Operational resilience: What it is and solutions for how to build it

What is operational resilience?

Operational resilience is a company’s ability to withstand and recover from moments of business disruption. It ties together multiple disciplines, teams, processes, and tools. It encompasses a wide range of practices— — from identifying and preventing potential business disruptions, to limiting the impact of disruptions when they do occur, to remediating and recovering from them as quickly as possible. In short: iIt offers a holistic approach to keeping a business up -and -running no matter what happens.

Why is operational resilience important

It isn’t enough to define operational resilience. It’s important to know why it matters.

In short : Operational resilience risk has become everyone’s problem.

Every business now runs on digital functions and data, and must keep them available to maintain a minimal viable business. For example, a car manufacturer needs to know what parts they have in stock, and a bank needs to clear transactions within a certain window of time. Without these core functions and data, neither can conduct its business—and developing operational resilience keeps these core functions and data available.

Operational resilience is becoming more important every year. Instability and risk continue to increase in size and volume. Businesses face disruptions from a growing number of sources—from environmental and geopolitical events to cybersecurity attacks (especially ransomware incidents). While these events are impossible to predict, it is possible to develop operational risk resilience strategies to withstand and recover from them competently.

Damage to a business’ bottom line, eroding customer trust, and regulatory compliance failures are some of the problems caused by a lack of resilient operations. Investing in operational resilience today can help prevent these from happening in the future, making operational risk and resilience high-priority topics that every organization must care about.

How does operational resilience contribute to business value?

Operational resilience does more than just prevent problems—it can also help a company accelerate its innovation and transformation.

If a company knows that making changes won’t break its business and that its fundamental risks are covered, then it will produce more code, adopt more digital services and tools, and rapidly increase its customer base without fear of downtime.

Operational resilience also saves money over time by avoiding fines, disruptions to business, and lost revenue, which can be reinvested into growth programs.

While operational resilience can seem like an entirely reactive practice, it lays a secure groundwork for more proactive and aggressive change.

Who is responsible for operational resilience?

Operational resilience is a collaborative practice that touches many teams, leaders, and functional areas within an organization, including:

• Service awareness and visibility, led by the head of infrastructure services
• Risk management, led by IT and cyber risk management teams, and outsourcing and third-party risk management teams.
• Business continuity management, led by the head of business continuity
• Incident management, led by the security operations center (SOC) and head of operations
• Governance, led by head of IT compliance, legal teams, and procurement teams

Ultimately, responsibility falls on IT and cyber security teams, and their leaders— — the chief information officer (CIO), chief operating officer (COO), and chief security officer (CSO), who report on the topic to the rest of the C-suite and the board.

Operational resilience vs business continuity

Operational resilience and business continuity are not the same thing. Business continuity is one element within of operational resilience, but operational resilience encompasses a much broader set of practices and concerns.

Operational resilience vs disaster recovery

Operational resilience and disaster recovery are also two different things.

Disaster recovery mitigates the impact of physical disasters (like an earthquake taking out a business’ physical mainframe) or certain cyberattacks. In most disaster recovery plans, an organization may have two mainframes (or other data centers) that are completely interconnected and live. If one is taken offline by a disaster, they it can switch to the redundant system and continue with the same data and processes, uninterrupted.

This does not solve modern cyberattacks like ransomware that can infect multiple mainframes or data centers at the same time. Operational resilience solves this problem by introducing additional measures like a third, air-gapped mainframe or data center that’s separated from the first two and won't receive malicious code. While disaster recovery is still necessary, it is no longer sufficient on its own to maintain operations.

What are the 5 pillars of operational resilience?

Operational resilience is a flexible, holistic practice that can incorporate many activities. Yet most practices are built around the following operational resilience pillars.

1. Identify. Understanding risk, the interconnection between systems, likely sources of disruption, and what happens if they occur.
2. Detect. Establishing safeguards and defenses to notice disruptions in real- time, and to understand their potential impact.
3. Protect. Mitigating disruptions to prevent their spread and reduce their impact, including limiting their potential impact before they occur.
4. Respond. Performing well-defined response mechanisms and protocols to eliminate the disruption and evict any threats as quickly as possible.
5. Recover. Restoringe data, functions, and normal business operations, and learning from the incident to prevent it from happening again.

These are not the only potential pillars of operational resilience. It is also possible to create a more granular understanding, to define common causes for failure for each pillar of operational resilience, and to overall make the concept as actionable as possible. Yet these five provide an efficient understanding of how to bring the concept to life.

Further, they can provide a high-level way to perform operational resilience mapping and, operational resilience gap analysis, and to see where a business might need to invest in their its operational resilience program.

Operational resilience in banking and financial services

Operational resilience is important for organizations in every industry. Everyone needs to be able to maintain their core digital business functions and data at all times.

However, operational resilience is particularly important in banking and financial services, — which includes traditional banks, bitcoin exchanges, bettering exchanges, and any institutionone else that handles money in a digital state. These organizations must be able to keep up-to-date account balances, move money, and clear accounts within a specific time period (generally by close of business each day).

Operational resilience in financial services is important. If a banking or financial company fails to maintain its services, it will lose business, customers, and customer trust, and face steep fines associated with new and increasing regulatory requirements.

What is the Digital Operational Resilience Act (DORA)?

The Digital Operational Resilience Act (DORA) is a comprehensive EU regulation. It’s designed to improve operational resilience, standardize incident response protocols, provide guidance for risk management and mitigation, and help organizations avoid operational disruptions that lead to financial penalties and reputational risk.

DORA focuses on digital operational resilience testing, incident reporting, ICT risk management, ICT third-party risk management, and information sharing. It requires certain organizations to prove their ability to maintain operational resilience throughout a cyberattack or similar incident.

A few requirements in DORA include:

• Resolving cyberattack incidents promptly and quickly
• Deploying “cyber vault” technology to create physically and logically separated immutable backups
• Performing vulnerability scans and assessments to uncover and address potential ICT vulnerabilities
• Recovering critical operations within two hours of disruption, and completing end-of-day payments and procedures on time
• Testing recovery procedures annually

While DORA applies to mainframe owners at EU-related financial institutions, every organization needs to pay attention to it, for two reasons:

• It applies to financial institutions outside of the EU that do business within the EU (which is effectively every institution)
• It is a sign of things to come, and new regulations will likely be drafted that set the same requirements for a broader range of organizations

Operational resilience tools

Your level of operational resilience depends largely on your tools.

To start with, you must have three levels of redundancy for how and where you store your data. This is discussed above. You must have your primary working data centers, a logically separated data center, and a physically separated data center that builds resilience against ransomware attacks.

Going deeper, there are three core areas where the right operational resilience solutions will make or break your ability to maintain business functions. They are:

1. Code and development. Tools that help you create resilient code.
2. Data. Tools that make sure your code sits on top of resilient systems.
3. Security. Tools that defend your systems against external and internal threats.

At BMC, every tool within our portfolio builds operational resilience within these areas. Highlights of our operational resilience software include:

1. Our developer experience (DevX portfolio) tools help you quickly produce resilient code that works, cope with high volumes of base changes entering your environment, and anticipate and avoid code-level risks before you push them into production.

   Learn more about BMC AMI DevX

2. Our data portfolio tools ensure your databases are clean, recover data if there is a problem, and keep multiple data centers synced yet separate and secure to prevent corruption in one from spreading to others.

   Explore BMC AMI Mainframe Security

3. Our security portfolio tools keep your systems and data safe from cyber threats, accelerate and automate both threat detection and remediation, and establish and maintain continuous compliance across the entire estate.

   Check out BMC AMI Data

Additional resources