What Is Operational Resilience
A plain explanation of operational resilience: what it means for an important service, how harm and recovery are judged, and why a patched system can still fail users.
Line 01: Operational resilience foundations
What operational resilience means, how it differs from cybersecurity alone, and how the backbone of this site runs: service, dependency, disruption, tolerance, test, recovery, evidence.
The line guide
Working guides on this line
From Policy to a Service That Recovers
How a resilience policy becomes a service that actually recovers: naming, mapping, tolerating, testing, fixing, and evidencing, in that order, for one named service.
How Regulators Test Resilience
How supervisors test operational resilience in practice: through service maps, tolerances, scenario evidence, and follow up, rather than through policy documents alone.
Intolerable Harm Explained
What intolerable harm means in operational resilience: the point at which a service disruption causes harm that a firm should not accept, judged before an incident happens.
Operational Resilience for Small Firms
How smaller firms approach operational resilience with fewer services, fewer people, and heavier reliance on suppliers, without copying a large firm programme.
Operational Resilience Glossary
Plain language explanations of the terms used across operational resilience: important services, tolerances, mapping, scenarios, and the evidence that ties them together.
Operational Resilience vs Business Continuity
How operational resilience differs from business continuity: one asks what harm users suffer when a service stops, the other plans how work resumes after disruption.
Operational Resilience vs Cyber Risk Management
How operational resilience differs from cyber risk management: cyber work reduces the chance and impact of attacks, while resilience asks whether users can still be served during one.
Resilience and Risk Appetite
How resilience tolerances relate to risk appetite: appetite describes the risks a firm is willing to take overall, while a tolerance states the harm a particular service must not suffer.
Resilience as a Board Question
Why operational resilience belongs on the board agenda: boards decide what harm is intolerable, what recovery is expected, and whether the evidence supports those decisions.
Resilience Culture and Ownership
How culture and ownership shape operational resilience: a service recovers when its owner is known, its people speak up about weakness, and lessons change the service.
Resilience Maturity Without Maturity Theatre
How to judge resilience maturity honestly: by recovery evidence for named services, not by levels, colours, or programme dashboards, and by whether recovery improves over time.
Severe but Plausible Scenarios Explained
What severe but plausible scenarios are, and how they are used in practice to test whether an important service can recover before harm becomes intolerable.
Why Services Not Systems Are the Unit
Why resilience is organised around services rather than systems: a service is what users receive, and a healthy system can still leave users unserved.