Operational resilience is the ability of an organisation to prevent, adapt to, respond to, recover from and learn from operational disruption, so that the services customers rely on keep working. UK regulators now treat it as a board-level obligation, not an IT housekeeping task.
In practice, an operationally resilient firm can do four things:
- Anticipate the disruptions that could stop its important services
- Withstand them by staying within an agreed level of harm
- Recover services within a tolerance the business has set in advance
- Adapt and learn so the same disruption does not bite twice
The shift the regulators have made is subtle but important. Instead of asking “are your systems secure?”, they now ask “if a service fails, how badly will customers and the market be harmed, and can you prove you will stay inside the limit you set?”
What is operational resilience?
Operational resilience is an outcome, not a control. It is the assurance that an organisation can continue to deliver its most important services through disruption, whether that disruption is a cyber attack, a third-party outage, a failed change or a natural event. It assumes disruption will happen and focuses on limiting the harm, rather than trying to prevent every incident.
That makes it broader than IT disaster recovery and more specific than general risk management. It is concerned with the end-to-end service a customer receives, and with the people, processes, technology, facilities and suppliers that sit behind it.
Start your free trial
Want to explore?
Sign up for your free trial today and get hands on with all the compliance features that ISMS.online has to offer
What are the UK operational resilience regulations?
The UK has one of the most developed operational resilience regimes in the world. If you operate in financial services, several rules apply at once, and they share the same underlying logic.
| Regulation | Who it applies to | What it requires |
|---|---|---|
| FCA PS21/3 | FCA-regulated firms (banks, insurers, investment firms, payment and e-money firms) | Identify important business services, set impact tolerances, map and test, with full compliance expected from 31 March 2025 |
| PRA SS1/21 | Banks, building societies and PRA-designated investment firms | The PRA’s matching expectations on operational resilience, supervised alongside the FCA |
| Bank of England | Financial market infrastructure (payment systems, CCPs, CSDs) | Operational resilience expectations for the firms that keep the financial system running |
| DORA | EU financial entities and their ICT providers, including UK firms serving the EU | ICT risk management, incident reporting, resilience testing and third-party risk, in force since January 2025 |
The direction of travel is consistent: more sectors, more scrutiny of third parties, and a stronger expectation that you can evidence resilience rather than assert it. The threat-led testing approach the Bank of England uses through CBEST is spreading the same evidence-first mindset across the industry.
How do you build operational resilience?
UK regulators set out a clear method, and it works just as well outside financial services. There are five steps:
- Identify your important business services: the services that, if disrupted, would cause real harm to customers or the market.
- Set impact tolerances: the maximum level of disruption each service can take before that harm becomes intolerable, usually expressed as a time limit.
- Map: document the people, processes, technology, facilities and suppliers each service depends on.
- Test: run severe but plausible scenarios to see whether you stay within tolerance.
- Self-assess and evidence: record what you found, fix the gaps and keep a current, defensible self-assessment.
Manage all your compliance, all in one place
ISMS.online supports over 100 standards and regulations, giving you a single platform for all your compliance needs.
Operational resilience vs business continuity
The two are related but not the same. Business continuity is one of the capabilities that delivers operational resilience: it focuses on keeping critical processes running and recovering them after an incident, and it is anchored in ISO 22301. Operational resilience is the wider, outcome-focused discipline that sets the impact tolerances continuity then has to meet. See business resilience vs business continuity for the full comparison.
How operational resilience fits into business resilience
Operational resilience answers a specific question: can your services keep running? Business resilience is the broader picture, and it is where most disruption now originates, in security, privacy and AI risk. Manage those three as one system, the Resilience Loop, and operational resilience becomes far easier to achieve, because you are tackling the causes of disruption, not just rehearsing the response.
That is why operational resilience is the gateway to business resilience, and why the financial firms furthest ahead on PS21/3 are also the ones investing in connected, certifiable governance. Our resilience for financial services guide goes deeper on the sector.
Why choose ISMS.online for operational resilience?
Most tools help you tick boxes. ISMS.online helps you build resilience you can prove.
- One connected system: manage information security, data privacy and AI governance together in a single platform, not three disconnected tools.
- Certifiable by design: every action maps to ISO 27001, ISO 27701, ISO 42001 and ISO 22301, so your resilience is provable.
- Evidence on demand: show regulators, auditors and customers proof of resilience, not promises.
- Informed by deep expertise: guided implementation from real specialists, not no touch automation that hides the risk.
- Continuous, not periodic: a live view of your risk and controls, instead of an annual scramble before an audit.
- Built for regulated markets: designed for organisations where security, privacy and trust drive the buying decision.
Explore the ISMS.online business resilience platform to see how it works in practice.
FAQs
What is operational resilience in simple terms?
Operational resilience is your ability to keep delivering the services people depend on, even when something goes wrong. It assumes disruption will happen and focuses on limiting the harm and recovering quickly, rather than trying to prevent every single incident.
What is an impact tolerance?
An impact tolerance is the maximum amount of disruption an important business service can take before it causes intolerable harm to customers or the market. It is usually set as a time limit, for example the longest a payment service can be unavailable, and it gives the business a clear target to test against.
Does DORA apply to UK firms?
It can. DORA applies to EU financial entities and the ICT providers that serve them, so UK firms with EU operations or EU clients are often in scope. UK firms also have their own regime through the FCA and PRA, so most are managing both at once.
What is the difference between operational resilience and cyber resilience?
Cyber resilience is about withstanding and recovering from cyber attacks specifically. Operational resilience is broader: it covers any disruption to important services, whether the cause is a cyber attack, a supplier failure, a system outage or a physical event. Cyber resilience is one input to operational resilience.
