GRA · Financial Cyber and Operational Resilience
Spatial financeWhere capital meets hazard, exposure and transition
Operational resilience testing
Testing shows whether resilience plans hold. Firms run severe but plausible scenario tests against impact tolerances, failover and restore tests, threat-led red-team exercises and joint exercises with peers and authorities. This page sets out the main test types and what each shows, where testing gives false comfort, the records produced, and who decides.
Operational resilience testing on the record.
Operational resilience testing: how the risk develops.
Severe but plausible scenario design. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Scenarios set the challenge
Tests are only as hard as the scenarios chosen. Mild scenarios confirm plans; severe ones expose weaknesses.
Red teams find what audits miss
Threat-led testing uses real attacker techniques against live systems, finding weaknesses in detection and response that control checklists miss.
Findings decay without action
Unremediated findings repeat in later tests. Tracking each finding to verified closure turns testing into improvement.
Joint exercises test coordination
Exercises with suppliers, peers and authorities reveal communication and decision gaps that sit between organisations.
Important business services.
The screen a team would use to follow this subject: its measures, states and decisions. Names are examples and values are illustrative.
Important business services
Operational resilience testing · Bank B services · Self-assessment 3
Services vs impact tolerance
| Make a payment | 2 | 5 | Cloud region loss | Within |
| Access cash | 19 | 8 | Cyber attack | Within |
| Mortgage servicing | 66 | 53 | Data centre loss | Within |
| Claims payment | 45 | 51 | Third-party failure | Outside |
Dependency map
people · process · technology · third parties
Remediation
- R-1Second claims platform supplierExit plan tested158 d
- R-2Immutable backups for paymentsCyber recovery47 d
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Scenario tests completed for important services | count | annual | Firm records | DECLARED |
| Threat-led penetration tests | count | periodic | Public records | Published statistics |
| Critical findings remediated on time | share | periodic | Remediation tracking | DECLARED |
| Restore tests passed | share | annual | Test records | DECLARED |
| Joint exercises with suppliers or sector | count | annual | Firm records | DECLARED |
| Tests involving severe destructive scenarios | share of tests | annual | Test records | DECLARED |
Transition and physical risk on a portfolio.
Three scenario families after the NGFS framework move a sector portfolio through carbon costs and warming damages; the transmission view follows the losses to lenders, investors, public finances and households. Scenario: named assumptions about the future, not a forecast.
Controls
- Carbon price at the horizon, orderly path
- 200 per tCO2
- Delay before a disorderly transition
- 50% of horizon
- Cost passed to customers
- 50%
- Warming today above pre-industrial
- 1.30°C
- Warming per decade, current policies
- 0.25°C
- Damage coefficient
- 0.24% per °C²
- Years ahead
- 25 years
Readouts
- Worst scenario at the horizon
- −33.6% of value
Numbers, methods and sources
| Year | Orderly transition (% value) | Delayed, disorderly transition (% value) | Current policies (% value) |
|---|---|---|---|
| 0 | −0.38 | −0.38 | −0.38 |
| 3 | −2.87 | −0.53 | −0.67 |
| 6 | −5.36 | −0.68 | −0.97 |
| 9 | −7.84 | −0.84 | −1.27 |
| 12 | −10.33 | −0.99 | −1.57 |
| 15 | −12.82 | −7.12 | −1.87 |
| 18 | −15.31 | −15.05 | −2.17 |
| 21 | −17.80 | −23.00 | −2.48 |
| 24 | −20.29 | −30.94 | −2.79 |
Methods
- Climate scenario families NGFS (2023), Climate Scenarios for central banks and supervisors, Phase IV
- Climate stress test of the financial system Battiston and others (2017), Nature Climate Change 7
- Damage function Nordhaus (2017), Revisiting the social cost of carbon, PNAS 114
- Transmission channels BCBS (2021), Climate-related risk drivers and their transmission channels
- Uncertainty fan (parameter Monte Carlo) Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
- One-at-a-time sensitivity (tornado) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
Data
The model runs on the teaching values set by the controls. To calibrate it for a place, read it against these admitted layers and series, which this page's map can draw:
- Urban extents Natural Earth
- Seaports Natural Earth
- Past year, daily temperature (ERA5 via Open-Meteo) Open-Meteo.com (CC BY 4.0), Copernicus ERA5 (C3S/ECMWF) · register open-meteo.public-pages
- Surface air temperature, daytime (AIRS) NASA AIRS · register nasa.gibs.context-live-layers
Across the six pillars, led by Nexus Consortium
- Experiments Labs
- Built in Financial Cyber and Operational Resilience in Foundry
- Tested at Financial Cyber and Operational Resilience in Universe
- Codified in Digital, Cyber and AI in Standards
- Published in Financial Cyber and Operational Resilience in Reports
- Taught in Faculty of Technology and Digital Systems in Academy
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| TIBER-EU framework | Threat intelligence-based ethical red-teaming | Free, ECB terms |
| DORA threat-led penetration testing standards | EU testing requirements | Free, EU reuse terms |
| CBEST framework | UK threat-led testing | Free, Bank of England terms |
| Hong Kong Monetary Authority iCAST and similar frameworks | Testing frameworks in other jurisdictions | Free, terms per authority |
| Supervisory reports on scenario testing practice | Observations on firms' testing | Free, terms per supervisor |
What operational resilience testing means for exposure, loss and capital.
The exposure, loss, scenario and capital views a risk officer, supervisor or ministry of finance would ask for, with the frameworks they report against. Structures follow supervisory and actuarial practice. Values are illustrative: never prices, ratings or advice.
Transmission channels
How a shock in operational resilience testing reaches credit, market, underwriting, liquidity and operational risk, and feeds back.
Who decides, and what the evidence serves.
Financial Cyber and Operational Resilience prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Boards | Which scenarios to test and whether results are acceptable | Test results and remediation status |
| Authorities | Which firms must run threat-led tests | Frameworks and risk assessments |
| Testing teams | How to design tests safely and realistically | Framework requirements |
| Internal audit | Whether testing is adequate and findings closed | Test and remediation records |
Outputs this topic produces
- Guide to operational resilience test types
- Method note on severe scenario design
- Brief on remediation tracking
- Questions for boards on test results
What test designers ask.
- Is the scenario severe enough to stretch the firm, yet plausible enough to be credible?
- Does it include combined failures, such as a cyber attack during a provider outage?
- Does it test decisions and communication as well as technology?
- What happens to findings: are weaknesses fixed and retested?
What testing reveals.
Tests often reveal hidden dependencies, such as a recovery process that relies on a system that would itself be down, or a team that cannot be reached without the communication tool that failed. They reveal decision bottlenecks and gaps between documented plans and what people actually do.
Threat-led testing, carried out under strict controls by authorised teams, shows how real attackers could move through systems. Sector-wide exercises show how firms, providers and authorities would coordinate. Each kind of test answers different questions, and none proves that a firm is resilient against everything.
Kinds of testing.
- 01
Scenario-based exercises
Tabletop and simulation exercises using resilience engineering methods. Limits: participants know it is an exercise.
- 02
Technical recovery tests
Testing failover and restoration of systems. Limits: full production tests carry risk.
- 03
Threat-led penetration testing
Controlled emulation of real attackers, grounded in cybersecurity. Limits: time-boxed and scoped.
- 04
Sector-wide exercises
Coordinated exercises across firms and authorities. Limits: complex to organise.
How it is studied, and what the methods cannot say.
- 01Reliability and resilience engineeringService and dependency mapping · Recovery strategy comparison · Learning reviewsApplied here
- 02Cybersecurity and cryptographyIdentity and privileged access · Detection and response capability · Threat-led testingApplied here
- 03Software and safety-critical systems engineeringChange control for core systems · Integrity by design · Fault toleranceApplied here
Where this page leads across the Consortium.
Questions and answers.
What is a severe but plausible scenario?
How does red-teaming differ from penetration testing?
Why involve suppliers in exercises?
Can the platform run a test for my firm?
What does severe but plausible mean?
Does passing a test prove resilience?
Why test combined failures?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GRASend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGlobal Risks AllianceSee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.