Cyber and operational
Critical financial services now depend on a dense web of digital infrastructure: cloud platforms, payment networks, data centres, software suppliers and telecommunications. A cyber incident or outage at one shared provider can interrupt many institutions at once. The Global Risks Alliance (GRA) examines how cyber and operational events become financial losses and service failures across the industry, and what evidence would show the dependencies before they fail. It reviews no firm's own controls. See Financial-system risk.
- 01InstitutionThe Global Risks Alliance (GRA)
- 02Service levelR0: information and enquiries
- 03In briefThe short answer
- 04TransmissionHow a cyber or operational event reaches finance
- 05Supervisory frameOperational resilience is now law in several markets
- 06Dependency mappingFrom one provider to many institutions
- 07QuestionsShared questions GRA works on
GRA · Institution · service level R0
The short answer.
Cyber and operational risk in finance is the potential for a cyber incident or outage at one shared provider, such as a cloud platform, payment network or software supplier, to interrupt many institutions at once. GRA examines how such events become financial losses and service failures across the industry; it performs no security review.
Settlement dependencies, and what fails with a node.
How a failure at one financial centre can spread through settlement links. Design links, not real dependencies.
How a cyber or operational event reaches finance.
| Channel | How the shock reaches finance |
|---|---|
| Service outage | Payments, trading or customer services stop, with direct losses and loss of confidence |
| Third-party concentration | Many institutions depend on the same cloud, software or network provider |
| Fraud loss | Intrusions enable theft or fraudulent transactions |
| Insurance accumulation | Cyber and business-interruption claims arrive across many policies from one event |
| Public services | Disrupted payments reach benefits, tax collection and public services |
Channels describe mechanisms, not measured strengths or probabilities.
Operational resilience is now law in several markets.
| Instrument | Body | Core requirement |
|---|---|---|
| Principles for Operational Resilience (2021) | Basel Committee | Identify critical operations, map their interconnections and dependencies, and set tolerance for disruption |
| Digital Operational Resilience Act (DORA) | European Union, applying from 17 January 2025 | ICT risk management, incident reporting, threat-led penetration testing and an oversight regime for critical ICT third-party providers |
| Third-party risk management toolkit (2023) | Financial Stability Board | Common terms for critical services and concentration in third-party providers |
| Cyber Lexicon and FIRE incident reporting format | Financial Stability Board | Shared definitions and a common format so incident reports compare across authorities |
| Cyber resilience guidance for FMIs (2016) | CPMI-IOSCO | Recovery of critical operations within two hours of a disruption as a planning objective for FMIs |
From one provider to many institutions.
An operational shock becomes systemic when many firms share the same node: a cloud region, a payment processor, a messaging network, a market-data feed. GRA's method maps important business services to the third parties and physical sites that support them, then reads the map in reverse: which services across the sector fail together if one node fails. Data centres and cable landing stations are also physical assets, so the same map carries flood, heat and power-supply hazard.
The engineering evidence for those dependencies sits at GCRI cloud and third parties and GCRI interdependency and cascade; specialist work continues at Financial Cyber Resilience.
Shared questions GRA works on.
- 01
Mapping shared providers
Which providers would interrupt several institutions at once, and for how long, without exposing any firm's architecture?
- 02
Recovery assumptions
Are the recovery objectives institutions plan around consistent with what shared providers could deliver in a regional event?
- 03
Cyber accumulation
How could one incident trigger correlated claims across insurers writing cyber cover?
- 04
Infrastructure dependence
How do power, communications and data-centre failures combine with cyber events?
Industry evidence, never a security review.
- GRA does not test, audit or certify any institution's security controls.
- Security reports about GRA's own systems go to security@globalriskalliance.com, without exploit details or personal data in a first message.
- No member's confidential incident or architecture information is exchanged with another.
- Related: Payments and market infrastructure.
The same subject across the Consortium.
Financial Cyber and Operational Resilience
The specialist community, in development: Financial Cyber and Operational Resilience.
Cyber and digital resilience
Evidence from The Global Centre for Risk and Innovation (GCRI): Cyber and Digital Resilience.
Digital governance
Dialogue convened by The Global Risks Forum (GRF): AI and Digital Governance.
Terms used on this page.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Operational resilience | A firm's ability to prevent, adapt to, respond to, recover from and learn from operational disruption while keeping important business services running. |
| Cyber resilience | The ability to anticipate, withstand, recover from and adapt to adverse conditions, stresses and attacks on systems that use cyber resources, in NIST usage. |
| Critical third-party provider | A provider, such as a cloud company, whose failure could affect many financial institutions at once. |
| Impact tolerance | The maximum tolerable level of disruption to an important business service, set by the firm and used in supervisory resilience regimes. |
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
- BCBS Principles for Operational Resilience (2021)
- EU Digital Operational Resilience Act, Regulation 2022/2554 (applies from 17 January 2025)
- FSB toolkit on enhancing third-party risk management and oversight (December 2023)
- FSB Cyber Lexicon and format for incident reporting exchange (FIRE)
- CPMI-IOSCO Principles for Financial Market Infrastructures (2012) and cyber resilience guidance (2016)
Questions and answers.
Should we report a cyber incident to GRA?
Can institutions share incident data through GRA?
Who uses this work?
Why treat cyber and operational risk as systemic?
Around GRA.
Start with an enquiry.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.