Home / Lines
The 20 lines
Resilience runs along a service: the service is named, its dependencies are mapped, its tolerance is set, and it is tested, recovered, and evidenced. Each line is one cluster of guides, completed whole.
Line 01 - Foundations line Operational resilience foundations What operational resilience means, how it differs from cybersecurity alone, and how the backbone of this site runs: service, dependency, disruption, tolerance, test, recovery, evidence. (14 guides) Line 02 - Service line Important business services How to identify the services whose disruption would cause intolerable harm, who uses them, and where the boundary of a service sits. (11 guides) Line 03 - Mapping line Service mapping and dependencies Mapping a service to the people, processes, technology, data and third parties it actually depends on, so a disruption has a traceable path. (16 guides) Line 04 - Tolerance line Impact tolerances Setting a tolerance for each important service: how much disruption, for how long, and with what data loss, before harm becomes intolerable. (9 guides) Line 05 - Risk line ICT risk management The ICT risk management framework at the centre of DORA: identifying, protecting, detecting, responding and recovering, as one joined-up system. (13 guides) Line 06 - Incident line Incident management and reporting Classifying an ICT-related incident, managing it while the service is down, and reporting it to the right authority in the right phase. (15 guides) Line 07 - Testing line Digital operational resilience testing Testing whether resilience works before a real disruption tests it: proportionate testing programmes, from tabletop work to live exercises. (10 guides) Line 08 - Threat-led line Threat-led penetration testing Threat-led penetration testing under DORA: what it is, who it applies to, how a test is scoped, and what happens to its findings. (14 guides) Line 09 - Third-party line ICT third-party risk Managing the risk that arrives with a supplier: selection, contracting, oversight, exit, and the difference between a supplier and a dependency. (12 guides) Line 10 - Outsourcing line Outsourcing and cloud dependencies Outsourcing and cloud: where responsibility stays with the firm even when the system sits elsewhere, and how concentration creeps in. (16 guides) Line 11 - Concentration line Concentration risk and critical third parties When many services lean on one provider, one region, or one technology: measuring concentration and the oversight framework for critical providers. (9 guides) Line 12 - Register line Register of information The register of information DORA requires: what it records about ICT third-party arrangements, how it is kept, and who it is reported to. (13 guides) Line 13 - Continuity line Business continuity and disaster recovery Business continuity plans and disaster recovery that are written for a service, not for a building: restoring the service within its tolerance. (15 guides) Line 14 - Recovery line Cyber recovery and restoration Recovering after a cyber incident: clean restoration, data integrity, sequencing, and the decision to bring a service back. (11 guides) Line 15 - Governance line Governance, board oversight and accountability Who owns resilience at board level, what the board must approve and review, and how accountability is evidenced rather than asserted. (14 guides) Line 16 - DORA line The DORA regime in full DORA as a whole regime: scope, proportionality, chapters, technical standards, application dates, and how the pieces fit together. (10 guides) Line 17 - UK line FCA and PRA operational resilience The UK regime, labelled as a separate regime throughout: FCA and PRA operational resilience, its own policy statements, dates and expectations. (16 guides) Line 18 - Sector line Operational resilience by sector How the same backbone plays out differently in banking, insurance, payments, asset management, fintech, and for ICT providers themselves. (12 guides) Line 19 - Scenario line Scenario testing and exercises Severe but plausible scenarios, exercises that rehearse them, and the lessons that change a plan instead of sitting in a report. (13 guides) Line 20 - Evidence line Evidence, audit and readiness Proving resilience to a regulator, an auditor, or a board: evidence trails, examinations, self-assessment, and the gaps that recur most often. (15 guides)