GRA · Financial Cyber and Operational Resilience
Spatial financeWhere capital meets hazard, exposure and transition
Industry scope and publisher
Financial Cyber and Operational Resilience is published by the Global Risks Alliance (GRA), a nonprofit corporation registered in Nevada, United States, operating as a business league for the financial services industry. A business league works on the common business interest of an industry rather than the private business of its members. This page identifies the publisher, the subject community and the legal limits on the platform's work. In short, it builds shared understanding of operational and cyber resilience and provides no security, testing or advisory service.
- STEM methods
- 4
- Canonical methods this field applies
- Topics
- 8
- Subject pages in the field
- Counterparts
- 10
- Platforms in shared fields across the network
- Report series
- 2
- Reports series it contributes to
Industry scope and publisher in seven parts.
- 01Industry scopeOperational risk and technology dependency in finance
- 02Exposure profileHow disruption reaches financial services
- 03OutputsWhat the platform is designed to produce
- 04Publisher and communityGRA answers for the platform
- 05Legal limitationsWhat the platform does not do
- 06Operating stateOpen for information and enquiries
- 07SourcesWhere this page's references lead
Operational risk and technology dependency in finance.
The scope is operational risk, cyber incidents and interconnected technology dependencies in financial services.
Threats and controls
How attacks reach financial firms and what evidence shows about controls, at sector level.
Shared providers
Cloud, software, data and market infrastructure that many firms rely on.
Important services
Keeping essential financial services running within tolerances through disruption.
How disruption reaches financial services.
| Risk class | Channel | Frame |
|---|---|---|
| Physical | Sites, staff and data centres hit by floods, heat or outages | BCBS operational resilience principles |
| Operational | Process failures, change errors, provider outages | DORA; impact tolerances |
| Technological | Ransomware, data corruption, supply-chain compromise | NIST CSF 2.0; FSB Cyber Lexicon |
| Systemic | Concentration in shared providers; contagion through payment and market links | FSB third-party toolkit; critical third-party regimes |
What the platform is designed to produce.
Service mapping templates, concentration studies from public registers and scenario designs, designed for the Scenario and Stress-Test series and the Strategic Systems series. Boundary. GRA tests, attests to and monitors no firm, publishes no vulnerability and is not an incident response service.
GRA answers for the platform.
GRA is one of the three institutions of the Nexus Consortium, alongside The Global Centre for Risk and Innovation (GCRI), which does science, and the Global Risks Forum (GRF), which governs and convenes. GRA translates risk evidence into finance, insurance and development-readiness questions.
The platform's subject community is financial chief information security officers, operational risk officers, resilience specialists and cyber researchers. Its planned outputs are resilience playbooks and finance cyber scenario summaries. Enquiries go to Contact; compliance questions to Contact; security reports about GRA's own sites to Contact.
What the platform does not do.
- It does not lend, underwrite, rate, invest or advise on or arrange transactions, and it takes no transaction-based pay.
- It does not provide security services, penetration testing, incident response or audits.
- It does not evaluate, rank or recommend firms, providers or products.
- It does not receive incident reports or act for any supervisor or authority.
- Readiness work is not approval, and nothing published here is professional advice.
Competition safeguards are designed into GRA programmes and set out in a written competition policy.
Open for information and enquiries.
Financial Cyber and Operational Resilience is an established platform. Its pages set out its scope and how it works, and its activities, records and services are published here as each one opens. Information and enquiries are open today. Membership has not yet opened.
- 01
- 02
Governance
Trust, rights and status explains how records are kept and corrected.
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Questions and answers.
Is the platform a separate organisation?
Is this an information sharing and analysis centre?
Who does the underlying cyber science?
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.