How to establish an operational resilience framework

To build an operational resilience framework, you must shift your mindset from simply preventing failure to assuming that failures will happen. The goal is to ensure that even when things go wrong—whether it is a cyberattack, a supplier going bust, or a major IT outage—your business can continue to deliver its most vital services without causing intolerable harm to your customers or the UK financial system.

1. Identify your Important Business Services (IBS)

Start by looking at your business through the eyes of your customers. An 'Important Business Service' is a service you provide that, if disrupted, would cause significant harm to your clients or the stability of the market. Not every part of your business is an IBS. For example, while your internal staff holiday booking system is useful, your platform's ability to process a real-time payment is an IBS.

• Focus on outcomes: Ask yourself, "What is the specific thing the customer is trying to achieve?"
• Be specific: Instead of saying "Banking," say "The ability for a customer to withdraw cash from an ATM."

2. Set your impact tolerances

Once you know what your critical services are, you need to decide the point at which a disruption becomes 'intolerable.' This is your impact tolerance. It is a hard line in the sand that you must not cross. You should set these tolerances based on:

• Time: For example, "This service must not be down for more than 4 hours."
• Data integrity: For example, "We cannot afford to lose more than 15 minutes of transaction data."
• Customer volume: For example, "We cannot allow a disruption to affect more than 5% of our active users."

Note: In the UK, the Financial Conduct Authority (FCA) expects these tolerances to be clear and measurable.

3. Map your delivery chain

Mapping is the process of identifying everything needed to deliver an Important Business Service. You should create a clear visual or documented map that includes:

• People: Who are the key staff members required? Is there a single point of failure?
• Processes: What are the step-by-step actions taken to deliver the service?
• Technology: Which software, servers, and APIs are involved?
• Facilities: Which physical offices or data centres are needed?
• Information: What data is required for the service to function?
• Third parties: Which external vendors (like cloud providers) are critical?

4. Conduct scenario testing

The final step is to prove you can stay within your tolerances. You should run "severe but plausible" scenarios to see how your framework holds up. Don't just test things that are easy to fix; test things that would really hurt your business.

Tips for success

• Keep it simple: If you are a small startup, don't over-engineer. Focus on the 2 or 3 most critical services first.
• Engage the board: Operational resilience isn't just an IT task; it is a strategic business requirement that needs buy-in from leadership.
• Update regularly: As your business grows and your technology changes, your maps and tolerances will need to evolve. Set a reminder to review your framework at least once a year.