A-P06 · PROCESS · checklistGRA dossier · service level R0
GRAFinancial Cyber and Operational ResilienceIn development
Readiness checklist

Reader questions and safeguards

The questions a programme in financial Cyber and Operational Resilience should be able to answer before a competent institution reviews it.

Make an enquiry Back to Resilience and finance readiness
Publisher
The Global Risks Alliance
Field
Cyber and digital resilience, Financial stability, Critical infrastructure
Status
In development
Service level
R0: information and enquiries

Programme board

Bank B services · Reader questions and… · Cycle 2 of 4

  • Workstreams active
    6Active
  • Milestones due this quarter
    7Watch
  • Decisions pending with owners
    3Watch
  • Open risks
    11
Quarter review dueGRA · Financial Cyber and Operational Resilience

Workstreams

by stage

Scoping02
Scenario testing programmeWS-160 · owner: Supervisor
Cyber recovery capabilityWS-988 · owner: Supervisor
In delivery02
Self-assessmentMilestone M3 · slipping
Service mappingMilestone M5 · on plan
Review01
Impact tolerance settingIndependent reviewer named
Closed01
Third-party exit plansClosure note on record

Gates

  1. Requestowner named
  2. Scoping noteboundary
  3. Qualifiedinputs
  4. BuildFoundry
  5. Testcontrolled
  6. Publishwith limits
  7. Decisionauthority

Financial Cyber and Operational Resilience · Programme boardProgramme board, in outline: domain structure with placeholder names and illustrative values, not a record.

01In brief

The short answer.

The Financial Cyber and Operational Resilience readiness checklist is a working aid of seven questions a programme should answer before a competent institution reviews it: purpose, evidence, ownership, governance, data, risks and monitoring. It is not a standard; reviewers apply their own rules, and decision holders such as boards keep their authority.

02Canvas

Scoping to review.

Canvas · scoping to reviewDesign, not a record
Reader questions and safeguards: the policy cycleA problem reaches the agenda, options are formulated and appraised, consultation tests them, the mandate holder decides, implementation and monitoring follow, and evaluation feeds the next agenda. Design of the process, not a record of a run.

Fig.A programme from scoping to the owner's decision. Design, not a record.

03Geography

Connected activity in the Low Countries.

For reader questions and safeguards, in GRA's spatial-finance reading, the map opens on night lights and population density with night lights tonight from NASA GIBS, framed on the Low Countries; 3 further NASA layers wait in the list.

The interactive map needs JavaScript; the layer list and sources are below.

Layers 2

Connected activity, for this page

Latest available

NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth

Loading the latest NASA imagery.

Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.

For reader questions and safeguards, in GRA's spatial-finance reading, the map opens on night lights and population density with night lights tonight from NASA GIBS, framed on the Low Countries; 3 further NASA layers wait in the list.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.

Data: NASA GIBS · ASTER GDEM · Blue Marble · © OpenStreetMap contributors · Natural Earth · NASA/NOAA VIIRS · CIESIN/Columbia, NASA SEDAC HBASE · GDACSSources and licences

  • We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • VIIRS Black Marble night-time lights, NASA Goddard Space Flight Center; distributed by the NASA Level-1 and Atmosphere Archive and Distribution System (LAADS DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • Center for International Earth Science Information Network (CIESIN), Columbia University. 2018. Gridded Population of the World, Version 4 (GPWv4): Population Density, Revision 11. NASA Socioeconomic Data and Applications Center (SEDAC). Licensed under CC BY 4.0. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). CC BY 4.0
  • VIIRS near-real-time products (flood, land surface temperature, snow cover, corrected reflectance), NASA LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • ASTER GDEM is a product of METI and NASA (ASTER Global Digital Elevation Model V003, NASA LP DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • Made with Natural Earth. Free vector and raster map data @ naturalearthdata.com. Public domain
  • © OpenStreetMap contributors (ODbL), via NASA GIBS (coastlines, boundaries, roads and place names). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). ODbL
  • Blue Marble, NASA Earth Observatory; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • Context on the globe and flat map: coastlines, boundaries, roads and place names from NASA GIBS reference layers (OpenStreetMap data, ODbL, © OpenStreetMap contributors); Blue Marble imagery as an optional base; 3D terrain and the elevation read-out from the ASTER GDEM elevation colour index (5 m to 200 m classes, exaggerated for legibility). Boundaries are drawn as published and imply no position on any territory.
  • Globe: MapLibre GL JS 6.9.1, BSD-3-Clause, © MapLibre contributors.
  • Observed (EO): NASA/NOAA VIIRS (Suomi NPP). We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS).
  • Context: CIESIN/Columbia, NASA SEDAC HBASE. Center for International Earth Science Information Network (CIESIN), Columbia University, and NASA Socioeconomic Data and Applications Center (SEDAC): Global Human Built-up And Settlement Extent (HBASE) 2010; Seto, Guneralp and Hutyra 2012, Global Grid of Probabilities of Urban Expansion to 2030; Global Urban Heat Island (UHI) Data Set, 2013.
  • Live: GDACS (EC JRC / UN OCHA) Events are indicative, not official warnings.
  • Optional layers (4 sources in the layer list: live, forecast, observed and context) print their provider credit on the map and here when switched on; forecasts are model output and derived indices are estimates.

Layers and dates

  • Night-time lights, daily: VIIRS Black Marble (VNP46A2), NASA LAADS DAAC · 12 Oct 2026
  • Population density, 2020: Population: CIESIN, Columbia University, Gridded Population of the World v4.11 (2018), NASA SEDAC, CC BY 4.0 · static
  • Flood water, 3-day composite: VIIRS Global Flood Product, NASA LANCE · 14 Oct 2026
  • Land surface temperature, day, 8-day composite: VIIRS NOAA-20 Level 3, 8-day, NASA LANCE · 14 Sep 2026
  • True colour: VIIRS NOAA-20 corrected reflectance, NASA LANCE · 13 Oct 2026

04Checklist

Seven questions.

  1. 01

    Purpose

    What problem does the programme address, and for whom?

  2. 02

    Evidence

    What hazard, exposure and vulnerability evidence supports it, with what uncertainty?

  3. 03

    Ownership

    Who owns the programme and answers for it?

  4. 04

    Governance

    How are decisions taken, recorded and challenged?

  5. 05

    Data

    Which data is used, on what terms, and how is it protected?

  6. 06

    Risks

    What could go wrong, and how is it managed?

  7. 07

    Monitoring

    How will results be measured and reported?

05Checklist

Mapping an important business service.

  • Service definition: the outcome customers or markets depend on.
  • Impact tolerance: maximum tolerable disruption, in time or data loss.
  • Resources: people, processes, technology, facilities and information supporting it.
  • Third parties: including fourth parties the provider relies on.
  • Locations: data centres and offices, with hazard exposure.
06Testing

Threat-led testing.

Threat-led penetration testing under DORA follows the TIBER-EU approach for designated entities. Results are confidential; sector research studies methods and lessons, not results. Incident response evidence at GCRI incident response and recovery.

07Key terms

Terms used on this page.

Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.

TermDefinition
Due diligenceThe independent investigation a lender or investor carries out before committing finance.
Risk ownerThe person or entity with the accountability and authority to manage a risk.
Data lineageA record of where data came from and how it was transformed before use.
Theory of changeA stated chain of causes from a programme's activities to its intended outcomes, used to plan evaluation.
08Sources

Where this page's references lead.

The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.

09Questions

Questions and answers.

Is the checklist a standard?
No. It is a working aid. Institutions apply their own standards and rules.
Related

Around Financial Cyber and Operational Resilience.

Financial Cyber and Operational Resilience

Bring your expertise to this field.

The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.

Write to the team See all contact routes
Skip to toolbar