Financial Cyber and Operational Resilience
The Global Risks Alliance (GRA)
Topics at Financial Cyber and Operational Resilience: the pages in this section are listed below, each with its own scope and status.
GRA · In development · service level R0
The Financial Cyber and Operational Resilience topics are the eight subject dossiers of its field, among them critical business services, financial cyber threats, and cloud and outsourcing. Each dossier sets out how the risk develops, what is measured and in which units, the public sources and their licences, the methods, who decides and the limits of the evidence.
GRA is a nonprofit business league for the financial services industry. It does not lend, underwrite, rate, invest, advise on or arrange transactions, and readiness work is not approval.
Topic pages in Financial Cyber and Operational Resilience share one structure: mechanisms, indicators, sources, methods, decisions and limits, written for CISOs and operational resilience leads and cyber supervisors.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Dependency mapping | Tracing the people, processes, technology, facilities and suppliers a service relies on. |
| Ransomware | Malicious software that encrypts or steals data and demands payment for its release. |
| Shared responsibility model | The split of security duties between a cloud provider and its customer. |
| Incident classification | Deciding an incident's severity against criteria that determine reporting and escalation. |
| Software bill of materials | A list of the components and dependencies in a piece of software. |
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Identifying service continuity outcomes.
TopicAttack paths and control evidence.
TopicConcentration and resilience.
TopicResponse roles, escalation and recovery.
TopicVendor risks and software dependencies.
TopicConfidentiality, integrity and continuity.
TopicSevere but plausible scenario design.
TopicTolerances, metrics and measurement limits.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.