GRA · Financial Cyber and Operational Resilience
Spatial financeWhere capital meets hazard, exposure and transition
Incident and crisis response
When an incident strikes, firms must detect it, decide its severity, contain it, report it to authorities, inform customers and recover. Major incidents need crisis management that coordinates technical, business and communication decisions under pressure. This page sets out how incident and crisis response works and fails, the reporting regimes involved, and who decides.
Incident and crisis response on the record.
Incident and crisis response: how the risk develops.
Response roles, escalation and recovery. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Detection delays decisions
Late detection lets attackers spread and corrupt more. Mean time to detect and contain drives the size of the impact.
Reporting clocks start
Regulatory regimes require initial notifications within hours of classification. Classification criteria decide which incidents trigger them and how fast.
Crisis decisions are cross-functional
Technical teams, business owners, legal, communications and executives must decide together, often on incomplete information.
Sector coordination limits spread
When incidents affect several firms or a shared provider, authorities and sector bodies coordinate information and response.
Settlement dependencies, and what fails with a node.
How a failure at one financial centre can spread through settlement links. Design links, not real dependencies.
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Major ICT incidents reported | count by classification | annual | Authority statistics | Published statistics |
| Time from detection to initial notification | hours | per incident | Firm and authority records | REPORTED |
| Time to contain incidents | hours or days | per incident | Firm records | REPORTED |
| Customers affected by incidents | count | per incident | Incident reports | REPORTED |
| Crisis management exercises held | count | annual | Firm records | DECLARED |
| Sector coordination activations | count | annual | Authority and sector body records | REPORTED |
Loss exceedance, average annual loss and probable maximum loss.
The loss a portfolio in the footprint can expect per year and at the 1 in 100 and 1 in 250 levels that insurers and lenders price, from the same three blocks every catastrophe model uses. Teaching model with stated illustrative values, not a prediction. The map on this page shows The Low Countries; the model itself is not tied to a place.
Controls
- Typical annual hazard intensity (location)
- 1.00 intensity index
- Spread of extremes (scale)
- 0.80 intensity index
- Intensity at which half the value is lost
- 4.00 intensity index
- Dispersion of vulnerability
- 0.55
- Share of value in the hazard footprint
- 40%
- Protection standard (return period)
- 50 years
Readouts
- Average annual loss
- 0.51% of value
- Loss at 1 in 100 years
- 24.5% of value
- Loss at 1 in 250 years
- 28.4% of value
- Intensity at 1 in 100 years
- 4.68 intensity index
Numbers, methods and sources
| Return period (years) | Intensity (intensity index) | Loss (% of value) |
|---|---|---|
| 1 | 0.09 | 0.00 |
| 2 | 1.27 | 0.00 |
| 4 | 1.91 | 0.00 |
| 7 | 2.47 | 0.00 |
| 13 | 3.00 | 0.00 |
| 24 | 3.51 | 0.00 |
| 44 | 4.02 | 0.00 |
| 82 | 4.53 | 23.55 |
| 154 | 5.03 | 26.44 |
| 287 | 5.53 | 28.87 |
| 536 | 6.03 | 30.88 |
| 1,000 | 6.53 | 32.53 |
Methods
- Gumbel extreme-value hazard Gumbel (1958), Statistics of Extremes, Columbia University Press
- Lognormal fragility (vulnerability) FEMA (2003), HAZUS-MH Technical Manual
- Exceedance-probability curve and average annual loss Grossi and Kunreuther (2005), Catastrophe Modeling, Springer
- Levee effect Di Baldassarre and others (2013), Socio-hydrology, HESS 17
- Uncertainty fan (parameter Monte Carlo) Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
- One-at-a-time sensitivity (tornado) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
Data
The model runs on the teaching values set by the controls. To calibrate it for a place, read it against these admitted layers and series, which this page's map can draw:
- Rivers Natural Earth
- Urban extents Natural Earth
- Cities Natural Earth
- Earthquakes M4.5+, past week (USGS) U.S. Geological Survey · register usgs.earthquake.summary-feeds
- Rain rate, last half hour (IMERG) NASA GPM IMERG Early · register nasa.gibs.context-live-layers
- River discharge forecast, 30 days with range (GloFAS via Open-Meteo) Open-Meteo.com (CC BY 4.0), Copernicus GloFAS · register open-meteo.public-pages
- Built-up and settlement extent, 2010 (HBASE, Landsat) CIESIN/Columbia, NASA SEDAC HBASE · register sedac.context-urban-layers
Across the six pillars, led by Nexus Consortium
- Experiments Labs
- Built in Financial Cyber and Operational Resilience in Foundry
- Tested at Financial Cyber and Operational Resilience in Universe
- Codified in Digital, Cyber and AI in Standards
- Published in Financial Cyber and Operational Resilience in Reports
- Taught in Faculty of Technology and Digital Systems in Academy
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| FSB Format for Incident Reporting Exchange (FIRE) | Common information items for incident reports | Free, FSB terms |
| DORA incident classification and reporting standards | EU incident criteria and timelines | Free, EU reuse terms |
| European Supervisory Authorities incident reports | Aggregated incident statistics | Free, EU reuse terms |
| CMORG and similar sector collaboration publications | Sector coordination arrangements | Free to read, terms to check |
| Post-incident public reports by firms and authorities | Lessons from major incidents | Public records, terms per publisher |
Trace a shock in incident and crisis response to the balance sheet.
Assembled from the Nexus Standards area profile Cyber resilience and digital operational resilience: the shocks it names, the systems and sectors that carry the loss, the controls that dampen it and the data that observe it. Pick an initiating shock and step through the cascade to see which exposures it reaches and where losses could concentrate. The Map view places the run on an example geography with open data. Every weight is a stated assumption. An exercise, not a forecast, a valuation, a rating or investment advice. To model a place of your own choosing, open the full System Builder.
Hazards
- Dam failure
- River flood (set off downstream)
- Flash flood (set off downstream)
- Mass displacement (set off downstream)
- Widespread power outage (set off downstream)
- Water supply shortfall (set off downstream)
Systems and couplings
Controls
NS-0Constitution and principlesNS-9Contextual UNIs (deployments, instances, programme instances)NS-10Policies and clauses (machine-readable obligations: definition, binding, evaluation and enforcement)NS-11Verification and monitoring (evidence, attestations, zero-trust conformance observation)NS-12Software, model and AI/ML artefacts (supply chain, model cards, dataset sheets)NRS-X6Cyber and digital security riskNRS-H54Hazard family: Signal and platform disruption (NHS-1 cyber.platform)NRS-P10Third-party, outsourcing and concentration riskNRS-H107Hazard family: Digital infrastructure concentration and monoculture (NHS-1 tech.digital-concentration)NRS-K31Domain pack profile: Cyber national resilience (DOMAIN-031)NRS-S7System profile: NXS-EOP (Earth observation and digital twins)
Observation
- Known Exploited Vulnerabilities catalogue (listed for reference)
- National Vulnerability Database (CVE enrichment API) (listed for reference)
- OSV open source vulnerability database (listed for reference)
- Proportion of population covered by a mobile network, by technology
Example geography
- North America: 243 hexagonal cells
- Night lights tonight, outages (VIIRS Day/Night Band), NASA GIBS
- Surface water through cloud, 30 m (OPERA DSWx-S1 radar), NASA GIBS
- Rain rate, last half hour (IMERG), NASA GIBS
- Surface soil moisture (SMAP), NASA GIBS
Who decides, and what the evidence serves.
Financial Cyber and Operational Resilience prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Incident commanders and executives | How to contain, communicate and recover | Playbooks and real-time information |
| Supervisors | What follow-up an incident requires | Incident reports and firm remediation |
| Sector coordination bodies | When to activate collective response | Incident scope and shared dependencies |
| Boards | Whether incident readiness is adequate | Exercise results and incident history |
Outputs this topic produces
- Guide to incident classification and reporting regimes
- Brief on cross-functional crisis decisions
- Method note on detection and containment metrics
- Questions for boards on crisis readiness
What incident and crisis response means for exposure, loss and capital.
The exposure, loss, scenario and capital views a risk officer, supervisor or ministry of finance would ask for, with the frameworks they report against. Structures follow supervisory and actuarial practice. Values are illustrative: never prices, ratings or advice.
Transmission channels
How a shock in incident and crisis response reaches credit, market, underwriting, liquidity and operational risk, and feeds back.
What response planning asks.
- Who has authority to make which decisions during an incident, including shutting down systems or paying for recovery?
- How quickly are incidents detected and escalated to people who can act?
- How are customers, supervisors, counterparties and the public informed, and by whom?
- How is coordination handled when an incident affects many firms at once?
- How does the firm decide when an incident is over and normal operations can safely resume?
What makes response succeed or fail.
Post-incident reviews across the industry repeatedly find the same patterns. Technical recovery is rarely the only bottleneck; decisions, coordination and communication often take longer than restoring systems.
Time to know
Late detection lets attackers or faults spread before response begins.
Clear authority
Unclear roles slow critical decisions, such as isolating systems or invoking recovery plans.
Trust under stress
Silence or inaccurate statements can damage confidence more than the incident itself.
How response is prepared and studied.
- 01
Incident response plans and playbooks
Documented roles and procedures. Limits: plans meet reality imperfectly.
- 02
Exercises
Tabletop and technical exercises, including sector-wide exercises. Limits: participants know it is an exercise.
- 03
Post-incident review
Structured learning from incidents, informed by resilience engineering. Limits: depends on openness.
- 04
Recovery engineering
Designing systems for recovery, including isolated backups, using safety-critical systems engineering. Limits: recovery from widespread compromise remains hard.
How it is studied, and what the methods cannot say.
- 01Cybersecurity and cryptographyIdentity and privileged access · Detection and response capability · Threat-led testingApplied here
- 02Reliability and resilience engineeringService and dependency mapping · Recovery strategy comparison · Learning reviewsApplied here
- 03Software and safety-critical systems engineeringChange control for core systems · Integrity by design · Fault toleranceApplied here
Questions and answers.
What is FIRE?
Why are reporting deadlines short?
What is crisis management?
Will the platform help during an incident?
Should firms pay ransoms?
Why do sector-wide exercises matter?
What makes a good post-incident review?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GRASend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGlobal Risks AllianceSee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.