Skip to content

GRA · Financial Cyber and Operational Resilience

Spatial financeWhere capital meets hazard, exposure and transition

Software and safety-critical systems engineering for financial cyber and operational resilience

Safety-critical software engineering builds systems whose failure would cause serious harm, using rigorous design, verification and change control. On this platform its practices inform how financial firms protect the integrity of core records and change critical systems safely.

Make an enquiry Back to STEM foundation of Financial Cyber and Operational Resilience
01Register

Software and safety-critical systems engineering for financial cyber and operational resilience on the record.

Method recordSTEM method
  1. MethodSoftware and safety-critical systems engineering
  3. Applied inFinancial Cyber and Operational Resilience
  6. Canonical pageSTEM Commons
02Application

What software and safety-critical systems engineering does here.

Software and safety-critical systems engineering develops software whose failure could cause harm, loss of life or major disruption. It applies rigorous processes to control-system, medical, aviation and infrastructure software. In cyber and digital resilience, financial stability and critical infrastructure, safety-critical software practice limits the chance that a software fault cascades through physical infrastructure. It informs assurance requirements for automated control in interconnected systems. The canonical description is on the STEM Commons.

Change control for core systems

Staged deployment, automated testing and rollback plans are examined as controls against outages caused by faulty changes to critical systems.

Integrity by design

Design patterns such as immutable logs, checksums and independent reconciliation are reviewed for how they detect and limit data corruption.

Fault tolerance

Redundancy, graceful degradation and safe failure modes are compared for how they keep important services partly running during faults.

03Geography

Connected activity in the Low Countries.

Night lights and population density over the Low Countries, from NASA GIBS. Each layer carries its own date.

The interactive map needs JavaScript; the layer list and sources are below.

Layers 2

Connected activity, for this page

Latest available

NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth

Loading the latest NASA imagery.

Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.

Connected activity, framed on the Low Countries.Satellite and model products as NASA publishes them, each with its own date. They are indicators, not assessments of any place.

Data: NASA GIBS · ASTER GDEM · Blue Marble · © OpenStreetMap contributors · Natural Earth · NASA EONET · NASA/NOAA VIIRS · CIESIN/Columbia, NASA SEDAC HBASE · U.S. Geological SurveySources and licences

  • We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
  • We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
  • VIIRS Black Marble night-time lights, NASA Goddard Space Flight Center; distributed by the NASA Level-1 and Atmosphere Archive and Distribution System (LAADS DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
  • Center for International Earth Science Information Network (CIESIN), Columbia University. 2018. Gridded Population of the World, Version 4 (GPWv4): Population Density, Revision 11. NASA Socioeconomic Data and Applications Center (SEDAC). Licensed under CC BY 4.0. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). doi:10.7927/H49C6VHW. CC BY 4.0
  • VIIRS near-real-time products (flood, land surface temperature, snow cover, corrected reflectance), NASA LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
  • NASA Fire Information for Resource Management System (FIRMS), VIIRS 375 m active fire product, NASA LANCE; vector tiles via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
  • ASTER GDEM is a product of METI and NASA (ASTER Global Digital Elevation Model V003, NASA LP DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). Cite as: NASA/METI/AIST/Japan Spacesystems and U.S./Japan ASTER Science Team (2019). ASTER Global Digital Elevation Model V003. doi:10.5067/ASTER/ASTGTM.003. NASA open data
  • Made with Natural Earth. Free vector and raster map data @ naturalearthdata.com. Public domain
  • © OpenStreetMap contributors (ODbL), via NASA GIBS (coastlines, boundaries, roads and place names). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). ODbL
  • Blue Marble, NASA Earth Observatory; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
  • Context on the globe and flat map: coastlines, boundaries, roads and place names from NASA GIBS reference layers (OpenStreetMap data, ODbL, © OpenStreetMap contributors); Blue Marble imagery as an optional base; 3D terrain and the elevation read-out from the ASTER GDEM elevation colour index (5 m to 200 m classes, exaggerated for legibility). Boundaries are drawn as published and imply no position on any territory.
  • Live events: NASA Earth Observatory Natural Event Tracker (EONET); events are indicative and keep their original source links.
  • Observed (EO): NASA/NOAA VIIRS (Suomi NPP). We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS).
  • Context: CIESIN/Columbia, NASA SEDAC HBASE. Center for International Earth Science Information Network (CIESIN), Columbia University, and NASA Socioeconomic Data and Applications Center (SEDAC): Global Human Built-up And Settlement Extent (HBASE) 2010; Seto, Guneralp and Hutyra 2012, Global Grid of Probabilities of Urban Expansion to 2030; Global Urban Heat Island (UHI) Data Set, 2013.
  • Live: U.S. Geological Survey Events are indicative, not authority warnings.
  • NASA GIBS: We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS).
  • Optional layers (4 sources in the layer list: live, forecast, observed and context) print their provider credit on the map and here when switched on; forecasts are model output and derived indices are estimates.

Layers and dates

  • Night-time lights, daily: VIIRS Black Marble (VNP46A2), NASA LAADS DAAC · 12 Oct 2026
  • Population density, 2020: Population: CIESIN, Columbia University, Gridded Population of the World v4.11 (2018), NASA SEDAC, CC BY 4.0 · static
  • Flood water, 3-day composite: VIIRS Global Flood Product, NASA LANCE · 14 Oct 2026
  • Land surface temperature, day, 8-day composite: VIIRS NOAA-20 Level 3, 8-day, NASA LANCE · 14 Sep 2026
  • Active fires and thermal anomalies: VIIRS NOAA-20 375 m (FIRMS), NASA LANCE FIRMS · 13 Oct 2026
  • True colour: VIIRS NOAA-20 corrected reflectance, NASA LANCE · 13 Oct 2026

04Data

What the method consumes.

Datasets and records used by software and safety-critical systems engineering on this platform, with the role each plays and the label its values carry. Sources are listed in the source register.

DataRoleLabel
Change and release recordsChange riskDECLARED
Incident root causesFailure modesREPORTED
Architecture documentationDesign controlsDECLARED
05Exposure model

How a local shock becomes a system outage.

How much of the networks an operator, insurer or lender depends on stays working after a local shock, and how much the coupling between them amplifies it. Teaching model with stated illustrative values, not a prediction. The map on this page shows The Low Countries; the model itself is not tied to a place.

Controls

Assets per layer
18
Hazard footprint
8% of area
Assets that depend on another layer
60%
Spare capacity (tolerance)
30%

Readouts

Assets hit by the hazard
6%
Assets still working
15%
Amplification of the initial damage
15.3 times
Steps to settle
5
Numbers, methods and sources
StepData centres working (%)Networks working (%)Power working (%)
08910094
16110072
2289472
3282256
4111144
5111122

Methods

  1. Interdependent networks Buldyrev and others (2010), Catastrophic cascade of failures in interdependent networks, Nature 464
  2. Overload cascades Motter and Lai (2002), Physical Review E 66
  3. Betweenness load Brandes (2001), Journal of Mathematical Sociology 25
  4. Multilayer networks Kivela and others (2014), Journal of Complex Networks 2
  5. Infrastructure interdependencies Rinaldi, Peerenboom and Kelly (2001), IEEE Control Systems 21(6)
  6. Uncertainty fan (parameter Monte Carlo) Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
  7. One-at-a-time sensitivity (tornado) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley

Data

The model runs on the teaching values set by the controls. To calibrate it for a place, read it against these admitted layers and series, which this page's map can draw:

  • Major roads Natural Earth
  • Railways Natural Earth
  • Seaports Natural Earth
  • Airports Natural Earth
  • Urban extents Natural Earth
  • Night lights tonight, outages (VIIRS Day/Night Band) NASA/NOAA VIIRS (Suomi NPP) · register nasa.gibs.context-live-layers
  • Natural events (NASA EONET) NASA EONET · register nasa.eonet.events
How a local shock becomes a system outage. Illustrative teaching model: it runs on the values set by the controls, not on measured data. Methods: Interdependent networks (Buldyrev and others (2010), Catastrophic cascade of failures in interdependent networks, Nature 464); Overload cascades (Motter and Lai (2002), Physical Review E 66); Betweenness load (Brandes (2001), Journal of Mathematical Sociology 25).

Across the six pillars, led by Nexus Consortium

06Validation

How results are checked.

Software is verified through reviews, testing to defined coverage criteria and formal proofs where justified. Independent assessment examines the safety case.

CheckHow it is done
Change-related incident shareIncidents caused by changes are tracked and analysed
Verification evidenceCritical changes carry test and review evidence
Degradation testingPartial failure modes are tested, not only full failover

Complex software interacting with uncertain environments cannot be exhaustively tested. Updates and third-party components introduce new failure paths.

07Twin and cascade simulator

Trace a shock to the balance sheet.

Assembled from the Nexus Standards area profile Cyber resilience and digital operational resilience: the shocks it names, the systems and sectors that carry the loss, the controls that dampen it and the data that observe it. Pick an initiating shock and step through the cascade to see which exposures it reaches and where losses could concentrate. The Map view places the run on an example geography with open data. Every weight is a stated assumption. An exercise, not a forecast, a valuation, a rating or investment advice. To model a place of your own choosing, open the full System Builder.

Hazards

  • Dam failure
  • River flood (set off downstream)
  • Flash flood (set off downstream)
  • Mass displacement (set off downstream)
  • Widespread power outage (set off downstream)
  • Water supply shortfall (set off downstream)

Controls

  • NS-0 Constitution and principles
  • NS-9 Contextual UNIs (deployments, instances, programme instances)
  • NS-10 Policies and clauses (machine-readable obligations: definition, binding, evaluation and enforcement)
  • NS-11 Verification and monitoring (evidence, attestations, zero-trust conformance observation)
  • NS-12 Software, model and AI/ML artefacts (supply chain, model cards, dataset sheets)
  • NRS-X6 Cyber and digital security risk
  • NRS-H54 Hazard family: Signal and platform disruption (NHS-1 cyber.platform)
  • NRS-P10 Third-party, outsourcing and concentration risk
  • NRS-H107 Hazard family: Digital infrastructure concentration and monoculture (NHS-1 tech.digital-concentration)
  • NRS-K31 Domain pack profile: Cyber national resilience (DOMAIN-031)
  • NRS-S7 System profile: NXS-EOP (Earth observation and digital twins)

Observation

  • Known Exploited Vulnerabilities catalogue (listed for reference)
  • National Vulnerability Database (CVE enrichment API) (listed for reference)
  • OSV open source vulnerability database (listed for reference)
  • Proportion of population covered by a mobile network, by technology

Example geography

  • North America: 243 hexagonal cells
  • Night lights tonight, outages (VIIRS Day/Night Band), NASA GIBS
  • Surface water through cloud, 30 m (OPERA DSWx-S1 radar), NASA GIBS
  • Rain rate, last half hour (IMERG), NASA GIBS
  • Surface soil moisture (SMAP), NASA GIBS
08Connections

Topics that rely on this method.

09Exposure, loss and capital

What it means for exposure, loss and capital.

The exposure, loss, scenario and capital views a risk officer, supervisor or ministry of finance would ask for, with the frameworks they report against. Structures follow supervisory and actuarial practice. Values are illustrative: never prices, ratings or advice.

Transmission channels

How a shock in software and safety-critical systems engineering for financial cyber and operational resilience reaches credit, market, underwriting, liquidity and operational risk, and feeds back.

Channel structure after the Basel Committee's work on climate-related risk drivers and transmission channels; links shown are typical paths, not estimated exposures.
NGFS climate scenarios · Network for Greening the Financial SystemIFRS S2 Climate-related Disclosures · ISSBTCFD recommendations · Financial Stability Board TCFDPrinciples for the effective management of climate-related financial risks · Basel Committee on Banking Supervision
10Stewardship

Who maintains the method.

Cybersecurity and Digital Resilience stewards software and safety-critical systems engineering for the Consortium and reviews how it is applied across platforms.

Canonical page: Software and safety-critical systems engineering

11Connected

Where this page leads across the Consortium.

12Questions

Questions and answers.

What are the limits of software and safety-critical systems engineering in this field?
Complex software interacting with uncertain environments cannot be exhaustively tested. Updates and third-party components introduce new failure paths.
How are results checked?
Software is verified through reviews, testing to defined coverage criteria and formal proofs where justified. Independent assessment examines the safety case.
Are the values on this page real?
The data names, roles and checks are real descriptions of practice. The canvas shows a design of the method's use, not a run; no result is reported here.
Where else is this method applied?
The canonical method page lists every platform that applies it.
ReportsContribute

Contribute evidence from this page.

Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.

Global Risks AllianceFinancial Cyber and Operational ResilienceScenario and Stress-TestStrategic Systems

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

Financial Cyber and Operational Resilience

Bring an exposure or capital question to the Alliance.

Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.

Propose a readiness pilot See all contact routes
Legal

Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.