Focus
Services first
Begin with the services customers and markets rely on, then the systems behind them.
Operational resilience explained
Keep the services that matter within tolerance when something breaks.
What operational resilience is, how regulators in the UK, Australia and the EU define it, the five steps of a resilience framework, and how to tell whether yours is working.
What is operational resilience?
Operational resilience is an organisation's ability to keep its most important services running through disruption: to prevent what it can, stay within set limits when something breaks, recover, and learn from it.
Limits
Decided in advance
Agree how much disruption each service can take before the harm becomes intolerable.
Proof
Tested
Show it works against severe but plausible scenarios, before a real one arrives.
How do regulators define operational resilience?
Financial regulators were the first to write operational resilience down, and their wording is the clearest place to start.
- UK. The FCA's policy statement PS21/3 describes it as making sure firms and the sector "can prevent, adapt, respond to, recover and learn from operational disruptions".
- International banking. The Basel Committee's 2021 principles define it as "the ability of a bank to deliver critical operations through disruption".
- Australia. APRA's CPS 230 sets out to make sure a regulated entity "is resilient to operational risks and disruptions".
- EU. The Digital Operational Resilience Act (DORA) applies the same idea to technology: financial entities must be able to withstand, respond to and recover from ICT disruption.
The wording differs, and the idea is the same everywhere: know which services matter, decide how much disruption they can take, and prove you can stay inside that line. Outside financial services the same discipline often goes by organisational resilience or business resilience.
Why operational resilience is on the board agenda
FCA, 2025
40%+
of cyber incidents reported to the FCA involved a third party
NCSC, 2025
204
nationally significant cyber incidents in the UK in a year, up from 89
ASD, 2024-25
6 min
how often a cybercrime is reported in Australia, on average
Disruption increasingly arrives through suppliers and cyber attacks, and it is arriving more often.
How is operational resilience different from business continuity?
The three overlap, and most organisations need all of them. The difference is the question each one answers.
- Disaster recovery asks how you bring technology and data back after an outage. It is about systems.
- Business continuity asks how you keep operating, or recover, when something goes wrong. It is about plans and processes: see how business continuity planning works and what a business continuity plan must contain.
- Operational resilience asks whether your most important services can stay within a level of disruption you have decided you can tolerate, whatever the cause. It is about outcomes for customers and the market, and it covers the whole chain behind a service, suppliers included.
In practice, resilience sits over the other two. Recovery and continuity plans are how you stay within tolerance; the resilience work is deciding what within tolerance means, for each service, and proving you can meet it.
What does an operational resilience framework include?
Each regime and standard words it differently. A working framework comes down to five steps, repeated every year and after any material change.
Identify important business services
The services whose disruption would cause intolerable harm to customers, the market or the organisation itself.
In practice: Start from the customer outcome, then trace it back into the organisation. Important business services, explained.
Map what they depend on
For each service, the people, processes, technology, facilities, data and third parties behind it.
In practice: Include the suppliers your suppliers rely on, and the single points of failure they create.
Set impact tolerances
The most disruption each service can take before the harm becomes intolerable, usually as a maximum length of time.
In practice: Set each tolerance from the harm to customers and the market. Impact tolerance, explained.
Test severe but plausible scenarios
Check that each service can stay within tolerance when something serious goes wrong.
In practice: Cover supplier failure and cyber attack as well as system outages. Scenario testing, explained.
Learn, fix and report
Run a lessons learned exercise after every test and real incident, close the gaps, and record it for the board.
In practice: Keep the evidence current through the year, so the annual review confirms it.
Map your important business services in one place
Drova RunReady
Services, dependencies, impact tolerances and scenario tests in one workspace, ready for the board.
How do you measure operational resilience?
Measure against your tolerances rather than against uptime. A system can be available 99.9% of the year and still breach a tolerance in the one outage that matters. The measures that tell you whether resilience is working:
- Tested within tolerance. The share of important business services tested in the past year, and how many stayed within tolerance.
- Time to recover. How long each service took to recover in tests and real incidents, against its tolerance.
- Breaches. Incidents that took a service beyond its tolerance, and the cause of each.
- Open vulnerabilities. Gaps found by tests and incidents, and how long each has been open.
- Third-party coverage. How many of the suppliers behind each service are mapped and included in testing.
- Currency. When each service map, tolerance and plan was last reviewed.
These are the numbers a board and a regulator ask about, and they are the numbers a self-assessment is built from.
Who owns operational resilience?
The board. Regulators put accountability at the top: under the FCA's rules the governing body approves and regularly reviews the firm's self-assessment, and under CPS 230 the board is ultimately accountable for oversight of operational risk management, including business continuity and service providers.
Day to day, an executive owns the framework, often the chief risk officer, the chief operating officer or a head of operational resilience. Each important business service has a named owner. Operations and technology teams run the plans and the tests, the risk function challenges them, and internal audit checks the whole.
Where is operational resilience a regulatory requirement?
- UK. Banks, building societies, insurers, payment and e-money firms and other firms in scope meet the FCA's PS21/3 and SYSC 15A rules, and dual-regulated firms the PRA's SS1/21, in force since 31 March 2022. FCA operational resilience, explained.
- Australia. Banks, insurers and superannuation trustees meet APRA's CPS 230, in force since 1 July 2025. CPS 230, explained.
- EU. Financial entities meet DORA, which has applied since 17 January 2025. DORA overview.
- Any organisation. ISO 22301 is the international standard for business continuity management and a useful base wherever you operate. ISO 22301, explained.
How Drova RunReady supports operational resilience
RunReady is the operational resilience module of Drova's RunGood platform. It keeps your important business services, their dependencies, impact tolerances, scenario tests and remediation in one place, linked to your risks and controls, so the evidence is current when the board or a regulator asks. See how RunReady works.
Drova RunReady keeps services, dependencies, tolerances and tests connected, so the evidence is ready when the board asks.
Keep every important service within tolerance
Operational resilience, answered
What is operational resilience in simple terms?
Being able to keep your most important services running when something goes wrong, within a level of disruption you decided in advance you could live with.
What are the key principles of operational resilience?
Five steps, repeated every year: identify your important business services, map what they depend on, set impact tolerances, test severe but plausible scenarios, and learn, fix and report.
How is operational resilience different from business continuity?
Business continuity plans how you keep operating or recover when something goes wrong. Operational resilience decides how much disruption each important service can take, and proves you can stay within it, across the whole chain behind the service. Business continuity planning, explained.
How is operational resilience different from operational risk?
Operational risk management deals with the likelihood and impact of things going wrong. Operational resilience assumes some will, and asks whether important services can stay within tolerance when they do. The two share the same risks, controls and incident records. Operational risk, explained.
Is operational resilience the same as operational stability?
Stability is keeping operations steady in normal conditions. Resilience is about what happens when conditions change: absorbing a disruption, recovering within tolerance, and learning from it.
Who is responsible for operational resilience?
The board is accountable, and regulators in the UK and Australia say so in their rules. An executive owns the framework day to day, each important business service has an owner, and risk and internal audit challenge the work.
Does operational resilience only apply to regulated firms?
No. Regulation makes it mandatory for financial services in the UK, Australia and the EU, and any organisation that depends on technology, suppliers and customer trust gains from the same discipline. ISO 22301 gives a starting structure outside regulated sectors.
How often should operational resilience be reviewed?
At least once a year and after any material change to the business or the market. In the UK, the FCA's rules set that cycle for important business services and impact tolerances.
What is an operational resilience self-assessment?
The written record of how a firm meets the rules: its important business services, tolerances, mapping, testing, lessons learned and the action it is taking. FCA-regulated firms must keep one, approved by their governing body. What it must include.
What are some examples of operational resilience?
For example, a bank keeps payments within tolerance through a data centre failure, or an insurer keeps settling claims while its main supplier is down. Operational resilience examples sets out more by industry.
Operational resilience hub
Explore related topics
Important business services
Decide which services the rules apply to, and map them.
Impact tolerance
Set the limit a service must not cross.
Scenario testing
Test against severe but plausible disruption.
Business continuity planning
How the continuity discipline works.
Business continuity plan
The sections a plan must contain.
Business continuity software
How to choose it, and when operational resilience software fits better.
FCA operational resilience
What PS21/3 and SYSC 15A ask of UK firms.
APRA CPS 230
What CPS 230 asks of Australian entities.
DORA overview
The EU's Digital Operational Resilience Act.
ISO 22301
The international continuity standard.
Operational resilience examples
How different industries respond to disruption.
Financial services resilience
Sector-specific regulations.
Resilience strategy
Long-term resilience roadmaps.
Resilience, risk and compliance objectives
Keep resilience, risk and compliance objectives aligned.
