GRA · Financial Cyber and Operational Resilience
Spatial financeWhere capital meets hazard, exposure and transition
Resilience and finance readiness
Operational resilience readiness asks whether a financial institution or programme knows its important business services, the people, sites, technology and providers behind them, and how long each could be disrupted before harm becomes intolerable. Financial Cyber and Operational Resilience, a the Global Risks Alliance (GRA) platform, prepares mapping evidence and frames the questions; supervisors and firms judge.
The workspace for resilience and finance readiness.
Programme board
Bank B services · Resilience and finance · Cycle 1 of 4 · Example interface, not a record
- Workstreams active7Active
- Milestones due this quarter4Watch
- Decisions pending with owners2Watch
- Open risks6
Workstreams
by stage
Gates
- Requestowner named
- Scoping noteboundary
- Qualifiedinputs
- BuildFoundry
- Testcontrolled
- Publishwith limits
- Decisionauthority
Financial Cyber and Operational Resilience · Programme board. Programme board: example names and illustrative values, not a record.
Readiness is not approval.
A readiness file describes a programme's evidence, risks and governance so that an institution can carry out its own review. GRA does not approve, rate, underwrite, lend or invest, and it recommends no counterparty.
The five pillars of the EU regime, applied since January 2025.
| Pillar | What it requires |
|---|---|
| ICT risk management | A documented framework covering identification, protection, detection, response and recovery |
| Incident reporting | Classification and reporting of major ICT-related incidents to the competent authority |
| Resilience testing | Testing programme, with threat-led penetration testing for designated entities |
| Third-party risk | Register of ICT contracts, exit strategies, oversight of critical ICT third-party providers |
| Information sharing | Voluntary arrangements for cyber threat intelligence |
How the process runs.
Process explorer · Process
Resilience and finance readiness: Public service over DPI
7 steps·4 stages·1 gate
Process
Resilience and finance readiness: Public service over DPI
An illustrative service request; the Universal DPI Safeguards Framework 2.0 has 18 principles and five life cycle stages but prescribes no sequence.
01 Person
- 01IdentityDatasetThe person proves who they are to the service. The framework asks that people have a choice of digital and non-digital channels.
- 02ConsentGateThe person decides on sharing their data for a stated purpose. The framework asks that everyone can control their data and choose.
02 Agency
- 03Data exchangeModelThe agency obtains only the data it needs through agreed interfaces. The framework names data minimisation as a privacy-by-design principle.
- 04EligibilityStep · Service ownerThe agency applies its eligibility rules. Whether a person reviews the result is for the agency to set.
03 Rails
- 05PaymentStepWhere the service pays out, it uses a payment rail, for example an instant-payment system. The framework does not name payment systems.
04 Accountability
- 06Grievance redressStep · Service ownerThe framework asks for complaint, redress and appeal routes without reprisal, accessible to all during service delivery.
- 07Independent assessment and auditDecision · Service ownerThe framework asks for independent, transparent and continuous assessments or audits that review evidence and act on heightened risks.
Neutral outline of a published external standard or method, from its issuing body. Not a record of operation. Nexus does not perform, certify or approve any step shown. A gate or decision belongs to the party the source names. The sequence is a sketch, not a prescribed process. Each step is tied to the principle that bears on it, where one exists.
The same ideas elsewhere.
The BCBS operational resilience principles, NIST Cybersecurity Framework 2.0 and national supervisory rules share the structure: know your important services, set tolerances, test against severe scenarios and manage third parties. Topic depth at operational resilience testing; cyber evidence at the Global Centre for Risk and Innovation (GCRI) cyber risk management.
Who sees a readiness file.
A file is released only at the programme owner's written direction, to a party the owner chooses, with no fee tied to any transaction.
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Pages in Resilience and finance readiness.
Questions and answers.
Does a readiness file mean finance is available?
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.