GRA · Financial Cyber and Operational Resilience
Spatial financeWhere capital meets hazard, exposure and transition
Analysis and uncertainty
The field uses service mapping, dependency graphs, impact-tolerance analysis, scenario testing and incident data analysis. This page explains each method, how supervisory frameworks shape it, and what public incident data can and cannot reveal.
The order things happen in.
- 01Draftsources cited, labels attached
- 02Evidence checkevery value traced
- 03Independent reviewconflicts declared
- 04Editionpublished with its limits
- 05Correctiona new version, never a silent edit
The methods in use.
- 01Cybersecurity and cryptographyIdentity and privileged access · Detection and response capability · Threat-led testingApplied here
- 02Reliability and resilience engineeringService and dependency mapping · Recovery strategy comparison · Learning reviewsApplied here
- 03Network science and contagionSector dependency maps · Outage propagation · Software component networksApplied here
- 04Software and safety-critical systems engineeringChange control for core systems · Integrity by design · Fault toleranceApplied here
Measuring cyber resilience at sector level.
| Method | Use | Limit |
|---|---|---|
| Incident data analysis | Frequency, duration and cause of outages | Under-reporting and inconsistent formats; FIRE aims to align them |
| Dependency mapping | Concentration in providers | Fourth-party visibility |
| Cyber loss modelling | Insured and economic loss scenarios | Short history, changing threat |
| Resilience metrics | Recovery time and data loss against tolerance | Self-reported |
How the process runs.
Process explorer · Process
Analysis and uncertainty: Source to evidence record
10 steps·4 stages·2 gates
Process
Analysis and uncertainty: Source to evidence record
A source is registered and assessed, its record labelled and classified, and a Digital Evidence Passport carries provenance; a correction reaches every dependent record.
01 Intake
- 01Identify the sourceSource · The source stewardDiscovery is not ingestion. Source identification records the source class, steward, institutional role and jurisdiction.
- 03Register the sourceStepRegistration makes a discovered source a governed participant in the evidence lifecycle. It implies no endorsement or certification.
02 Assessment
- 04Jurisdiction and rights classificationGateRights classification identifies licence, consent, confidentiality and reuse limits. The result determines access and routing.
- 05Evidence quality assessmentStepQuality assessment decides whether a record is fit for a defined use. Quality is multidimensional and never a single score.
- 06Evidence labelStepEvery finding carries one of nine evidence labels. Missing data is shown as missing, never as zero.
03 Record
- 07Evidence classificationRecordClassification gives records lifecycle states, such as source-verified, public-safe or restricted. States can coexist and set evidence use.
- 08Source release and identifierRecord · NXS-GRX (canonical data, provenance and risk)A source release records rights, temporal coverage and source lineage. A UNI is allocated through a catalogue and never typed by hand.
- 09Digital Evidence PassportRecordThe passport records provenance, quality, rights, jurisdiction, permitted use and history, so evidence keeps its context when it travels.
04 Use and correction
- 02Correction reaches dependent recordsStep · NXS-GRX (canonical data, provenance and risk)A source correction propagates to dependent cuts and products without rewriting old results.
- 10Public-safe reviewGatePublic-safe review decides whether a record can be shared publicly. It is a distinct stage and is not validation.
Data protocols: evidence lifecycle · Data protocols: core data objects and evidence records · The Global Risks Index (NXS-GRX)Designed programme process, not a record of operation. No cycle has run and every programme is at service level R0. A gate is a programme decision, never a public-authority approval, certification or deployment authorisation. The data-protocol pages describe a design, not a running system.
What a resilience metric should say.
A useful metric names the service, the tolerance and the evidence that it was met under test. Topic depth at resilience metrics.
How uncertainty is reported.
- 01
State assumptions
Each analysis lists its assumptions and the data it depends on.
- 02
Quantify where possible
Ranges and confidence are reported alongside central estimates.
- 03
Validate and compare
Models are checked against observations and, where possible, against other models.
- 04
Publish limits
What an analysis cannot show is stated beside what it can.
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Questions and answers.
Are the methods open?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GRASend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGlobal Risks AllianceSee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.