Cyber resilience
Also called digital operational resilience, cyber operational resilience
Cyber resilience is a firm's ability to anticipate, withstand, respond to and recover from cyber attacks and IT failures while keeping its critical services running. It goes beyond preventing breaches. It assumes some attacks will succeed and focuses on limiting damage, restoring systems quickly and learning from each incident.
How it works
At a bank or insurer, cyber resilience combines security controls with recovery planning. The firm identifies its critical systems and data, tests defences through penetration and scenario testing, keeps isolated backups and rehearses incident response. Major incidents are classified and reported to supervisors within set deadlines. Lessons from each event feed back into controls and the risk register.
Financial regulators now treat cyber resilience as a board responsibility. In the EU, DORA sets binding ICT risk, testing and incident reporting duties for most financial entities. NIS2 extends similar duties to other sectors. Product makers face the Cyber Resilience Act. Supervisors test whether firms can keep important services within tolerance during a severe but plausible attack.
The rules
Sets binding rules on ICT risk management, major incident reporting, resilience testing and oversight of ICT third-party providers.
Banks, insurers, investment firms, payment firms and other EU financial entitiesMember states had to transpose rules on cybersecurity risk management and incident reporting for critical sectors by this date.
Essential and important entities in critical sectorsReporting of actively exploited vulnerabilities and severe incidents applies from this date, with most other obligations from 11 December 2027.
Manufacturers of hardware and software products sold in the EUCommon questions
What is the difference between cybersecurity and cyber resilience?
Cybersecurity aims to stop attacks and protect systems and data. Cyber resilience accepts that some attacks will get through and adds the ability to keep critical services running, recover quickly and adapt. Regulators increasingly assess both together.
Does DORA cover cyber resilience?
Yes. DORA applies from 17 January 2025 and requires EU financial entities to run an ICT risk management framework, report major ICT incidents, test their digital resilience and manage risks from ICT third-party providers, including threat-led penetration testing for larger firms.
How do UK firms approach cyber resilience?
UK firms fall under the FCA and PRA operational resilience rules. They identify important business services, set impact tolerances and show they can stay within them during severe disruption, including cyber attacks. Firms had to meet these requirements by 31 March 2025.
