GRA · Financial Cyber and Operational Resilience
Spatial financeWhere capital meets hazard, exposure and transition
Reader questions and safeguards
Operational resilience starts from services, not systems. This checklist sets out the evidence a firm or programme assembles before a supervisor's or partner's review: important services, impact tolerances, mapped dependencies, third-party concentration and tested scenarios, without exposing security details.
The workspace for reader questions and safeguards.
Programme board
Bank B services · Reader questions · Cycle 2 of 4 · Example interface, not a record
- Workstreams active6Active
- Milestones due this quarter7Watch
- Decisions pending with owners3Watch
- Open risks11
Workstreams
by stage
Gates
- Requestowner named
- Scoping noteboundary
- Qualifiedinputs
- BuildFoundry
- Testcontrolled
- Publishwith limits
- Decisionauthority
Financial Cyber and Operational Resilience · Programme board. Programme board: example names and illustrative values, not a record.
Seven questions.
- 01
Purpose
What problem does the programme address, and for whom?
- 02
Evidence
What hazard, exposure and vulnerability evidence supports it, with what uncertainty?
- 03
Ownership
Who owns the programme and answers for it?
- 04
Governance
How are decisions taken, recorded and challenged?
- 05
Data
Which data is used, on what terms, and how is it protected?
- 06
Risks
What could go wrong, and how is it managed?
- 07
Monitoring
How will results be measured and reported?
Mapping an important business service.
- Service definition: the outcome customers or markets depend on.
- Impact tolerance: maximum tolerable disruption, in time or data loss.
- Resources: people, processes, technology, facilities and information supporting it.
- Third parties: including fourth parties the provider relies on.
- Locations: data centres and offices, with hazard exposure.
How the process runs.
Process explorer · Process
Reader questions and safeguards: Policy question to decision
9 steps·5 stages·1 gate
Process
Reader questions and safeguards: Policy question to decision
A priority becomes a question, evidence, a decision case and a limited publication; the competent authority decides, never the programme.
01 Question
- 01A priority becomes a questionStep · Universe; national counterpartsA priority becomes a researchable question with stated criteria. National counterparts own the agenda, data and decisions.
- 03Scientific and stakeholder challengeStep · the Global Centre for Risk and Innovation (GCRI); the Global Risks Forum (GRF)Scientific and affected-stakeholder challenge informs mission selection and methods.
02 Evidence and options
- 04Assemble the evidenceStep · GCRIMethods, labelled data and uncertainty are assembled. Every finding carries one of nine evidence labels.
- 06Decision case with optionsRecord · The decision owner named in the caseA decision case binds owner, alternatives, evidence and deadline. It needs sensitivity and robustness.
03 Review and publication
- 07G6 · Publication authorisedGate · The Global Risks ForumGRF authorises publication of results that have passed scientific and editorial review. It cannot publish personal data.
- 08Publish with method, uncertainty and limitsRecord · ReportsFindings are published with their method, uncertainty and limits. An edition is published after review, not to a calendar.
04 Outside the programme
- 02Competent authority decidesDecision · The competent authorityThe authority or institution decides under its own rules. The authority decides; the programme informs.
- 05Action and implementation stay with the ownersActor · The relevant government, operator or licensed institutionDecisions and execution stay with the relevant government, operator or licensed institution. The programme records one only if shared.
05 Learning
- 09Corrections and lessons feed the next agendaStep · UniverseCorrections and lessons feed the next annual agenda. The findings of one year set the mandate of the next.
The Nexus cycle · Decision rights · The programme yearDesigned programme process, not a record of operation. No cycle has run and every programme is at service level R0. A gate is a programme decision, never a public-authority approval, certification or deployment authorisation.
Threat-led testing.
Threat-led penetration testing under DORA follows the TIBER-EU approach for designated entities. Results are confidential; sector research studies methods and lessons, not results. Incident response evidence at GCRI incident response and recovery.
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Questions and answers.
Is the checklist a standard?
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.