Operational Resilience Policy

LESSON 1: Scenario Testing is Only as Good as Your Resource Mapping

Accurate and reliable resource mapping is essential. Scenarios must be based on up-to-date and detailed information about essential resources, including upstream and downstream dependencies.

Resource mapping helps identify single points of failure and model impact. Understanding the “handshake” between IBSs and infrastructure is key when testing infrastructure scenarios. Inaccurate maps produce unreliable results, giving a false sense of resilience.

LESSON 2: Define “Critical” Consistently

Criticality means that if a resource becomes unavailable or its integrity is compromised, it will disrupt delivery of the IBS to one or more customers. This is a low threshold, and it must be applied consistently across the organisation.

Avoid reverting to volumetric or likelihood-based definitions, which can lead to overlooking scenarios that may cause unacceptable harm. Keep the interests of all clients and customers at the forefront.

LESSON 3: Testing Reveals Truly Critical IBSs and Informs Recovery Sequencing

While IBS-specific testing focuses on individual services, aggregated mapping can reveal concentration risks and interdependencies between IBSs.

Infrastructure scenarios (e.g., ransomware, major data corruption) can highlight which IBSs must be prioritised for recovery and the sequence for rebuilding infrastructure. This insight can guide architecture redesign, customer treatment planning, and substitution strategies during recovery.

LESSON 4: Shift from a Risk to a Resilience Mindset

A common cultural challenge is the tendency to take a risk-based approach — assuming existing preventative controls make severe scenarios unlikely. However, resilience requires planning for plausible low-probability events where multiple controls fail.

Before ransomware’s surge in 2015, many underestimated such threats. Preventive investment remains important, but firms must also invest in recovery capability. Balance a protective mindset with readiness to respond and recover.

Looking towards the next round

Post-March 2022, regulators will review each firm’s approach and share good practices in late 2022 or 2023. In the meantime, firms should focus on:

1. Moving Towards More IBS-Agnostic Process Mapping and Testing

With initial resource mapping and IBS-specific testing done, the next phase should focus on infrastructure and complex cyber/data integrity scenarios. While the number of tests may decrease, the depth of analysis will increase.

2. Ensuring Scenario Testing Delivers Value

Ask two questions for each scenario:

• Will it provide a new perspective on potential failures and client impact?
• Will it reveal new vulnerabilities or recovery requirements?

Coordinate with transformation programmes to avoid duplicate remediation work and to embed resilience thinking early.

3. Managing Tensions Between Resilience and Other Organisational Objectives

Resilience measures can conflict with optimisation or risk reduction efforts. For example, reducing the number of data centres may cut costs but create concentrated points of failure. Maintaining IBS delivery after an incident might require disabling certain controls, increasing risk. Such tensions should be addressed openly.

Final thoughts

The Operational Resilience Policy aims to shift focus from preventing incidents to operating through them. With rising cyber threats, the aftershocks of the pandemic, and geopolitical instability, resilience has never been more critical.