Operational Resilience Glossary

This glossary explains the working vocabulary of operational resilience in plain language, so that a reader can follow the other guides in this cluster without being misled by jargon. The central terms are important business service, impact tolerance, intolerable harm, mapping, severe but plausible scenario, and evidence, and each term describes a piece of the same discipline rather than a separate programme.

The discipline can be summarised in one sentence using those terms: a firm names an important business service, maps its dependencies, sets an impact tolerance that marks intolerable harm, tests the service against a severe but plausible scenario, and keeps evidence of what changed as a result. A reader who can follow that sentence can follow the rest of the cluster.

An important business service is a service whose disruption would cause serious harm to users or to the wider market, judged by the firm under the regime that applies to it. Importance is therefore a judgement about harm, not a judgement about revenue, system size, or internal prestige, and a service can be important even if it is technically modest.

The UK regime uses the language of important business services and impact tolerances, while DORA uses related language around ICT risk and digital resilience for financial entities. The labels differ by regime, and this guide keeps them separate, but both point to the same idea: some services matter enough that their recovery deserves explicit attention.

An impact tolerance is the maximum level of disruption to an important service that a firm is willing to accept, expressed in terms of the harm users would suffer, such as how long they are left without the service and how widely they are affected. It is set in advance, with reasoning, so that recovery during an incident can be judged against a decision made calmly rather than improvised under pressure.

Intolerable harm is the point beyond that tolerance, where the harm becomes unacceptable. The two terms belong together: a tolerance without a sense of intolerable harm is an arbitrary limit, and a discussion of harm without a tolerance gives no guidance for recovery order or escalation.

Mapping means tracing an important service end to end, from the user through channels, processes, systems, data, suppliers, and people, so that the firm can see what the service actually depends on. A map is useful when it reveals a dependency that a system list would hide, such as a supplier that supports both a service and its backup.

A severe but plausible scenario is a demanding but imaginable disruption used to test that mapped service, judged by whether the service recovers within its tolerance. Scenario testing is therefore not a generic disaster rehearsal. It is a service specific test, and its value lies in the owned changes it produces, not in the reassurance of having run it.

Evidence, in this context, means records that show a decision, a test, or a change for a particular service, rather than general programme documents. A service map, a tolerance with its reasoning, a scenario result with owned actions, and a follow up record showing those actions completed together form a chain that a reviewer can follow from service to outcome.

Evidence also includes incident records, where a real disruption shows what actually happened against the tolerance and what changed afterwards. A firm whose evidence consists only of policies and plans, with no test or incident learning attached to a service, has described an intention rather than demonstrated resilience.

When a new term appears in a resilience document, ask which service it refers to, what harm it concerns, and what evidence would show it. If the term cannot be tied to a service in that way, it may be jargon filling a gap where a service judgement should be.

This glossary is educational and does not define legal terms for any regime. Where a regime gives a term a specific meaning, the regime source should be checked, and the label for that regime kept with the term when it is used.