accessibility and amenities; activities depend on the weather, transport, communications, health services, and emergency services; and amenities, in turn, support all the other A’s. Because a failure in one area can create problems in another, destination security evaluations should not merely ask whether individual establishments are secure; they should also examine what each establishment depends on and what depends on it. Resilience can be built only this way.

The Hidden Infrastructure of Tourism

Among the most crucial tourism security resources are those which tourists do not see. These comprise emergency communication systems, backup power supplies, networks for referring patients to medical care, alternative transport options, water supply systems, telecommunications, cybersecurity measures, procedures for reporting incidents, emergency operations centers, trained staff, mutual-aid agreements, dependable weather information, crisis communication protocols, and the relationships between public and private stakeholders. Because these systems tend to be overlooked when everything is functioning normally, their importance becomes apparent only when a problem arises. A resilient destination therefore invests in capabilities that are seldom visible but become vital when a disruption occurs.

The Platform Has Become Part of the Destination

As tourism becomes increasingly digital, it introduces another layer. A tourist might come across an attraction on social media, book lodging via Airbnb or some other short-term rental service, compare hotels on Agoda or Expedia, organize transport using a digital app, buy an activity online, make a payment through an e-wallet, use a mapping application to navigate, and communicate by means of messaging services—all without knowing which company, agency, or country is in charge of each of these steps. To the tourist, the entire experience counts as a single journey,, which in turn raises a new issue of accountability. When an accommodation listing is found to be fraudulent, who helps the tourist? If an activity booked through an online platform is canceled due to a hazard, who provides an alternative? If a payment is compromised, who deals with the situation, and if a platform is unavailable during a major disruption, where can the tourist get reliable information?

The question then is not whether platforms are good or bad, since they clearly increase access, choice, convenience, and market reach. What matters is whether destinations have incorporated the platforms into their resilience plans. In the digital age,, tourism security standards must account for verification, data protection, payment security, fraud prevention, emergency assistance, provider accountability, and service continuity, as the platform is now part of the tourism infrastructure.

Climate Risk Is an Operational Risk

Climate change is also altering the concept of tourism security. It is not necessary for a destination to suffer a catastrophic disaster for tourism to be disrupted; extreme heat can change the nature of outdoor activities, drought can have an impact on destinations which are water-intensive, heavy rain can make roads and attractions inaccessible, storms can interfere with flights and ferry services, and coastal hazards can damage the tourism infrastructure. Because wildfires, haze, flooding, landslides, and other environmental hazards can affect both visitors and staff, the tourism industry must shift from being aware of the weather to making decisions based on forecasts. When a forecast is available an operational decision should be made, there should be a threshold beyond which an activity is modified; the destination should know when an attraction has to close, the hotel should know how to keep its essential services running during a prolonged disruption, and transport operators should know when routes become unsafe. This approach is known as resilience-by-design.

The ASEAN climate outlook has long stressed the need to monitor climate conditions and their effects on Southeast Asia’s economies and communities, and the current situation clearly shows how climate events can directly affect tourism activities. In Sri Lanka, for instance, severe droughts have led to restrictions on tourist visits to certain areas of Yala National Park, as authorities have focused on ensuring water supplies and protecting wildlife. The Philippines has plenty of examples of this. In 2026, prolonged southwest monsoon rains put large parts of Central Luzon, such as Pampanga, into a state of calamity for several weeks, forcing the displacement of hundreds of thousands of people and disrupting transport, agriculture, and local business activities well beyond the area immediately affected by the flooding. Central Luzon is not a small tourism route; it is the country’s main air entry point outside of Metro Manila and serves as a transit route for millions of domestic and international travelers each year. A tourism problem does not have to involve a single hotel or attraction; a flood affecting roads, airport approaches, or the power supply tourism relies on is enough, which is why climate risk is no longer a future concern for tourism. It is an issue operations face today.

Cybersecurity Has Entered Every A

Cybersecurity also affects all five aspects. Attractions offer online ticketing and maintain visitor databases; transport relies more and more on digital booking, tracking, communication, and payment systems; and hotels manage reservations, guest information, Wi-Fi, access controls, building systems, and financial transactions. These activities use online booking, digital waivers, payments, communication, and sometimes location data, and amenities increasingly rely on digital financial systems, telecommunications, health information, and public information platforms. A cyber incident can therefore disrupt tourism in the physical world.

Consider a simple case. When peak season arrives, the hotel’s reservation system goes down, guests can’t confirm their bookings, front-desk work slows down, and payment processing becomes unreliable. Customer information might then be lost, visitors get annoyed, and complaints start to appear on social media. What began as a technical issue has now turned into an operational and reputational one, which is the reason why cybersecurity should be seen as an aspect of tourism continuity. The World Economic Forum’s 2026 cybersecurity outlook highlights the growing importance of interconnected systems and supply-chain exposure, and tourism is especially vulnerable because the visitor’s journey involves many different organizations and digital platforms.

The Real Test Is Not the First Incident

Even if a destination manages an incident reasonably, it can still fail the resilience test, since the first incident might be followed by a second. For example, a typhoon could be followed by a communications outage; a transport disruption could be followed by the spread of misinformation; a cyberattack could happen at the same time as a physical emergency; and a medical emergency could occur while hospitals are already handling another event. This is the reason why the conventional tabletop exercise which asks what would happen if a fire took place, is no longer adequate. A more useful exercise asks what would happen if the fire occurred when telecommunications were down, roads were congested, tourists were posting conflicting information online, and the main hospital was at full capacity. Only in such a situation does organizational resilience become apparent.

From Emergency Plans to Operating Capability

Although most tourism organizations have some kind of emergency procedure, having a plan does not mean that they have the necessary capability. A resilient organization can quickly answer five questions: who is in charge, who is responsible for communication, who takes action, what continues to happen, and what changes. If these answers are unclear, the organization will waste time during an incident, and this is also true at the destination level. Various stakeholders must understand their roles before a crisis occurs. The police should know how tourism operators are to report incidents, hotels should know where to get official information, hospitals should understand the process by which tourist emergencies are escalated, tour operators should know when activities are to be suspended, transport providers should have alternative arrangements, local government should know how to co-ordinate public and private resources, and cybersecurity teams should know when a digital incident has become a tourism continuity issue. This is not bureaucracy; it is about response time.

Crisis Communication Is Part of Security

One often-overlooked aspect of tourism resilience is communication. If an incident is not communicated well, it can grow beyond the original event, since a lack of information creates a vacuum someone will fill. In 2026, that person could be a tourist, an influencer, an anonymous account, an automated system, or a malicious actor. Communication for a destination therefore must have three features: it must be quick so information reaches affected visitors before speculation takes over; it must be accurate so it distinguishes verified facts from uncertainty; and it must be actionable so visitors know what to do. Simply stating that “the situation is under control” is not enough. A helpful message should tell visitors whether to travel, where to go, what to avoid, what is still open, where to get help, and when the next update will be published. This is what Assurance means in practice.

Assurance Must Be Demonstrated

Assurance should not end up being yet another tourism slogan; it has to be shown by actual performance, and a destination can assess it by posing practical questions such as: how quickly can a visitor get access to verified emergency information, how long it takes to put into operation alternative transport, how quickly can a hotel deal with its guests, how quickly can an injured tourist get access to proper medical care, how long can essential services keep going in the absence of normal utilities, how quickly can a cyber incident be contained, how quickly can the destination correct false information, and how quickly can tourism operations get back going? Most importantly, by how much does the destination’s resilience improve after the incident? These are questions that can be measured, and they turn Assurance from an abstract idea into a concrete objective.

The Tourism Security Maturity Test

A maturity model that is practical can be used in relation to any destination, progressing from a reactive position—where the destination only responds when something occurs and the various stakeholders act on their own—to one that is resilient by design, in which security, safety, disaster risk reduction, cybersecurity, business continuity, climate adaptation, and crisis communication are incorporated into tourism development right from the start. The stages in between, namely prepared, integrated, and adaptive, represent the step-by-step development of coordination, shared information, and real-time decision-making as described in this article.

We should not state that a destination is resilient; instead, we should show increasing capability.

ASEAN 2026 as a National Learning Opportunity

The Philippines hosting ASEAN 2026 presents a special opportunity because it involves all the systems needed for tourism resilience—namely security, transport, hospitality, health, communications, tourism, local government, protocol, cybersecurity, and emergency management. The national organizing structure understands how these areas are interdependent. Within the ASEAN 2026 framework, responsibilities for secure transport and telecommunications are assigned, and the tourism and hospitality element covers cultural events, tours, welcome receptions, social events, and site enhancement, which is in effect, the Five A’s being put into action in an international setting.

The lesson should not conclude with the end of the ASEAN calendar; the capabilities gained through ASEAN should become widely available, the procedures tried out for international delegates should enhance the experience of regular tourists, the infrastructure built for large events should benefit local tourism, and the relationships established among the various agencies and private operators should stay active. In this way, an event becomes a resilience investment rather than just an event.

The Next Step: Test the System

The tourism industry has plenty of conferences, but what it needs more is a chance to examine relationships between organizations, since a destination may have good policies and still fail in a compound incident. The only way to spot the gap is to put the system to the test: bring the various stakeholders together, draw up the Five A’s, identify the dependencies, introduce a realistic scenario, add a second disruption, and then assess the response. Who gets the first alert and who confirms it? Who takes the decision and who communicates with tourists? Who is in charge of moving people, who gives medical assistance, who secures the hotel, who handles the digital systems, who deals with misinformation, who restores operations, and who explains what took place afterward? The exercise proves valuable when participants realize the problem does not lie with a single organization; it lies with the system as a whole.

PROtecTOURS 2026: From Discussion to Demonstration

PROtecTOURS 2026 (www.protectours.asia) is designed around operational thinking and professional protection of tourism. Its aim is to bring the various elements of the tourism ecosystem together to discuss and, more importantly, address the same operational problem, rather than creating another silo for tourism security. Tourism stakeholders must understand how physical security, disaster risk, crisis management, cybersecurity, health, transportation, hospitality, communications, and business continuity are interrelated. For this purpose, the Five A’s offer a shared language, scenario-based exercises put pressure on the system, and the gaps that emerge form the basis for improvements.

The same monsoon conditions mentioned earlier also affected PROtecTOURS 2026, prompting the organizers to change the event’s operating schedule this year. This serves as a reminder that resilience planning is not merely an academic exercise carried out from a position of safety, but a discipline practiced by people situated within the risk environment they are trying to improve. PROtecTOURS 2026 can therefore be seen not just as an event, but as a chance for stakeholders in the Philippine tourism sector to consider whether the tourism experience can remain safe and functional when normal operating conditions are no longer in place; in this way, Assurance is generated.

The Competitive Advantage Is Confidence

Tourism destinations strive to attract attention, investment, visitors, events, conferences, and return customers. Once people are interested because of the attractions, accessibility gets them there, accommodation provides a place to stay, activities offer experiences, and amenities enable the trip. Yet assurance determines whether people trust the destination, since in a world where geopolitical risk, climate disruption, cyber incidents, health emergencies, misinformation, and infrastructure failures can rapidly change travel conditions, that trust matters. The best tourism destination isn’t the one that claims it is free from risk because no destination can be entirely free from risk; it is the one that shows it understands its risks and can manage them.

Returning to the Original Idea

Back in 2013 when I was writing Tourism Security: End to End, my aim was to get the various stakeholders in the tourism industry to look beyond their own individual responsibilities. That principle still holds; the difference now is the extent and pace of interdependence. Today, the tourist moves through physical and digital systems at the same time, and their experience is influenced by organizations that may never have come together. If a disruption in one section of the journey, affects the others, resilience must be the responsibility of all five A’s rather than something left to security, government, the hospitality sector, or disaster management.

The Five A’s, One Assurance

The framework can thus be summed up in a single statement: attractions need to be protected, accessibility must stay adaptable, accommodation has to remain safe and operational, activities should be managed on the basis of risk, and amenities must support the tourism ecosystem. When these five areas work in coordination, they yield something more valuable than mere compliance—they generate Assurance, and Assurance in turn leads to confidence. This confidence enables travel; travel, in turn, promotes tourism; and tourism supports communities, businesses, employment, investment, and the nation’s economic resilience.

The main aim of tourism security is to go beyond preventing incidents and ensure that, if a disruption does occur, the visitor’s experience does not become a failure of the whole system. For the Philippines, that will be the challenge in 2026 and at the same time, an opportunity. Secure tourism is resilient tourism, and resilient tourism is tourism that can maintain people’s trust even when circumstances change. The final test is straightforward: when something goes wrong, can the Philippines show it knows how to respond?