About the Continuity Desk
OperationalResilience.help is an independent publication about one job: keeping important business services running through disruption, and bringing them back within a stated tolerance when they stop.
The regulation in this field is written for lawyers and supervisors. The people who must live with it are mostly not lawyers: they run a payments service, a claims platform, a trading system, or the team that keeps those services up at 3 a.m. This desk exists to close that gap. It reads the regulation text, the technical standards, and the regulators' policy statements, and explains, service by service, what must be identified, mapped, tolerated, tested, recovered, and evidenced.
Three sites, three different jobs
Readers often arrive here from two neighbouring sites in the same fleet, and the distinction matters. The Cyber Resilience Act site (cyberresilienceact.help) is about product cybersecurity: whether a product with digital elements is secure by design and supported through its life. The NIS2 site (nis2compliance.digital) is about organisational cybersecurity and risk-management obligations: how an organisation governs cyber risk. This site is different again. Operational resilience is about continuity of important services through disruption, whatever the cause: a cyber attack, a supplier failure, a bad change, a flood, or a data corruption. A service can be cyber-secure on paper and still fail its users for hours; this desk is about the hours, the tolerance, and the recovery.
Two regimes, kept apart
Most guides here explain DORA, Regulation (EU) 2022/2554, which applies from 17 January 2025. A separate line explains the UK regime, FCA and PRA operational resilience, under its own policy statements. The two regimes are never merged in a guide: a DORA duty is labelled DORA, a UK duty is labelled UK, and a comparison guide keeps the two columns apart. Where a regime provides proportionality by size or risk, the guide says so; where it does not, the guide does not invent it.
What we are not
We are not a regulator, a consultancy, or a law firm, and nothing here is compliance advice or a compliance determination for any individual firm. Where a guide states an obligation, it attributes the statement to the regime that creates it, so a reader can check the claim against the source in one step. Firms deciding their own position should take advice on their own facts. Nothing here promises a resilience outcome: a plan, a test, or a tool does not guarantee that a service will stay up.
How guides are made
Each guide is written from primary sources, carries the date it was last checked, and opens with a service check summarising the regime reference, the obligation, the start date, and who acts. If a regime changes, the affected guides change and the corrections page records it. If we get something wrong, the same page is where the fix is announced.
Preferred sources
If these guides are useful to you, you can add OperationalResilience.help to your preferred sources in Google so its pages are surfaced for you more often: add this site to preferred sources.