GRA · Financial Cyber and Operational Resilience
Spatial financeWhere capital meets hazard, exposure and transition
Resilience metrics
Boards and supervisors want to know whether resilience is improving. Metrics such as outage duration, recovery time against tolerance, incident counts and control effectiveness help, but each can mislead. This page sets out which resilience metrics exist, what they show and hide, how they are collected, and who decides how they are used.
Resilience metrics in seven parts.
- 01The questionResilience metrics: how the risk develops
- 02IndicatorsWhat is measured, and how well
- 03SourcesWhere the evidence comes from
- 04DecisionsWho decides, and what the evidence serves
- 05Core questionsWhat measurement asks
- 06MechanismsWhat metrics can and cannot show
- 07Methods and limitsApproaches to measurement
Resilience metrics: how the risk develops.
Tolerances, metrics and measurement limits. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Counts reward under-reporting
Incident counts fall when detection is weak or definitions narrow. A falling count can mean worse visibility, not better resilience.
Averages hide the tail
Average recovery time can look good while the worst incidents, which matter most, take far longer.
Outcome metrics matter most
Measures tied to services, such as customer impact and time beyond tolerance, connect resilience to harm better than technical uptime.
Leading and lagging indicators
Lagging measures show past incidents; leading measures such as patch latency and test coverage show exposure before failure.
Settlement dependencies, and what fails with a node.
How a failure at one financial centre can spread through settlement links. Design links, not real dependencies.
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Time beyond impact tolerance | hours per service per year | annual | Incident records | REPORTED |
| Customer-impacting incidents | count and customers affected | annual | Incident records | REPORTED |
| Service availability | percent of operating time | monthly | Monitoring | OBSERVED |
| Patch latency for critical vulnerabilities | days | monthly | Vulnerability management | OBSERVED |
| Test coverage of important services | share tested in the year | annual | Test records | DECLARED |
| Control effectiveness ratings | share of key controls rated effective | annual | Control testing | DECLARED |
Important business services.
The screen a team would use to follow this subject: its measures, states and decisions. Names are examples and values are illustrative.
Important business services
Resilience metrics · Bank B services · Self-assessment 2
Services vs impact tolerance
| Make a payment | 3 | 1 | Cloud region loss | Outside |
| Access cash | 19 | 15 | Cyber attack | Within |
| Mortgage servicing | 63 | 47 | Data centre loss | Within |
| Claims payment | 27 | 46 | Third-party failure | Outside |
Dependency map
people · process · technology · third parties
Remediation
- R-1Second claims platform supplierExit plan tested168 d
- R-2Immutable backups for paymentsCyber recovery113 d
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| UK operational resilience self-assessment requirements | Expectations for documenting and measuring resilience | Free, Bank of England and FCA terms |
| BCBS operational risk loss data standards | Loss data collection for banks | Free, BIS terms |
| ORX operational risk loss data consortium publications | Aggregated operational loss data | Members only; public summaries free to read |
| NIST Cybersecurity Framework 2.0 measurement guidance | Measuring cybersecurity outcomes | Public domain |
| Supervisory feedback on resilience metrics | Observations on firms' metrics | Free, terms per supervisor |
Transition and physical risk on a portfolio.
Three scenario families after the NGFS framework move a sector portfolio through carbon costs and warming damages; the transmission view follows the losses to lenders, investors, public finances and households. Scenario: named assumptions about the future, not a forecast. The map on this page shows The Low Countries; the model itself is not tied to a place.
Controls
- Carbon price at the horizon, orderly path
- 200 per tCO2
- Delay before a disorderly transition
- 50% of horizon
- Cost passed to customers
- 50%
- Warming today above pre-industrial
- 1.30°C
- Warming per decade, current policies
- 0.25°C
- Damage coefficient
- 0.24% per °C²
- Years ahead
- 25 years
Readouts
- Worst scenario at the horizon
- −33.6% of value
Numbers, methods and sources
| Year | Orderly transition (% value) | Delayed, disorderly transition (% value) | Current policies (% value) |
|---|---|---|---|
| 0 | −0.38 | −0.38 | −0.38 |
| 3 | −2.87 | −0.53 | −0.67 |
| 6 | −5.36 | −0.68 | −0.97 |
| 9 | −7.84 | −0.84 | −1.27 |
| 12 | −10.33 | −0.99 | −1.57 |
| 15 | −12.82 | −7.12 | −1.87 |
| 18 | −15.31 | −15.05 | −2.17 |
| 21 | −17.80 | −23.00 | −2.48 |
| 24 | −20.29 | −30.94 | −2.79 |
Methods
- Climate scenario families NGFS (2023), Climate Scenarios for central banks and supervisors, Phase IV
- Climate stress test of the financial system Battiston and others (2017), Nature Climate Change 7
- Damage function Nordhaus (2017), Revisiting the social cost of carbon, PNAS 114
- Transmission channels BCBS (2021), Climate-related risk drivers and their transmission channels
- Uncertainty fan (parameter Monte Carlo) Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
- One-at-a-time sensitivity (tornado) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
Data
The model runs on the teaching values set by the controls. To calibrate it for a place, read it against these admitted layers and series, which this page's map can draw:
- Urban extents Natural Earth
- Seaports Natural Earth
- Past year, daily temperature (ERA5 via Open-Meteo) Open-Meteo.com (CC BY 4.0), Copernicus ERA5 (C3S/ECMWF) · register open-meteo.public-pages
- Surface air temperature, daytime (AIRS) NASA AIRS · register nasa.gibs.context-live-layers
Across the six pillars, led by Nexus Consortium
- Experiments Labs
- Built in Financial Cyber and Operational Resilience in Foundry
- Tested at Financial Cyber and Operational Resilience in Universe
- Codified in Digital, Cyber and AI in Standards
- Published in Financial Cyber and Operational Resilience in Reports
- Taught in Faculty of Technology and Digital Systems in Academy
Who decides, and what the evidence serves.
Financial Cyber and Operational Resilience prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Boards and risk committees | Which metrics to monitor and what thresholds trigger action | Metric definitions and history |
| Chief risk officers | How to combine metrics into a view of resilience | Data quality and coverage evidence |
| Supervisors | Which metrics to request and compare | Firm submissions and sector data |
| Internal audit | Whether metrics are accurate and complete | Data lineage and controls |
Outputs this topic produces
- Guide to resilience metrics and their pitfalls
- Method note on service-based outcome measures
- Brief on leading and lagging indicators
- Questions for boards reading resilience dashboards
Trace a shock in resilience metrics to the balance sheet.
Assembled from the Nexus Standards area profile Cyber resilience and digital operational resilience: the shocks it names, the systems and sectors that carry the loss, the controls that dampen it and the data that observe it. Pick an initiating shock and step through the cascade to see which exposures it reaches and where losses could concentrate. The Map view places the run on an example geography with open data. Every weight is a stated assumption. An exercise, not a forecast, a valuation, a rating or investment advice. To model a place of your own choosing, open the full System Builder.
Hazards
- Dam failure
- River flood (set off downstream)
- Flash flood (set off downstream)
- Mass displacement (set off downstream)
- Widespread power outage (set off downstream)
- Water supply shortfall (set off downstream)
Systems and couplings
Controls
NS-0Constitution and principlesNS-9Contextual UNIs (deployments, instances, programme instances)NS-10Policies and clauses (machine-readable obligations: definition, binding, evaluation and enforcement)NS-11Verification and monitoring (evidence, attestations, zero-trust conformance observation)NS-12Software, model and AI/ML artefacts (supply chain, model cards, dataset sheets)NRS-X6Cyber and digital security riskNRS-H54Hazard family: Signal and platform disruption (NHS-1 cyber.platform)NRS-P10Third-party, outsourcing and concentration riskNRS-H107Hazard family: Digital infrastructure concentration and monoculture (NHS-1 tech.digital-concentration)NRS-K31Domain pack profile: Cyber national resilience (DOMAIN-031)NRS-S7System profile: NXS-EOP (Earth observation and digital twins)
Observation
- Known Exploited Vulnerabilities catalogue (listed for reference)
- National Vulnerability Database (CVE enrichment API) (listed for reference)
- OSV open source vulnerability database (listed for reference)
- Proportion of population covered by a mobile network, by technology
Example geography
- North America: 243 hexagonal cells
- Night lights tonight, outages (VIIRS Day/Night Band), NASA GIBS
- Surface water through cloud, 30 m (OPERA DSWx-S1 radar), NASA GIBS
- Rain rate, last half hour (IMERG), NASA GIBS
- Surface soil moisture (SMAP), NASA GIBS
What measurement asks.
- What is the maximum tolerable disruption for each important service, expressed in time, volume or harm?
- Which indicators give early warning that a service is drifting towards its tolerance?
- How can resilience be compared across firms or over time without creating misleading rankings?
- Which aspects of resilience resist measurement, and how are they assessed instead?
- How should metrics account for dependencies on providers whose performance the firm cannot observe directly?
What resilience metrics means for exposure, loss and capital.
The exposure, loss, scenario and capital views a risk officer, supervisor or ministry of finance would ask for, with the frameworks they report against. Structures follow supervisory and actuarial practice. Values are illustrative: never prices, ratings or advice.
Transmission channels
How a shock in resilience metrics reaches credit, market, underwriting, liquidity and operational risk, and feeds back.
What metrics can and cannot show.
Metrics are most useful as prompts for questions rather than as verdicts. A recovery time that improves while the dependencies behind it grow more concentrated is not a real improvement.
Defining harm
Tolerances translate harm to customers and markets into measurable limits.
Leading and lagging
Lagging metrics record what happened; leading indicators try to signal trouble ahead.
Goodhart's law
When a measure becomes a target, it can be managed at the expense of the outcome it was meant to track.
Approaches to measurement.
- 01
Recovery time and point objectives
Targets for how fast systems recover and how much data may be lost. Limits: system targets may not reflect service outcomes.
- 02
Service-level tolerance tracking
Measuring disruption against tolerances in tests and incidents. Limits: incidents are rare, so evidence is limited.
- 03
Dependency concentration indicators
Measures of reliance on shared providers, using network science. Limits: describe exposure, not likelihood.
- 04
Qualitative maturity assessment
Structured judgement of capabilities, informed by resilience engineering. Limits: subjective and prone to optimism.
How it is studied, and what the methods cannot say.
- 01Reliability and resilience engineeringService and dependency mapping · Recovery strategy comparison · Learning reviewsApplied here
- 02Network science and contagionSector dependency maps · Outage propagation · Software component networksApplied here
- 03Cybersecurity and cryptographyIdentity and privileged access · Detection and response capability · Threat-led testingApplied here
Questions and answers.
Is availability a good resilience metric?
What is time beyond tolerance?
What are leading indicators of resilience?
Can resilience be reduced to a single score?
Does the platform publish resilience rankings?
What is an impact tolerance?
Why do common definitions matter?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GRASend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGlobal Risks AllianceSee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.