Operational Resilience

Operational resilience is an organization's ability to prevent, adapt, respond to, and recover from disruptions while continuing to deliver critical operations.

Operational resilience goes beyond traditional business continuity to focus on maintaining critical functions during any disruption.

Key components: - Service Identification: Map critical business services - Impact Tolerance: Define acceptable disruption levels - Scenario Testing: Test against various disruption scenarios - Dependency Mapping: Understand third-party dependencies - Recovery Capabilities: Ability to restore within tolerance

Regulatory drivers: - DORA (EU financial sector) - Bank of England operational resilience rules - APRA CPS 230 (Australia) - OCC guidance (US banking)

Difference from BC/DR: - BC/DR focuses on recovery after - Resilience focuses on maintaining operations during

Why It Matters

Operational resilience shifts the focus from recovering after a disruption to maintaining operations during one. With DORA now in effect and similar regulations emerging globally, financial institutions and their technology providers must demonstrate they can absorb and adapt to disruptions while continuing to deliver critical services. This requires understanding all dependencies, setting impact tolerances, and testing scenarios regularly.

Key Points

Focus on preventing disruption, not just recovery

Define impact tolerances for critical services

Map all dependencies including third parties

Increasingly required in financial sector

Regular scenario testing is essential

Applicable Compliance Frameworks

ISO 27001 SOC 2

Related Terms

Business Continuity

Business continuity planning (BCP) is the process of creating systems of prevention and recovery to deal with potential threats to a company, ensuring critical functions can continue during and after a disaster.

DORA

DORA (Digital Operational Resilience Act) is an EU regulation that requires financial entities to ensure they can withstand, respond to, and recover from ICT-related disruptions and threats.

Disaster Recovery

Disaster recovery (DR) is a set of policies, tools, and procedures designed to enable the recovery or continuation of IT infrastructure and systems following a disaster.

Frequently Asked Questions

What is an impact tolerance?

The maximum acceptable level of disruption for a critical service—expressed in time, data loss, or other metrics. Goes beyond traditional RTO/RPO.

Is operational resilience the same as cybersecurity?

No, but related. Cyber is one threat to resilience. Operational resilience covers all disruption types: cyber, natural disasters, third-party failures, pandemics.