GRA · Financial Cyber and Operational Resilience
Spatial financeWhere capital meets hazard, exposure and transition
Digital supply chains
Financial firms depend on chains of software libraries, hardware, vendors and service providers, most of them several steps away. A vulnerability or compromise anywhere in the chain can reach the firm. This page sets out how digital supply chain risk develops, how it is managed and measured, and who decides.
Digital supply chains on the record.
Digital supply chains: how the risk develops.
Vendor risks and software dependencies. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Open source underpins everything
Widely used open-source components appear in many products. A flaw in one, such as a logging library, exposes thousands of systems at once.
Visibility fades with depth
Firms know direct suppliers but rarely their suppliers' suppliers. Software bills of materials aim to make components visible.
Updates carry compromise
Trusted update channels can deliver malicious code if a vendor's build system is compromised, bypassing perimeter defences.
Patching races exploitation
Once a flaw is public, attackers move quickly. Firms that cannot identify where a component is used cannot patch in time.
Settlement dependencies, and what fails with a node.
How a failure at one financial centre can spread through settlement links. Design links, not real dependencies.
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Software with a software bill of materials | share of critical applications | periodic | Firm records | DECLARED |
| Time to identify affected systems after a public vulnerability | hours or days | per event | Firm records | REPORTED |
| Critical suppliers assessed for security | share | annual | Vendor management records | DECLARED |
| Supply chain incidents | count | annual | Incident reports | REPORTED |
| End-of-life components in critical systems | count | periodic | Asset inventories | DECLARED |
| Fourth-party dependencies mapped | share of critical suppliers | periodic | Firm records | DECLARED |
Indirect losses along the value chain.
How much output, and so revenue, is lost beyond the sector hit first, the indirect exposure a lender or investor carries through suppliers and customers. Teaching model with stated illustrative values, not a prediction. The map on this page shows The Low Countries; the model itself is not tied to a place.
Controls
- Sector hit first (position in the list)
- 0
- Size of the shock
- 30% of its output
- Duration of the shock
- 30 days
- Recovery rate
- 0.08 per day
- Days simulated
- 180 days
Readouts
- Output lost over the run
- 0.48% of a year's output
- Total over direct (multiplier)
- 1.63 times
- Most affected other sector
- Retail
- Its peak inoperability
- 2.7%
Numbers, methods and sources
| Sector | Peak inoperability (%) | Output weight (%) |
|---|---|---|
| Telecoms and data | 29.96 | 9.8 |
| Finance | 2.33 | 12.8 |
| Retail | 2.72 | 15.3 |
| Logistics | 1.91 | 21.6 |
| Public services | 1.57 | 18.5 |
| Manufacturing | 0.22 | 22.0 |
Methods
- Input-output analysis Leontief (1936); Miller and Blair (2009), Input-Output Analysis, Cambridge University Press
- Inoperability input-output model Haimes and Jiang (2001), Journal of Infrastructure Systems 7
- Dynamic inoperability and recovery Lian and Haimes (2006), Systems Engineering 9
- Uncertainty fan (parameter Monte Carlo) Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
- One-at-a-time sensitivity (tornado) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
Data
The model runs on the teaching values set by the controls. To calibrate it for a place, read it against these admitted layers and series, which this page's map can draw:
- Seaports Natural Earth
- Maritime chokepoints Nexus (named straits and canals at their published coordinates)
- Railways Natural Earth
- Major roads Natural Earth
Across the six pillars, led by Nexus Consortium
- Experiments Labs
- Built in Financial Cyber and Operational Resilience in Foundry
- Tested at Financial Cyber and Operational Resilience in Universe
- Codified in Digital, Cyber and AI in Standards
- Published in Financial Cyber and Operational Resilience in Reports
- Taught in Faculty of Technology and Digital Systems in Academy
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| NTIA and CISA software bill of materials guidance | Minimum elements and practice for SBOMs | Public domain |
| ENISA threat landscape for supply chain attacks | Analysis of supply chain incidents | Free, ENISA terms |
| OpenSSF Scorecard | Security practice indicators for open-source projects | Open source, Apache 2.0 |
| NIST Secure Software Development Framework | Practices for secure software development | Public domain |
| EU Cyber Resilience Act | Security requirements for products with digital elements | Free, EU reuse terms |
Trace a shock in digital supply chains to the balance sheet.
Assembled from the Nexus Standards area profile Cyber resilience and digital operational resilience: the shocks it names, the systems and sectors that carry the loss, the controls that dampen it and the data that observe it. Pick an initiating shock and step through the cascade to see which exposures it reaches and where losses could concentrate. The Map view places the run on an example geography with open data. Every weight is a stated assumption. An exercise, not a forecast, a valuation, a rating or investment advice. To model a place of your own choosing, open the full System Builder.
Hazards
- Dam failure
- River flood (set off downstream)
- Flash flood (set off downstream)
- Mass displacement (set off downstream)
- Widespread power outage (set off downstream)
- Water supply shortfall (set off downstream)
Systems and couplings
Controls
NS-0Constitution and principlesNS-9Contextual UNIs (deployments, instances, programme instances)NS-10Policies and clauses (machine-readable obligations: definition, binding, evaluation and enforcement)NS-11Verification and monitoring (evidence, attestations, zero-trust conformance observation)NS-12Software, model and AI/ML artefacts (supply chain, model cards, dataset sheets)NRS-X6Cyber and digital security riskNRS-H54Hazard family: Signal and platform disruption (NHS-1 cyber.platform)NRS-P10Third-party, outsourcing and concentration riskNRS-H107Hazard family: Digital infrastructure concentration and monoculture (NHS-1 tech.digital-concentration)NRS-K31Domain pack profile: Cyber national resilience (DOMAIN-031)NRS-S7System profile: NXS-EOP (Earth observation and digital twins)
Observation
- Known Exploited Vulnerabilities catalogue (listed for reference)
- National Vulnerability Database (CVE enrichment API) (listed for reference)
- OSV open source vulnerability database (listed for reference)
- Proportion of population covered by a mobile network, by technology
Example geography
- North America: 243 hexagonal cells
- Night lights tonight, outages (VIIRS Day/Night Band), NASA GIBS
- Surface water through cloud, 30 m (OPERA DSWx-S1 radar), NASA GIBS
- Rain rate, last half hour (IMERG), NASA GIBS
- Surface soil moisture (SMAP), NASA GIBS
Who decides, and what the evidence serves.
Financial Cyber and Operational Resilience prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Chief information security officers | How to inventory and assure software components | SBOM practice and vulnerability evidence |
| Procurement and vendor management | What security evidence to require from suppliers | Standards and contract practice |
| Supervisors and legislators | What supply chain requirements apply | Incident evidence and comparative rules |
| Software vendors | How to secure build and update processes | Secure development frameworks |
Outputs this topic produces
- Guide to software bills of materials for financial firms
- Brief on open-source dependency risk
- Method note on mapping fourth parties
- Questions for boards on supplier assurance
What digital supply chains means for exposure, loss and capital.
The exposure, loss, scenario and capital views a risk officer, supervisor or ministry of finance would ask for, with the frameworks they report against. Structures follow supervisory and actuarial practice. Values are illustrative: never prices, ratings or advice.
Transmission channels
How a shock in digital supply chains reaches credit, market, underwriting, liquidity and operational risk, and feeds back.
What supply chain analysis asks.
- Which software and services does each important business service depend on, including indirect dependencies?
- Which components are shared so widely that a single flaw would affect much of the industry?
- How are updates tested and deployed, and can a faulty update be stopped or rolled back quickly?
- What assurance do firms have about suppliers' security practices?
How supply chains transmit risk.
A compromised software update delivered through a trusted channel can give attackers access to every customer that installs it. A vulnerability in a widely used open-source library can expose systems across the industry overnight. A faulty update from a security or infrastructure vendor, with no attack involved, can disable systems at many firms simultaneously.
Visibility is limited. Firms often know their direct suppliers but not the components and sub-suppliers beneath them. Software bills of materials, which list the components in a product, are one response, as are stronger requirements on how suppliers build, sign and distribute software.
How supply chain risk is managed.
- 01
Software bills of materials
Listing components in software. Limits: adoption is incomplete and lists must be kept current.
- 02
Secure development and signing
Practices for building and distributing software securely, grounded in software and safety-critical systems engineering. Limits: depend on supplier discipline.
- 03
Supplier assessment
Questionnaires, audits and certifications of suppliers. Limits: point-in-time and often superficial.
- 04
Dependency analysis
Mapping shared components across the sector, using network science. Limits: data is fragmented.
How it is studied, and what the methods cannot say.
- 01Cybersecurity and cryptographyIdentity and privileged access · Detection and response capability · Threat-led testingApplied here
- 02Network science and contagionSector dependency maps · Outage propagation · Software component networksApplied here
- 03Software and safety-critical systems engineeringChange control for core systems · Integrity by design · Fault toleranceApplied here
Questions and answers.
What is a software bill of materials?
Why are open-source components a risk?
What is a fourth party?
Is open-source software a risk?
Can firms see all their software dependencies?
Does the platform assess suppliers?
Why can a faulty update be as harmful as an attack?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GRASend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGlobal Risks AllianceSee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.