Recommended Free Tools
Build operational resilience by identifying the services whose disruption could cause serious harm, setting clear limits for tolerable disruption, mapping the dependencies behind each service, and testing whether the organization can continue or recover delivery under severe but plausible scenarios. Treat the work as an ongoing management capability—not a document that guarantees incidents will not happen. The steps below are intended for business leaders and risk, continuity, and technology professionals; financial-sector rules discussed here apply only to specified entities and jurisdictions.
1. Give resilience clear ownership and connect it to strategy
Assign senior accountability, then link resilience work to operational risk management, technology and change management, business continuity, supplier oversight, and strategic planning. A standalone continuity plan cannot by itself resolve conflicting priorities or secure investment when a test exposes a weakness.
The Basel Committee describes operational resilience as an outcome supported by effective operational-risk management, preparedness, and the ability to respond and recover. The FCA likewise expects effective frameworks to be embedded in enterprise-wide risk management, change management, and strategic planning. The Basel consolidated-guidelines page is marked as a draft under consultation and says its operational-resilience chapter is based on the Committee’s March 2021 principles; do not treat that draft consolidation as a final rule. Basel Committee on Banking Supervision, Operational resilience; FCA, insights and observations.
2. Prioritize services according to the harm an interruption could cause
Start with the services delivered to customers, markets, or other recipients—not with a general inventory of technology assets. Identify which interruptions could cause material customer harm, threaten market integrity or financial stability, or create serious consequences for the organization. Not every internal activity needs the same level of resilience effort.
#1 Best Overall
For FCA-regulated firms, the relevant term is important business service: a service whose disruption could cause intolerable harm to clients or threaten market integrity or financial stability. That is a UK regulatory concept, not a universal label for every organization. Outside that framework, use the same harm-based logic while applying the organization’s own obligations and risk criteria. FCA, Operational resilience.
3. Define how much disruption each prioritized service can withstand
For every prioritized service, set a disruption threshold that marks when the resulting harm becomes unacceptable. Explain the assumptions behind it: who would be affected, which transactions or outcomes matter, and why the chosen boundary represents a meaningful limit. A threshold without that rationale is difficult to use when leaders must decide whether to invoke a workaround, divert capacity, or escalate an incident.
In the FCA framework, this threshold is an impact tolerance. It is related to, but not interchangeable with, a recovery-time objective. A time target may be part of the tolerance, but a time-only measure can miss the scale or nature of the impact. A recovery objective may need to be shorter than the impact tolerance so that restoring processing and addressing customer backlogs can happen before the broader threshold is reached. FCA, Operational resilience; FCA, insights and observations.
Rank #2
| Measure | What it helps answer | Example of what to define |
|---|---|---|
| Time | How long can delivery be disrupted before harm becomes unacceptable? | The maximum disruption period, with the assumptions that make that duration tolerable. |
| Customer or transaction impact | Who or what is affected, and at what scale? | Customer groups, transaction volumes, or transaction types that would cross the harm threshold. |
| Financial or market threshold | What level of financial impact or market effect would be unacceptable? | A reasoned financial threshold or market-integrity concern relevant to the service. |
These are possible dimensions, not a prescribed formula. Select measures that expose the harm relevant to the service and explain how they work together.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →4. Map the dependencies needed to deliver each service
Map each prioritized service end to end, at enough detail to reveal vulnerabilities and support realistic tests. Include the resources and dependencies that keep delivery working:
- People, including key roles and scarce expertise.
- Processes and operational handoffs.
- Technology and information.
- Facilities and other resources needed to operate.
- Internal dependencies, external suppliers, and, where known, subcontractors or shared-provider dependencies.
Use the map to identify single points of failure, concentrated dependencies, unsupported manual workarounds, and chains in which one failure could interrupt several services. The FCA has identified incomplete mapping and third-party vulnerabilities as areas for continued improvement. Mapping should be detailed enough to support decisions and testing, not expanded merely to produce more documentation. Basel Committee on Banking Supervision, Operational resilience; FCA, insights and observations one year on.
Rank #3
5. Test severe but plausible disruption scenarios
Build exercises around the vulnerabilities in the maps and the threats that could affect service delivery. Vary the event, its severity and duration, and the resources it affects. Depending on the organization, scenarios may include a cyber incident, technology failure, loss of key people or facilities, or disruption at a supplier.
Test whether the organization can continue or restore the service within its reasoned tolerance—not simply whether a written plan exists. Record what happened, which workarounds were used, how communications worked, and where the response fell short. Assign owners and funding to remediation so that test findings change the actual resilience of the service. Basel guidance calls for continuity exercises under severe but plausible scenarios; FCA observations emphasize using testing to support resilience evidence and remediation. Basel Committee on Banking Supervision, Operational resilience; FCA, insights and observations.
| Scenario dimension | Decision to make when designing an exercise |
|---|---|
| Event type | Which mapped vulnerability or plausible threat is being tested? |
| Severity and duration | How demanding is the disruption, and how long does it persist? |
| Affected resources | Which people, technology, facilities, information, or providers are unavailable? |
| Service scope | Does the exercise test one service, or several services that share resources? |
Testing only one service in isolation can overlook correlated effects when multiple services depend on the same people, technology, or provider. Include shared-resource scenarios where the maps show that one disruption could affect more than one prioritized service. FCA, insights and observations.
Rank #4
6. Prepare response, recovery, and communications
Make sure people know who can declare and lead a response, when to escalate, who can make consequential decisions, and who takes over if a key decision-maker is unavailable. Keep response and recovery resources identifiable, including internal teams and relevant third parties.
Coordinate business continuity, disaster recovery, cybersecurity, supplier contingency, and crisis-management procedures so they work together during an incident. Specify how the organization will communicate with affected stakeholders, and review and test the procedures. Use lessons from the organization’s own incidents and relevant incidents elsewhere to address root causes and reduce the risk of recurrence. Basel Committee on Banking Supervision, Operational resilience.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Keep the framework current and close the gaps tests reveal
Review service definitions, tolerances, dependency maps, scenarios, and plans on a regular schedule and after material change. Track remediation to closure, and use the gaps found in mapping and testing to inform investment choices. Update assumptions when incident experience shows that a tolerance or recovery approach does not reflect actual service impact.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Best Value
FCA supervisory observations call for review at least annually or after material change. Its March 2026 observations describe stronger practice where incident experience informs tolerance calibration, while identifying mapping gaps and third-party vulnerabilities as continuing improvement areas. Those observations concern the FCA’s framework and supervisory context; organizations elsewhere should follow their applicable requirements and risk governance. FCA, insights and observations one year on.
What the FCA timetable means for firms in scope
The FCA rules apply to specified UK financial firms and financial market entities, including banks, building societies, some investment firms and insurers, recognized investment exchanges, certain enhanced-scope SM&CR firms, specified payment and electronic-money entities, consolidated tape providers, and qualifying cryptoasset firms. The FCA page says the rules came into force on 31 March 2022. Firms in scope had until 31 March 2025 to complete mapping and testing and be able to remain within their impact tolerances.
As of the FCA page’s update on 15 September 2026, new incident-reporting and third-party-notification requirements are due to take effect on 18 March 2027. Confirm the current rules and whether a particular entity is in scope before using these dates for compliance planning; they are not general deadlines for every organization. FCA, Operational resilience.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute
