GRA · Financial Cyber and Operational Resilience
Spatial financeWhere capital meets hazard, exposure and transition
Critical business services
Operational resilience starts by deciding which services matter most: payments, account access, claims payment, trading, custody. Firms map the people, processes, technology, facilities and suppliers each service depends on, and set how much disruption is tolerable. This page sets out how critical services are identified and protected, where mapping fails, the records involved, and who decides.
Critical business services in seven parts.
- 01The questionCritical business services: how the risk develops
- 02IndicatorsWhat is measured, and how well
- 03SourcesWhere the evidence comes from
- 04DecisionsWho decides, and what the evidence serves
- 05Core questionsWhat service identification asks
- 06MechanismsWhy service-based thinking matters
- 07Methods and limitsHow services are identified and mapped
Critical business services: how the risk develops.
Identifying service continuity outcomes. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Services, not systems
Resilience is judged by whether customers and markets receive a service, not whether a single system runs. A firm can keep systems up and still fail the service.
Hidden dependencies
Mapping often stops at the first layer. Shared data centres, single staff with key knowledge and subcontracted suppliers stay hidden until they fail.
Tolerances set the bar
Impact tolerances define the maximum acceptable outage or data loss. Tolerances set too loosely let investment decisions ignore resilience gaps.
Boards own the outcome
Boards approve important services and tolerances. Where they delegate this entirely, resilience is treated as an IT matter rather than a service promise.
Settlement dependencies, and what fails with a node.
How a failure at one financial centre can spread through settlement links. Design links, not real dependencies.
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Important business services identified | count | annual | Firm self-assessments | DECLARED |
| Impact tolerances set | time or volume per service | annual | Firm self-assessments | DECLARED |
| Services mapped to all dependency layers | share of important services | annual | Mapping records | DECLARED |
| Services within tolerance in severe scenario tests | share of services tested | annual | Scenario test records | DECLARED |
| Single points of failure identified | count per service | annual | Mapping records | DECLARED |
| Remediation investment for resilience gaps | currency | annual | Firm plans | DECLARED |
Important business services.
The screen a team would use to follow this subject: its measures, states and decisions. Names are examples and values are illustrative.
Important business services
Critical business services · Bank B services · Self-assessment 1
Services vs impact tolerance
| Make a payment | 3 | 2 | Cloud region loss | Outside |
| Access cash | 12 | 15 | Cyber attack | Within |
| Mortgage servicing | 60 | 45 | Data centre loss | Within |
| Claims payment | 41 | 54 | Third-party failure | Outside |
Dependency map
people · process · technology · third parties
Remediation
- R-1Second claims platform supplierExit plan tested176 d
- R-2Immutable backups for paymentsCyber recovery50 d
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| Bank of England, PRA and FCA operational resilience policy and statements | Requirements and supervisory observations | Free, Bank of England and FCA terms |
| BCBS Principles for Operational Resilience | International expectations for banks | Free, BIS terms |
| DORA regulatory technical standards | EU requirements for ICT risk and critical functions | Free, EU reuse terms |
| IOSCO and IAIS operational resilience reports | Expectations for securities and insurance firms | Free, IOSCO and IAIS terms |
| Supervisory thematic review findings | Observations on firms' implementation | Free, terms per supervisor |
Trace a shock in critical business services to the balance sheet.
Assembled from the Nexus Standards area profile Cyber resilience and digital operational resilience: the shocks it names, the systems and sectors that carry the loss, the controls that dampen it and the data that observe it. Pick an initiating shock and step through the cascade to see which exposures it reaches and where losses could concentrate. The Map view places the run on an example geography with open data. Every weight is a stated assumption. An exercise, not a forecast, a valuation, a rating or investment advice. To model a place of your own choosing, open the full System Builder.
Hazards
- Dam failure
- River flood (set off downstream)
- Flash flood (set off downstream)
- Mass displacement (set off downstream)
- Widespread power outage (set off downstream)
- Water supply shortfall (set off downstream)
Systems and couplings
Controls
NS-0Constitution and principlesNS-9Contextual UNIs (deployments, instances, programme instances)NS-10Policies and clauses (machine-readable obligations: definition, binding, evaluation and enforcement)NS-11Verification and monitoring (evidence, attestations, zero-trust conformance observation)NS-12Software, model and AI/ML artefacts (supply chain, model cards, dataset sheets)NRS-X6Cyber and digital security riskNRS-H54Hazard family: Signal and platform disruption (NHS-1 cyber.platform)NRS-P10Third-party, outsourcing and concentration riskNRS-H107Hazard family: Digital infrastructure concentration and monoculture (NHS-1 tech.digital-concentration)NRS-K31Domain pack profile: Cyber national resilience (DOMAIN-031)NRS-S7System profile: NXS-EOP (Earth observation and digital twins)
Observation
- Known Exploited Vulnerabilities catalogue (listed for reference)
- National Vulnerability Database (CVE enrichment API) (listed for reference)
- OSV open source vulnerability database (listed for reference)
- Proportion of population covered by a mobile network, by technology
Example geography
- North America: 243 hexagonal cells
- Night lights tonight, outages (VIIRS Day/Night Band), NASA GIBS
- Surface water through cloud, 30 m (OPERA DSWx-S1 radar), NASA GIBS
- Rain rate, last half hour (IMERG), NASA GIBS
- Surface soil moisture (SMAP), NASA GIBS
Who decides, and what the evidence serves.
Financial Cyber and Operational Resilience prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Boards | Which services are important and what tolerances apply | Service maps, harm analysis and test results |
| Prudential and conduct supervisors | Whether firms' services and tolerances are credible | Self-assessments and thematic review findings |
| Chief operating and technology officers | Which resilience gaps to fix first | Mapping, scenario results and cost evidence |
| Internal audit | Whether mapping and testing are complete and reliable | Mapping records and test evidence |
Outputs this topic produces
- Guide to identifying important business services and impact tolerances
- Method note on mapping dependencies beyond the first layer
- Brief on supervisory observations about tolerance setting
- Questions for boards approving important services
What critical business services means for exposure, loss and capital.
The exposure, loss, scenario and capital views a risk officer, supervisor or ministry of finance would ask for, with the frameworks they report against. Structures follow supervisory and actuarial practice. Values are illustrative: never prices, ratings or advice.
Transmission channels
How a shock in critical business services reaches credit, market, underwriting, liquidity and operational risk, and feeds back.
What service identification asks.
- Which services, if disrupted, would cause intolerable harm, and to whom: individual customers, markets or the wider economy?
- What is the maximum tolerable disruption for each, in time or volume?
- Which people, processes, technology, facilities, data and third parties does each service depend on?
- Which services matter for the financial system, not just for the firm?
Why service-based thinking matters.
Firms historically organised resilience around systems and departments. Customers experience services, which cut across many systems and departments, so a service view reveals dependencies that a systems view misses.
Harm to people
Defining services by the harm their loss would cause keeps attention on customers and markets.
End-to-end view
A service view traces every dependency, including third parties, rather than stopping at the firm's boundary.
Focus
Identifying what matters most directs investment where disruption would hurt most.
How services are identified and mapped.
- 01
Impact analysis
Assessing the harm of disruption over time for each service. Limits: harm to the wider system is hard to estimate from inside one firm.
- 02
Dependency mapping
Tracing resources each service needs, using reliability and resilience engineering. Limits: maps become outdated as systems change.
- 03
Tolerance setting
Defining maximum tolerable disruption. Limits: requires judgement and can be set to fit current capability rather than real harm.
- 04
Sector-level aggregation
Identifying services that are critical across the industry, using network science. Limits: depends on comparable definitions across firms.
How it is studied, and what the methods cannot say.
- 01Reliability and resilience engineeringService and dependency mapping · Recovery strategy comparison · Learning reviewsApplied here
- 02Network science and contagionSector dependency maps · Outage propagation · Software component networksApplied here
- 03Cybersecurity and cryptographyIdentity and privileged access · Detection and response capability · Threat-led testingApplied here
Questions and answers.
What is an important business service?
How is an impact tolerance different from a recovery time objective?
Why map people and facilities as well as technology?
Is an important business service the same as a critical system?
Who sets impact tolerances?
Does the platform review firms' service lists?
Why look at services across the whole sector?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GRASend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGlobal Risks AllianceSee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.