For financial services firms, cyber security is no longer just an IT matter. Regulators expect firms to show that their most important services can withstand and recover from severe disruption, and a cyber attack is one of the most likely causes.
The UK operational resilience framework
The FCA, PRA and Bank of England introduced operational resilience rules in 2021, with firms required to be able to stay within their impact tolerances by 31 March 2025. In short, firms need to:
- Identify their important business services
- Set impact tolerances: the maximum tolerable disruption for each service
- Map the people, processes, technology and third parties behind each service
- Test their ability to stay within tolerance under severe but plausible scenarios
- Keep a self-assessment and act on what testing reveals
Cyber scenarios, such as ransomware taking core systems offline or a key supplier being compromised, are central to that testing.
DORA for firms serving the EU
The EU’s Digital Operational Resilience Act (DORA) has applied since 17 January 2025 to many EU financial entities and their critical ICT providers. It covers ICT risk management, incident reporting, digital operational resilience testing and third-party risk. UK firms with EU operations or clients should check whether it applies to them.
What boards need to see
Across these frameworks, the common thread is evidence. Boards and regulators want to see that resilience has been tested, not just documented:
- A tested incident response plan, with clear roles and escalation
- Scenario exercises involving senior decision-makers
- Independent technical testing of key systems
- Oversight of the third parties important services depend on
- Monitoring that would detect an attack quickly
- Lessons learned that feed back into improvements
Where CyberQ helps
Our Board Cyber Crisis Simulation puts your leadership team through a realistic scenario and gives you documented findings. Penetration testing provides independent evidence that key systems hold up. Third-party supplier risk management helps you understand the suppliers your services depend on, and Managed XDR gives you 24/7 detection and response.
Your compliance and legal teams own the overall programme; we help you build and evidence the cyber elements. Read more about our work with financial services firms.
Cyber scenarios worth testing
Severe but plausible scenarios help you test whether important business services can stay within tolerance. Cyber examples include:
- Ransomware encrypting a core platform and its backups
- Compromise of a key outsourced provider or software supplier
- Theft of client data followed by an extortion demand
- Payment fraud through business email compromise
- A prolonged outage of a critical cloud service
Each scenario should test decision-making as well as technology: who decides, how quickly, and with what information.
Turning findings into evidence
The value of testing lies in what you do next. Record what each exercise or test found, assign owners and deadlines to the actions, and track them to completion. That trail of findings, actions and improvements is exactly what boards, auditors and regulators want to see.
Talk to us about resilience testing
Book a call to discuss crisis simulations, testing and evidence for your board.
