Operational resilience is the ability to continue delivering critical services during disruption.
It extends beyond the recovery of individual systems or facilities. It considers how people, processes, technology, data, premises and third parties work together to support services relied upon by customers, citizens, regulators and markets.
Identify critical services
Operational resilience begins with the service delivered, not the department or system.
Examples may include payments, claims processing, public-service delivery, investment operations or critical infrastructure.
A service should be considered critical where prolonged disruption could cause material harm to customers, the organisation or wider society.
Map dependencies
Once critical services are identified, organisations should map the resources required to deliver them.
These may include:
⦁ Processes.
⦁ Employees.
⦁ Applications.
⦁ Data.
⦁ Facilities.
⦁ Third parties.
⦁ Communication channels.
⦁ Internal services.
Mapping can reveal concentration risks, hidden dependencies and single points of failure.
Set impact tolerances
An impact tolerance defines the maximum disruption the organisation is prepared to accept before unacceptable harm occurs.
It may consider duration, customer impact, transaction volumes, financial loss, data loss, regulation, reputation and safety.
Impact tolerances differ from system recovery targets because critical services usually depend on multiple resources.
Assess vulnerabilities
The organisation should test whether current arrangements can keep each critical service within tolerance.
This includes reviewing controls, recovery capability, workforce capacity, third parties, workarounds, communication, data availability and cyber exposure.
Test severe scenarios
Testing should consider disruption across multiple dependencies, such as cyber incidents, supplier failure, technology outages, loss of premises, workforce unavailability or data corruption.
The Falconry approach
Falconry Solutions brings together operational resilience, business continuity, crisis management, cyber resilience and third-party risk.
Our practitioners support critical-service identification, dependency mapping, impact tolerances, vulnerability assessments, resilience strategies and testing.
Falconry is different from approaches that focus only on plans or individual systems. We examine the end-to-end service and the leadership decisions required to maintain it.
Falconry360 can connect services, dependencies, risks, plans, incidents, tests and remediation. Managed resilience services can support ongoing maintenance and testing, while Falconry Academy can build capability through role-based training and simulations.
The result is a resilience programme focused on protecting services that matter most.
