GRA · Financial Cyber and Operational Resilience
Spatial financeWhere capital meets hazard, exposure and transition
Test in Universe
For Universe, governed by the Global Risks Forum (GRF), the platform designs a third-party concentration failure exercise to rehearse coordination across firms and authorities.
Universe among the six pillars.
Where everything comes together in the annual programme, with the Global Centre for Risk and Innovation (GCRI), GRF and the Global Risks Alliance (GRA) each contributing in its role and capacity. It is led by the Nexus Consortium; its home is universe.nexus.
handoff in playrecorded handoffno direct handoff
Programme yearAll phases
Route
Around Universe
The pillars Universe hands work to and receives it from.
L · F · U · S · R · A
- Pillars
- 5 of 6
- Handoffs
- 16 of 18
- Loops
- 16 closed
Handoffs in play
- F01Universe → Foundry · Admitted mission becomes a cycle project with a decision caseReadiness preparation
- F02Foundry → Universe · Core Build Report and go or no-go evidenceControlled build
- F03Foundry → Reports · Sealed observations and indicator series behind a profileCloseout
- F04Universe → Reports · After-action and scenario findings for chapters 10 and 13After-action review
and 12 more
- LabsWhere questions become experiments and prototypes: new methods, data and tools are tried in the open, with their limits on record, before the Foundry builds them, under the Nexus Consortium.Labs
- FoundryWhere exposure and scenario evidence is built so supervisors, insurers and investors can read it.Financial Cyber and Operational Resilience in FoundryFoundry
- UniverseWhere scenarios are tested in controlled exercises, and finance-readiness dialogues read what they mean for capital and cover.Financial Cyber and Operational Resilience in Universeuniverse.nexus
- Nexus StandardsWhere disclosure and data rules are codified so risk evidence is comparable for finance and insurance.Digital, Cyber and AI in Standardsnexustandards.com
- ReportsWhere sector analysis and the finance and insurance readiness series are published, with exposure and limits stated.Financial Cyber and Operational Resilience in ReportsReports
- Risk AcademyWhere finance, insurance and public-finance professionals learn to read risk evidence, on Risk Academy.Faculty of Technology and Digital Systems in Academyrisksacademy.com
Universe in every area of the work
| Area | Universe |
|---|---|
| Leadership | GRF steers the annual programme and records each gate decision from G0 to G7, with dissent kept on the record. |
| Strategy | National and regional priorities become the year’s missions; the annual mandate at gate G0 sets which missions the programme takes on. |
| Cadence | One year to prepare, one month to build, one week to act and test in Q3, a planned stand-down, then review and renewal in Q4. |
| Ownership | Owns the cycle mandate, mission admission decisions, gate decisions, after-action records and the renewal decision. |
| Process | Twelve phases, from planning to renewal, each closed by a gate or a record. |
| Development | Develops national demand into admitted, qualified missions, and carries the lessons into the next mandate. |
| Simulations | Tests work under exercise control in Action Week with independent evaluators; nothing simulated is reported as observed impact. |
| Reporting | Authorises publication of the year’s results at gate G6 and supplies after-action and scenario findings. |
| Governance | GRF governs the programme; a cycle gate is a programme decision, not a public-authority approval. |
| Data and evidence | Run, decision and observation records from Action Week are sealed at closeout, gate G5. |
| Finance and resourcing | Data, people and resource offers are qualified before the build at gate G2; an offer is not an allocation. |
| Risk and assurance | Exercise controls and stop-work events keep Action Week controlled, reversible and independently evaluated. |
| Participation | Governments, agencies, researchers, finance, civil society and communities take part through missions, tracks and national contributions. |
| Communication | Mission themes are presented as proposals until admitted, and confirmed exercises are announced with their gate record. |
| Local | Exercises run on named places and systems, under exercise control. |
| National | National demand forms the agenda, and national counterparts own the agenda, data and decisions. |
| Regional | Regional programmes contribute missions that cross borders. |
| Planetary | The annual programme brings national and regional work together once a year. |
What each institution brings
| Pillar | GCRI | GRF | GRA |
|---|---|---|---|
| Universe | Its technical office prepares the scientific and data readiness of each mission. | Stewards and governs the programme: the mandate, gates G0 to G7, convening and Action Week. | Runs finance-readiness dialogues on what each mission means for finance and insurance. |
Synthetic injects.
| Inject | Tests |
|---|---|
| A shared provider pushes a faulty update | Detection and rollback |
| Ransomware corrupts backups | Recovery from immutable copies |
| A flood closes an operations centre | Staff and site continuity |
Governance: exercises and learning.
Financial Cyber and Operational Resilience exercises test cyber and operational dependency, with decisions left to the participants who hold them, such as cyber insurance analysts.
The workspace for Test in Universe.
Exercise control
Supervisor walkthrough · Example exercise interface, not a record
What the screen records
- Injects delivered
- count against the planned injects
- Median response
- minutes, per player cell
- Observer notes
- count, observers first
- Stand-down
- planned day and hot wash
Inject timeline
example sequence
- 09:00INJ-1Scenario opens: Supervisor walkthrough
- 10:30INJ-2Operational resilience lead receives first signal
- 12:15INJ-3Escalation: second system affected
- 14:00INJ-4Media query and public message
- 16:30HOTHot wash, observers first
Player cells
| Service owner | injects, response time, state |
| Operational resilience lead | injects, response time, state |
| Board | injects, response time, state |
| Third-party manager | injects, response time, state |
Financial Cyber and Operational Resilience · Exercise control. Exercise control: example names and illustrative values, not a record.
Mission themes from this field.
- 01
Third-party concentration failure
Proposed for controlled testing in the annual programme; a theme is not a confirmed exercise.
How the process runs.
Process
Test in Universe: Programme through eight gates
GRF records eight yearly gates, each a programme decision; a gate not passed stops its work, and the competent authority decides outside.
01 Q1 · Planning
- 01G0 · Annual programme authorisedGate · The Global Risks ForumGRF authorises the annual mandate. It never sets a national agenda.
- 03Route the candidate mission to standardsStep · Nexus StandardsNexus Standards routes each candidate mission to the standards and profiles that apply.
02 Q2 · Readiness and build
- 04G1 · Missions admittedGate · The Global Risks ForumGRF admits missions with reasons recorded. It cannot admit a mission without an accountable owner.
- 05G2 · Data and resources qualifiedGate · The Global Risks ForumReadiness preparation closes when data, people and resources are qualified.
- 06G3 · Build accepted for exerciseGate · The Global Risks ForumGRF records whether the build is accepted for exercise. A gate not passed stops the work it governs.
03 Q3 · Action Week
- 07G4 · Controlled live operation authorisedGate · The Global Risks ForumGRF authorises controlled live operation for Action Week.
- 08G5 · Evidence sealed and stand-down recordedGate · The Global Risks ForumThe evidence is sealed with its provenance and the stand-down is recorded.
04 Q4 · Reporting and renewal
- 02Competent authority decides and actsActor · The competent authorityThe competent authority decides and acts under its own rules. The programme informs it and never decides for it.
- 09Scientific and editorial reviewStep · Reviewers and the publisherQualified, conflict-managed reviewers and the publisher decide what is accepted. Institutions cannot decide a scientific conclusion.
- 10G6 · Publication authorisedGate · The Global Risks ForumGRF authorises publication of results that have passed scientific and editorial review. It cannot publish personal data.
- 11G7 · Renewal reviewedGate · The Global Risks ForumGRF reviews renewal and sets the next cycle’s mandate.
The programme year · The Global Risks Forum · Decision rightsDesigned programme process, not a record of operation. No cycle has run and every programme is at service level R0. A gate is a programme decision, never a public-authority approval, certification or deployment authorisation.
Controlled, reviewed and reversible.
Selected work is tested under controlled conditions, reviewed and then published with its limits. Results that pass go to Reports. The planned stand-down of each edition keeps review, reconciliation and corrections going after the event.
Where this page’s references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Questions and answers.
Where is Universe?
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.