Operational resilience: demonstrating resilience in practice

Firms must identify and document the people, processes, technology, facilities and information needed to deliver each important business service. This should include dependencies on third parties, group services, shared infrastructure and other arrangements that could affect the firm’s ability to remain within impact tolerance.

Examples of good practice

• Stronger firms use mapping to identify dependency risk across third and fourth parties, group services, financial market infrastructures, shared platforms and technology services.
• Effective mapping shows how important business services are delivered from end to end and how disruption to people, processes, technology, facilities, information or dependencies could affect delivery of important business services.
• More mature approaches use mapping outputs to inform testing, vulnerability management, remediation prioritisation, investment decisions and Board reporting.

These give firms a clear view of how important business services are delivered from end to end, and how dependencies could affect this if they were unavailable or disrupted.

Examples of poor practice

• Some firms rely on assumptions about third party, group or shared service resilience without showing how they have tested or challenged those assumptions.
• Some self-assessments do not explain how dependency failure would affect customers, clients, market integrity or the firm’s ability to remain within impact tolerance.
• Some mapping remains too focused on technology, without properly covering people, processes, facilities, information and operational dependencies.

This theme was also raised in March 2026. Our latest observations build on it by highlighting how dependencies may affect firms’ ability to remain within impact tolerance during disruption. 

Firms must develop and maintain testing plans that show they can remain within impact tolerances for each important business service through severe but plausible disruption. Testing should be informed by the firm’s risk profile, vulnerabilities, dependencies and previous incidents.

Where firms discover that there are scenarios they would currently be unable to fully recover from within impact tolerance, stronger firms continue the analysis beyond identifying the recovery limitation.  

Firms need to identify when disruption could cause intolerable consumer harm or threaten market integrity, and assessed how response options could prevent, minimise or delay those impacts.

We observed stronger firms minimise the impact of disruptions to avoid intolerable harm to consumers or threats to market integrity. This was evidenced through contingency arrangements, prioritisation decisions or minimum service arrangements. More mature firms go on to consider whether their scenario testing explains the service outcomes that would need to be maintained during severe cyber disruption or material third party failure, and how they have tested assumptions about recovery, suppliers and workarounds.

Firms that use non-time-based metrics to inform their impact tolerances demonstrated a clearer understanding of how response options would prevent, minimise and/or delay the impacts to consumers or markets. This enabled firms to make more informed prioritisation decisions across elements of their important business services – for example thinking about transaction volumes and values, types of end user and how their response would mitigate any intolerable harm to consumers, or threats to market integrity. Stronger analysis also considered how this would play out in the markets they operate in, if there’s more than one firm affected by a disruption.

Examples of good practice

• More mature firms use testing to demonstrate whether each important business service can remain within impact tolerance, not just whether existing plans and procedures work.
• Mature firms test how disruption to interconnected services or shared dependencies could affect multiple important business services at the same time, and how this may create cumulative harm or competing recovery priorities.
• Effective testing considers the possibility of major cyber disruption, data integrity issues, third party failure, group service disruption, loss of key staff, degraded communication channels and unavailability of production environments.
• Stronger self-assessments explain assumptions, evidence supporting recovery times, limitations of workarounds and risks that remain after testing.

This means that firms have a clear view of their current capabilities and the priority areas they need to invest in.

Examples of poor practice

• Some firms rely on manual workarounds without showing how these workarounds would operate during a severe disruption, including whether they are scalable for a large number of impacted users and/or services, particularly over an extended period.
• Some firms rely on assumptions about supplier and/or group service providers’ operational resilience or cyber recovery arrangements without showing how they have tested them against severe but plausible disruption.
• Some firms’ self-assessments do not explain how they would maintain essential services so that the potential for intolerable harm to consumers or threats to market integrity were minimised if full recovery within the impact tolerance was not possible.
• Some firms do not demonstrate that their testing is sufficiently severe or aligned to the vulnerabilities and dependencies that the mapping identified.
• Some firms state that they would be able to recover from every scenario within impact tolerance, but do not show evidence to support this.

Severe but plausible testing was raised previously. The latest findings suggest that stronger firms focus more on whether testing demonstrates resilience in practice, including whether their assumptions, workarounds and recovery strategies remain valid under stress. 

Firms' mapping and testing should identify vulnerabilities that could prevent them remaining within impact tolerance. Firms should be able to show how vulnerabilities are prioritised, remediated, validated and re-tested.

Examples of good practice

• Stronger firms validate remediation and re-test where needed, rather than treat closing an action as enough evidence that their resilience has improved.
• Clearer self-assessments distinguish between remediated, open and risk-accepted vulnerabilities, and explain how they can recover despite them.
• Effective remediation approaches include owners, timelines with target closure dates, prioritisation criteria, funding decisions and governance routes.
• This means that firms can distinguish completed actions from improvements that have demonstrably increased resilience, understand the residual risk from open or risk-accepted vulnerabilities, and prioritise further remediation and funding decisions.

Examples of poor practice

• Some firms describe planned remediation but do not clearly state whether they can remain within impact tolerance before it is complete.
• Some firms do not show enough evidence that remediation has been validated, re-tested or considered by the Board where residual risk remains.
• Some firms report few or no vulnerabilities, but don’t provide evidence to show how they reached those conclusions.

In March 2026, we shared observations relating to how firms identify, remediate, track and close vulnerabilities. These latest findings build on that. We focus on whether firms can show that remediation has improved resilience, not only that actions have been completed. 

Firms must maintain an internal and external communications strategy that can support clear, timely and relevant messaging during operational disruption. Communications should help reduce harm, support customers and market participants, and support escalation and decision making.

Examples of good practice

• More mature firms test communications as part of their operational resilience scenarios, including what they would do if their usual channels were unavailable and they needed to communicate quickly.
• Stronger firms consider how they would make sure their communications supported customers in vulnerable circumstances, customers unable to access services, market participants and relevant authorities.
• Effective approaches identify internal and external audiences, escalation thresholds, approval routes, alternative channels and decision points.
• This means that firms can provide clear and timely information in different scenarios, including if their usual channels are unavailable, so that they can continue communicating to support decisions and help reduce harm even during disruption.

Examples of poor practice

• Some firms provide limited evidence that communications would work if usual channels were unavailable, degraded or compromised.
• Some do not clearly explain how they would prioritise communications during prolonged disruption, nor adapt them for different audiences.
• Some self-assessments do not show how firms would use operational information, customer impact data and incident decisions to inform how they communicate during disruption.

We raised this theme in our last report. Our latest review showed that stronger firms have enough evidence to show that communications would work if normal channels, data flows or approval routes were unavailable. 

Boards and senior management should have sufficient information to understand the firm’s operational resilience position, challenge assumptions, prioritise remediation and oversee ongoing resilience. Firms should consider whether their self-assessments clearly explain accountability for important business services, including where delivery depends on group services or shared infrastructure.

Examples of good practice

• More mature firms give Boards clear information on resilience capability, residual risk, vulnerabilities, remediation progress and investment choices, so they can challenge the firm’s current resilience position and prioritise action.
• If there are important business services that depend on group services, shared platforms or group arrangements, stronger firms clearly show that UK entities retain sufficient visibility and accountability, and that this helps with understanding the whole firm’s operational resilience.
• Effective governance arrangements show clear ownership for important business services, impact tolerances, mapping, testing, remediation and communication.
• Stronger self-assessments include second and third line input and show how firms track findings and challenge actions through to effective completion.

Examples of poor practice

• Some firms rely on Board approval of the self-assessment as the main evidence of oversight, without showing the nature of challenge, decision-making or prioritisation.
• Some firms do not provide enough evidence that UK Boards or senior managers have visibility over dependencies managed at group level.
• Some governance materials do not clearly distinguish current capability from planned improvements.
• Some self-assessments show limited evidence of independent assurance, second line challenge or third line review.

In March 2026, we highlighted observations relating to Board oversight, clear ownership, challenge, and second and third line involvement. These latest findings build on this – they focus on Board and senior manager visibility of current resilience, risk, and dependencies managed through group or shared arrangements.