Digital4Security Taster Workshops - Workshop 4: Operational Resilience: Surviving the Accident and the Hack

Rising Imperative for Operational Resilience

Financial services operate in an environment where digital disruptions—whether from cyberattacks, technical failures, or external events—can halt trading, payments, and customer access within minutes. The convergence of stricter regulations and escalating threats has made operational resilience a board-level priority rather than an IT concern.

In the European Union, the Digital Operational Resilience Act (DORA), applicable since January 2025, mandates harmonised rules for managing ICT risks across banks, insurers, investment firms, and other entities. Regulators expect full compliance, including detailed registers of third-party providers and rigorous testing, with no transition leniency signalled. Non-compliance risks fines, audits, and reputational damage in a sector already under scrutiny for systemic stability.

Parallel developments in the UK reinforce this shift. The FCA and PRA's operational resilience framework, fully in force after a March 2025 deadline, requires firms to map important business services, set impact tolerances, and demonstrate ongoing adherence. Supervisors now scrutinise evidence of real-world preparedness rather than documentation alone.

Recent incidents underscore the stakes. Average breach costs in finance remain in the millions, while specific events—like nationwide outages tied to power failures or repeated cloud disruptions—have paralysed banking services across regions. Cyber incidents rose sharply, with financial firms facing advanced threats from state actors and criminals exploiting third-party dependencies. These not only incur direct financial losses but also trigger regulatory reporting cascades and potential market instability.

Less visible tensions emerge in the trade-offs. Firms push aggressive digital transformation—cloud adoption, AI integration—to stay competitive, yet these expand attack surfaces and complicate resilience. Regulators demand visibility into third-party risks, but global supply chains resist full oversight. Geopolitical factors amplify threats, while boards balance investment in prevention against short-term profitability pressures.

The result is a sector where surviving 'the accident and the hack' means building capabilities to absorb shocks without cascading failures, at a time when inaction invites both regulatory sanctions and existential operational breakdowns.