Lead Operational Resilience Manager cheat sheet

Operational resilience is the ability of an organization to prevent, adapt to, respond to, recover from, and learn from operational disruptions; it is outcome-based, not asset-based.

Four core outcomes (UK PRA/FCA model): identify important business services, set impact tolerances, map critical dependencies, and test severe-but-plausible scenarios.

Impact tolerance is the maximum tolerable level of disruption to an important business service, expressed as a time limit (e.g., hours of outage) plus qualitative harm criteria.

Important business services are those whose failure causes intolerable harm to consumers, market integrity, or firm soundness - determined by harm, not by revenue size.

Resilience differs from risk management: risk focuses on likelihood-weighted loss events; resilience assumes disruption occurs and focuses on continuity of outcomes.

Severity dimensions for scenario design: duration, scale (number of customers/transactions affected), and scope (single service vs. cross-firm or systemic).

Recovery time objective (RTO) is a technical restoration target; impact tolerance is a business-level harm threshold - RTOs must be set inside tolerances, never outside them.

Maturity progression typically runs: awareness, ad hoc response, defined processes, integrated management, adaptive/optimized continuous improvement.

Framework components: governance and accountability, policy and standards, service and dependency inventory, impact tolerances, scenario library, testing programme, incident management, and assurance/reporting.

Assign named accountable owners for each important business service; accountability sits with business line executives, not only with risk or technology functions.

Governance body structure: board-level oversight sets risk appetite for disruption; an executive resilience committee owns delivery; service owners execute.

Policy hierarchy: board-approved policy → standards defining minimum requirements → procedures and playbooks → evidence and records.

Risk appetite for resilience must be quantified in tolerance terms (e.g., 'no important business service exceeds its impact tolerance more than once per year').

Dependency mapping must extend beyond first parties to shared infrastructure, people, premises, utilities, and fourth parties (sub-outsourcers).

Framework must integrate with existing disciplines: business continuity, IT service continuity, crisis management, third-party risk, and cyber incident response.

Reporting design: define metrics (tolerance breaches, test coverage, open remediation age) and escalation triggers before incidents occur, not during them.

Annual framework review cycle should be triggered by material change: mergers, new critical systems, new outsourcing, or regulatory change.

Business impact analysis (BIA) ranks services by harm over time; outputs feed tolerance setting, recovery prioritization, and resource allocation.

Business continuity plans require defined roles, call trees, alternate sites or remote-working capacity, manual workarounds, and communication templates for customers and regulators.

Cyber resilience extends beyond prevention to detect, contain, eradicate, recover, and learn; assume compromise rather than assuming perimeter defense holds.

Incident response lifecycle: preparation, detection and analysis, containment/eradication/recovery, post-incident review with tracked corrective actions.

Recovery capability must be proven for both data (backup integrity, restore testing, immutable/offline copies) and technology (failover, degraded-mode operation).

Ransomware scenario planning must address operating without primary systems for extended periods, not just rapid restoration from backup.

Identity, access management, and privileged access controls are resilience controls: compromised credentials are a leading cause of severe disruption.

Digital resilience depends on third-party cloud and network providers; internal recovery plans must state assumptions about provider outage duration and failover geography.

Crisis communication requires pre-approved holding statements, single-source-of-truth status channels, and defined regulatory notification timelines (e.g., incident reporting windows).

Third-party lifecycle: due diligence, contract negotiation, onboarding, ongoing monitoring, exit planning, and offboarding.

Contracts must specify service levels, incident notification timeframes, audit and access rights, subcontracting controls, data return/deletion, and termination assistance.

Concentration risk arises when multiple services depend on the same provider, region, or technology stack; assess it at portfolio level, not contract by contract.

Exit plans must be documented, tested where feasible, and state the maximum time to migrate or substitute - this must fit within the service's impact tolerance.

Fourth-party (sub-outsourcer) visibility is required for critical providers; flow-down obligations must be contractually mandated.

Culture indicators: psychological safety to report near misses, blameless post-incident reviews, executive participation in exercises, and incentives tied to resilience outcomes.

Speak-up mechanisms and escalation paths must allow staff to raise resilience concerns without fear; suppression of bad news is a leading cultural failure mode.

Training and awareness should be role-based: executives for decision-making under stress, technical staff for recovery procedures, all staff for incident reporting.

Test types: desktop walkthroughs, tabletop/simulation exercises, component failover tests, end-to-end service tests, and live/controlled disruption tests.

Scenario selection must cover severe-but-plausible events, including extreme scenarios that exceed historical experience and combined (cyber plus third-party) events.

Test design rule: every important business service should be tested against its impact tolerance at least annually, with critical services tested more frequently.

Testing must exercise the full chain: people, processes, technology, data, premises, and third-party dependencies - component tests alone do not prove service resilience.

Findings require a remediation log with owners, deadlines, severity ratings, and executive visibility; unresolved issues are reported as residual tolerance risk.

Lessons-learned process: capture observations, root causes, and thematic trends across tests and real incidents; feed results back into tolerance and dependency reviews.

Metrics for improvement: percentage of services tested against tolerance, mean time to remediate findings, number of tolerance breaches, and test-derived plan changes.

Independent assurance (internal audit or external review) validates that the testing programme is credible and that reported resilience reflects reality.

Operational resilience is the ability of an organization to prevent, adapt to, respond to, recover from, and learn from operational disruptions; it is outcome-based, not asset-based.

Four core outcomes (UK PRA/FCA model): identify important business services, set impact tolerances, map critical dependencies, and test severe-but-plausible scenarios.

Impact tolerance is the maximum tolerable level of disruption to an important business service, expressed as a time limit (e.g., hours of outage) plus qualitative harm criteria.

Important business services are those whose failure causes intolerable harm to consumers, market integrity, or firm soundness - determined by harm, not by revenue size.

Resilience differs from risk management: risk focuses on likelihood-weighted loss events; resilience assumes disruption occurs and focuses on continuity of outcomes.

Severity dimensions for scenario design: duration, scale (number of customers/transactions affected), and scope (single service vs. cross-firm or systemic).

Recovery time objective (RTO) is a technical restoration target; impact tolerance is a business-level harm threshold - RTOs must be set inside tolerances, never outside them.

Maturity progression typically runs: awareness, ad hoc response, defined processes, integrated management, adaptive/optimized continuous improvement.

Framework components: governance and accountability, policy and standards, service and dependency inventory, impact tolerances, scenario library, testing programme, incident management, and assurance/reporting.

Assign named accountable owners for each important business service; accountability sits with business line executives, not only with risk or technology functions.

Governance body structure: board-level oversight sets risk appetite for disruption; an executive resilience committee owns delivery; service owners execute.

Policy hierarchy: board-approved policy → standards defining minimum requirements → procedures and playbooks → evidence and records.

Risk appetite for resilience must be quantified in tolerance terms (e.g., 'no important business service exceeds its impact tolerance more than once per year').

Dependency mapping must extend beyond first parties to shared infrastructure, people, premises, utilities, and fourth parties (sub-outsourcers).

Framework must integrate with existing disciplines: business continuity, IT service continuity, crisis management, third-party risk, and cyber incident response.

Reporting design: define metrics (tolerance breaches, test coverage, open remediation age) and escalation triggers before incidents occur, not during them.

Annual framework review cycle should be triggered by material change: mergers, new critical systems, new outsourcing, or regulatory change.

Business impact analysis (BIA) ranks services by harm over time; outputs feed tolerance setting, recovery prioritization, and resource allocation.

Business continuity plans require defined roles, call trees, alternate sites or remote-working capacity, manual workarounds, and communication templates for customers and regulators.

Cyber resilience extends beyond prevention to detect, contain, eradicate, recover, and learn; assume compromise rather than assuming perimeter defense holds.

Incident response lifecycle: preparation, detection and analysis, containment/eradication/recovery, post-incident review with tracked corrective actions.

Recovery capability must be proven for both data (backup integrity, restore testing, immutable/offline copies) and technology (failover, degraded-mode operation).

Ransomware scenario planning must address operating without primary systems for extended periods, not just rapid restoration from backup.

Identity, access management, and privileged access controls are resilience controls: compromised credentials are a leading cause of severe disruption.

Digital resilience depends on third-party cloud and network providers; internal recovery plans must state assumptions about provider outage duration and failover geography.

Crisis communication requires pre-approved holding statements, single-source-of-truth status channels, and defined regulatory notification timelines (e.g., incident reporting windows).

Third-party lifecycle: due diligence, contract negotiation, onboarding, ongoing monitoring, exit planning, and offboarding.

Contracts must specify service levels, incident notification timeframes, audit and access rights, subcontracting controls, data return/deletion, and termination assistance.

Concentration risk arises when multiple services depend on the same provider, region, or technology stack; assess it at portfolio level, not contract by contract.

Exit plans must be documented, tested where feasible, and state the maximum time to migrate or substitute - this must fit within the service's impact tolerance.

Fourth-party (sub-outsourcer) visibility is required for critical providers; flow-down obligations must be contractually mandated.

Culture indicators: psychological safety to report near misses, blameless post-incident reviews, executive participation in exercises, and incentives tied to resilience outcomes.

Speak-up mechanisms and escalation paths must allow staff to raise resilience concerns without fear; suppression of bad news is a leading cultural failure mode.

Training and awareness should be role-based: executives for decision-making under stress, technical staff for recovery procedures, all staff for incident reporting.

Test types: desktop walkthroughs, tabletop/simulation exercises, component failover tests, end-to-end service tests, and live/controlled disruption tests.

Scenario selection must cover severe-but-plausible events, including extreme scenarios that exceed historical experience and combined (cyber plus third-party) events.

Test design rule: every important business service should be tested against its impact tolerance at least annually, with critical services tested more frequently.

Testing must exercise the full chain: people, processes, technology, data, premises, and third-party dependencies - component tests alone do not prove service resilience.

Findings require a remediation log with owners, deadlines, severity ratings, and executive visibility; unresolved issues are reported as residual tolerance risk.

Lessons-learned process: capture observations, root causes, and thematic trends across tests and real incidents; feed results back into tolerance and dependency reviews.

Metrics for improvement: percentage of services tested against tolerance, mean time to remediate findings, number of tolerance breaches, and test-derived plan changes.

Independent assurance (internal audit or external review) validates that the testing programme is credible and that reported resilience reflects reality.

Operational resilience is the ability of an organization to prevent, adapt to, respond to, recover from, and learn from operational disruptions; it is outcome-based, not asset-based.

Four core outcomes (UK PRA/FCA model): identify important business services, set impact tolerances, map critical dependencies, and test severe-but-plausible scenarios.

Impact tolerance is the maximum tolerable level of disruption to an important business service, expressed as a time limit (e.g., hours of outage) plus qualitative harm criteria.

Important business services are those whose failure causes intolerable harm to consumers, market integrity, or firm soundness - determined by harm, not by revenue size.

Resilience differs from risk management: risk focuses on likelihood-weighted loss events; resilience assumes disruption occurs and focuses on continuity of outcomes.

Severity dimensions for scenario design: duration, scale (number of customers/transactions affected), and scope (single service vs. cross-firm or systemic).

Recovery time objective (RTO) is a technical restoration target; impact tolerance is a business-level harm threshold - RTOs must be set inside tolerances, never outside them.

Maturity progression typically runs: awareness, ad hoc response, defined processes, integrated management, adaptive/optimized continuous improvement.

Framework components: governance and accountability, policy and standards, service and dependency inventory, impact tolerances, scenario library, testing programme, incident management, and assurance/reporting.

Assign named accountable owners for each important business service; accountability sits with business line executives, not only with risk or technology functions.

Governance body structure: board-level oversight sets risk appetite for disruption; an executive resilience committee owns delivery; service owners execute.

Policy hierarchy: board-approved policy → standards defining minimum requirements → procedures and playbooks → evidence and records.

Risk appetite for resilience must be quantified in tolerance terms (e.g., 'no important business service exceeds its impact tolerance more than once per year').

Dependency mapping must extend beyond first parties to shared infrastructure, people, premises, utilities, and fourth parties (sub-outsourcers).

Framework must integrate with existing disciplines: business continuity, IT service continuity, crisis management, third-party risk, and cyber incident response.

Reporting design: define metrics (tolerance breaches, test coverage, open remediation age) and escalation triggers before incidents occur, not during them.

Annual framework review cycle should be triggered by material change: mergers, new critical systems, new outsourcing, or regulatory change.

Business impact analysis (BIA) ranks services by harm over time; outputs feed tolerance setting, recovery prioritization, and resource allocation.

Business continuity plans require defined roles, call trees, alternate sites or remote-working capacity, manual workarounds, and communication templates for customers and regulators.

Cyber resilience extends beyond prevention to detect, contain, eradicate, recover, and learn; assume compromise rather than assuming perimeter defense holds.

Incident response lifecycle: preparation, detection and analysis, containment/eradication/recovery, post-incident review with tracked corrective actions.

Recovery capability must be proven for both data (backup integrity, restore testing, immutable/offline copies) and technology (failover, degraded-mode operation).

Ransomware scenario planning must address operating without primary systems for extended periods, not just rapid restoration from backup.

Identity, access management, and privileged access controls are resilience controls: compromised credentials are a leading cause of severe disruption.

Digital resilience depends on third-party cloud and network providers; internal recovery plans must state assumptions about provider outage duration and failover geography.

Crisis communication requires pre-approved holding statements, single-source-of-truth status channels, and defined regulatory notification timelines (e.g., incident reporting windows).

Third-party lifecycle: due diligence, contract negotiation, onboarding, ongoing monitoring, exit planning, and offboarding.

Contracts must specify service levels, incident notification timeframes, audit and access rights, subcontracting controls, data return/deletion, and termination assistance.

Concentration risk arises when multiple services depend on the same provider, region, or technology stack; assess it at portfolio level, not contract by contract.

Exit plans must be documented, tested where feasible, and state the maximum time to migrate or substitute - this must fit within the service's impact tolerance.

Fourth-party (sub-outsourcer) visibility is required for critical providers; flow-down obligations must be contractually mandated.

Culture indicators: psychological safety to report near misses, blameless post-incident reviews, executive participation in exercises, and incentives tied to resilience outcomes.

Speak-up mechanisms and escalation paths must allow staff to raise resilience concerns without fear; suppression of bad news is a leading cultural failure mode.

Training and awareness should be role-based: executives for decision-making under stress, technical staff for recovery procedures, all staff for incident reporting.

Test types: desktop walkthroughs, tabletop/simulation exercises, component failover tests, end-to-end service tests, and live/controlled disruption tests.

Scenario selection must cover severe-but-plausible events, including extreme scenarios that exceed historical experience and combined (cyber plus third-party) events.

Test design rule: every important business service should be tested against its impact tolerance at least annually, with critical services tested more frequently.

Testing must exercise the full chain: people, processes, technology, data, premises, and third-party dependencies - component tests alone do not prove service resilience.

Findings require a remediation log with owners, deadlines, severity ratings, and executive visibility; unresolved issues are reported as residual tolerance risk.

Lessons-learned process: capture observations, root causes, and thematic trends across tests and real incidents; feed results back into tolerance and dependency reviews.

Metrics for improvement: percentage of services tested against tolerance, mean time to remediate findings, number of tolerance breaches, and test-derived plan changes.

Independent assurance (internal audit or external review) validates that the testing programme is credible and that reported resilience reflects reality.