Financial Cyber and Operational Resilience
The Global Risks Alliance (GRA)
Operational resilience is the ability of a financial firm, and of the financial system, to prevent, adapt to, respond to, recover from and learn from operational disruption, keeping important services within tolerable limits. Cyber resilience is a central part of it. This page describes the discipline as a subject of research: its concepts, where risks lie and what shared understanding the industry needs. It describes no execution and gives no advice. The platform home links to the topics.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 2
Activity and exposure, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
For financial discipline overview, in GRA's spatial-finance reading, the map opens on night lights and population density with night lights tonight from NASA GIBS, framed on the Low Countries; 3 further NASA layers wait in the list.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
GeographyFor financial discipline overview, in GRA's spatial-finance reading, the map opens on night lights and population density with night lights tonight from NASA GIBS, framed on the Low Countries; 3 further NASA layers wait in the list.
The Financial Cyber and Operational Resilience sector overview covers operational risk, cyber incidents and interconnected technology dependencies in financial services. It sets out who is in scope, from financial CISOs and operational risk officers, how risk reaches the sector and how it travels onward, analysed with financial operational resilience, third-party mapping and incident evidence. GRA builds shared industry understanding and does not advise, rate or assess individual firms.
Fig.How GCRI, GRF and GRA share one field while the authorities decide. Design, not a record.
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Traditional operational risk management focused on identifying and controlling individual risks. Operational resilience starts from the other end: assume disruption will happen, identify the services whose interruption would cause intolerable harm to customers, markets or the firm, set tolerances for how long they can be disrupted, map everything they depend on, and test whether the firm can stay within tolerance under severe but plausible scenarios.
Cyber resilience applies the same thinking to cyber threats. Prevention remains essential, but firms also need to detect intrusions quickly, contain them, recover data and services, and communicate clearly. The key shift is from asking whether a control exists to asking whether the service survives.
Financial Cyber and Operational Resilience frames are set by European Union, BCBS and FSB.
| Part | Channel Financial Cyber and Operational Resilience studies |
|---|---|
| Banks | Services |
| FMIs | Settlement |
| Insurers | Claims |
| Providers | Cloud |
Shocks travel between these parts, and Financial Cyber and Operational Resilience studies the links: Which services fail together? The evidence base is dependency maps and incident data.
Ransomware, intrusion, fraud and disruption campaigns targeting firms and suppliers.
Software faults, failed changes and infrastructure outages without malicious cause.
Concentration on cloud, software, data and market infrastructure providers.
The platform studies these risks at sector level: common dependencies, patterns in incident evidence, scenario design and measurement. Analysis is sector-level and educational. It does not assess individual firms, test their controls or certify their resilience. It publishes nothing that would help an attacker and does not comment on specific incidents under investigation.
Finance depends on energy, telecommunications and digital infrastructure studied by The Global Centre for Risk and Innovation (GCRI), including Digital Public Infrastructure. Within GRA, Payments and Market Infrastructure studies the systems that move money. At The Global Risks Forum (GRF), Capital Nexus convenes on financial system governance. Financial-system transmission sets out how disruption spreads.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Transmission channel | The route by which a shock reaches financial institutions' balance sheets. |
| Operational resilience | A firm's ability to prevent, adapt to, respond to, recover from and learn from operational disruption while keeping important business services running. |
| Important business service | A service whose disruption could harm customers or market integrity, the unit for resilience planning. |
| Systemic risk | The risk of disruption to financial services caused by impairment of all or parts of the financial system, with serious consequences for the real economy, as the IMF, FSB and BIS define it. |
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.