Topics
Topics at Financial Cyber and Operational Resilience: the pages in this section are listed below, each with its own scope and status.
Topics at Financial Cyber and Operational Resilience.
The Global Risks Alliance (GRA) is a nonprofit business league for the financial services industry. It does not lend, underwrite, rate, invest, advise on or arrange transactions, and readiness work is not approval.
Financial Cyber and Operational Resilience topics, and the question each answers.
- Critical business services and tolerancesThe questionOperational resilience starts by deciding which services matter most: payments, account access, claims payment, trading, custody.
- Cyber threats to financial firmsThe questionFinancial firms face ransomware, intrusions to steal data or funds, attacks that enable fraud, insider threats and activity by state-linked groups.
- Cloud and outsourcing risk in financeThe questionFinancial firms run core services on cloud platforms and outsource operations to specialist providers.
- Incident and crisis response in financeThe questionWhen an incident strikes, firms must detect it, decide its severity, contain it, report it to authorities, inform customers and recover.
- Digital supply chain risk in financeThe questionFinancial firms depend on chains of software libraries, hardware, vendors and service providers, most of them several steps away.
- Data integrity and recovery in financeThe questionFinance runs on records: account balances, positions, policies and transactions.
- Operational resilience testing in financeThe questionTesting shows whether resilience plans hold.
- Operational resilience metricsThe questionBoards and supervisors want to know whether resilience is improving.
Topic pages in Financial Cyber and Operational Resilience share one structure: mechanisms, indicators, sources, methods, decisions and limits, written for CISOs and operational resilience leads and cyber supervisors.
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Pages in Topics.
Critical business services
Identifying service continuity outcomes.
TopicFinancial cyber threats
Attack paths and control evidence.
TopicCloud and outsourcing
Concentration and resilience.
TopicIncident and crisis response
Response roles, escalation and recovery.
TopicDigital supply chains
Vendor risks and software dependencies.
TopicData integrity and availability
Confidentiality, integrity and continuity.
TopicOperational resilience testing
Severe but plausible scenario design.
TopicResilience metrics
Tolerances, metrics and measurement limits.
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GRASend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGlobal Risks AllianceSee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.