Financial Cyber and Operational Resilience
The Global Risks Alliance (GRA)
What readiness means in financial Cyber and Operational Resilience: the evidence, governance and documentation a programme needs before a competent institution can review it independently.
Bank B services · Resilience and finance… · Cycle 1 of 4
by stage
Financial Cyber and Operational Resilience · Programme boardProgramme board, in outline: domain structure with placeholder names and illustrative values, not a record.
Readiness in Financial Cyber and Operational Resilience is the state in which a programme's evidence, governance and documentation let a competent institution review it independently, against frameworks such as Principles for Operational Resilience and Principles for the Sound Management of Operational Risk and Digital Operational Resilience Act (DORA). A readiness file is released only at the owner's written direction, and GRA does not approve, rate, underwrite, lend or invest.
Fig.A programme from scoping to the owner's decision. Design, not a record.
How a failure at one financial centre can spread through settlement links. Design links, not real dependencies.
A readiness file describes a programme's evidence, risks and governance so that an institution can carry out its own review. GRA does not approve, rate, underwrite, lend or invest, and it recommends no counterparty.
| Pillar | What it requires |
|---|---|
| ICT risk management | A documented framework covering identification, protection, detection, response and recovery |
| Incident reporting | Classification and reporting of major ICT-related incidents to the competent authority |
| Resilience testing | Testing programme, with threat-led penetration testing for designated entities |
| Third-party risk | Register of ICT contracts, exit strategies, oversight of critical ICT third-party providers |
| Information sharing | Voluntary arrangements for cyber threat intelligence |
The BCBS operational resilience principles, NIST Cybersecurity Framework 2.0 and national supervisory rules share the structure: know your important services, set tolerances, test against severe scenarios and manage third parties. Topic depth at operational resilience testing; cyber evidence at GCRI cyber risk management.
A file is released only at the programme owner's written direction, to a party the owner chooses, with no fee tied to any transaction.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Readiness file | A document set describing a programme's evidence, risks, governance and data so that a competent institution can carry out its own independent review; it is not an approval, rating or offer of finance. |
| Due diligence | The independent investigation a lender or investor carries out before committing finance. |
| Environmental and social safeguards | Requirements lenders set so financed projects avoid, minimise and offset harm to people and the environment. |
| Important business service | A service whose disruption could harm customers or market integrity, the unit for resilience planning. |
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.