Operational Resilience Risk Management: Implementing PRA Supervisory Statement SS1/21 with ISO 22301 Business Continuity Controls

What does PRA SS1/21 require for operational resilience?

PRA Supervisory Statement SS1/21 mandates UK banks, building societies, and PRA-designated investment firms implement comprehensive operational resilience frameworks by March 31, 2025. The regulation requires firms to identify important business services, set impact tolerances for service disruption, conduct scenario testing, and maintain detailed response and recovery plans.

Unlike traditional business continuity approaches focused on facility-level disruptions, SS1/21 demands end-to-end service resilience across people, processes, technology, facilities, and third parties. Firms must demonstrate ability to remain within impact tolerances during severe but plausible disruption scenarios, including cyber attacks, technology failures, and supply chain interruptions.

Key requirements include mapping critical business services to supporting resources, establishing quantitative impact tolerance thresholds, conducting regular scenario testing with board oversight, and maintaining dynamic response capabilities that adapt to evolving threat landscapes.

How does ISO 22301 business continuity management support SS1/21 compliance?

ISO 22301 provides a systematic approach to business continuity management that directly aligns with SS1/21 operational resilience requirements. The standard's plan-do-check-act methodology supports the regulatory expectation for continuous improvement and adaptation to changing risk environments.

ISO 22301's business impact analysis requirements mirror SS1/21's important business service identification process, while the standard's risk assessment and treatment procedures support impact tolerance development. The framework's emphasis on testing, exercising, and continuous improvement directly addresses regulatory expectations for scenario testing and response capability validation.

Key Alignment Areas:

• Business impact analysis methodology for identifying critical services and dependencies
• Risk assessment processes for evaluating disruption scenarios and likelihood
• Continuity strategy development aligned with impact tolerance requirements
• Testing and exercise programs that demonstrate resilience capabilities
• Management system approach ensuring board-level oversight and accountability
• Continuous monitoring and improvement processes for adapting to emerging threats

What constitutes an important business service under SS1/21?