Skip to content

Operational Resilience

What is Operational Resilience?

The ability of an organisation to continue to deliver critical operations through disruption. Operational resilience goes beyond business continuity to encompass prevention, adaptation, response, recovery, and learning.

Governance

Terms that appear alongside operational resilience

Each of these is named in at least one of the same controls as operational resilience. The number is how many controls name both.

Frameworks that govern operational resilience

NIST Cybersecurity Framework 2.0View framework →COBIT 2019View framework →ISO 27001:2022View framework →

What the standards actually require on operational resilience

Requirements naming operational resilience across 6 standards, quoted from the control text.

HKMA SPM6 controls

HKMA SPM Operational Risk + Resilience + Recovery + Outsourcing modules. OR OPERATIONAL RISK MANAGEMENT: (1) OR-1 Operational Risk Management - sound operational risk governance + risk identification + assessment + mitigation + monitoring + reporting + RCSA +...

HKMA-SPM-OR-RR-SA-OperationalResilience · HKMA SPM Operational Risk (OR-1), Operational Resilience (OR-2), Recovery Planning (RR-1), Outsourcing (SA-2) →
HKMA TM-G-14 controls

HKMA TM-G-1 adjacent modules covered in this framework's scope. TM-G-2 BUSINESS CONTINUITY PLANNING: (a) Business Continuity Governance (TM-G-2.2.1) - Board oversight + BCP committee + crisis management + RACI + ownership;

HKMA-TMG1-Adjacent-TMG2-TME1-OR2-BCP-eBanking-Resilience · TM-G-2 BCP + TM-E-1 e-Banking + OR-2 Operational Resilience Adjacent Modules →
DORA3 controls

Financial entities shall establish, maintain and review a sound and comprehensive digital operational resilience testing programme as an integral part of the ICT risk management framework, following a risk-based approach.

DORA-Art.24 · General requirements for the performance of digital operational resilience testing →
HKMA Cyber Resilience Assessment Framework (C-RAF)3 controls

HKMA C-RAF coordination with HKMA SPM Modules + international banking sectoral cybersecurity + 2024-2025 pipeline. HKMA SUPERVISORY POLICY MANUAL (SPM) MODULES: (a) TM-G-1 General Principles for Technology Risk Management (verified separately) - foundational t...

HKMA-CRAF-Coord-SPM-TM-G-1-Singapore-UK-Sectoral · HKMA C-RAF Coordination with HKMA SPM TM-G-1, Singapore MAS TRMG, UK FCA Operational Resilience and Sectoral Cybersecurity →
Japan FSA Cybersecurity Guidelines for Financial Institutions3 controls

Business Continuity + Cyber Resilience is core per FSA Cybersecurity Guidelines + intersects with FSA Operational Resilience Framework (2023) + BCBS Principles for Operational Resilience (March 2021) + CPMI-IOSCO Guidance on Cyber Resilience for FMIs.

JP-FSA-CYB-Business-Continuity-Cyber-Resilience-RTO-RPO-Backup-Immutable-Air-Gapped-Disaster-Recovery-Ransomware-Resistance · Japan FSA Cybersecurity Business Continuity + Cyber Resilience + RTO + RPO + Backup + Immutable + Air-Gapped + Disaster Recovery + Ransomware Resistance + Operational Resilience + Critical Function Mapping + FSA Operational Resilience Framework →
IRM Enterprise Risk Management Framework (Institute of Risk Management)2 controls

Project + Programme + Third Party + Resilience + Assurance operationalise risk management in specific contexts. (1) Project + Programme Risk Management: systematic application of risk management to projects + programmes per Association for Project Management (...

IRM-Project-Programme-ThirdParty-SupplyChain-Resilience-BCP-Crisis-AssuranceMapping-3LoD · IRM Project + Programme Risk + Third Party + Supply Chain Risk + Operational Resilience + BCP + Crisis Management + Assurance Mapping + Three Lines of Defence →

Questions people ask about operational resilience

What is Operational Resilience?
The ability of an organisation to continue to deliver critical operations through disruption. Operational resilience goes beyond business continuity to encompass prevention, adaptation, response, recovery, and learning.
Why is Operational Resilience important for compliance?
Operational Resilience is a key concept in Governance. Understanding operational resilience helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Operational Resilience?
Operational Resilience appears in the requirement text of HKMA SPM, HKMA TM-G-1, DORA, HKMA Cyber Resilience Assessment Framework (C-RAF), Japan FSA Cybersecurity Guidelines for Financial Institutions. Across these standards we have identified 21 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Operational Resilience?
Explore our compliance framework pages to see how operational resilience applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Operational Resilience applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.