Backup and Recovery

Operational Resilience: Understanding the UK's Latest Regulation for Financial Services

Cameron Skinner
Senior Strategic Business Development Manager, Own Company
No items found.

Amidst the backdrop of the COVID-19 pandemic, businesses can no longer ignore the risk of technology outages or the threat of increasingly sophisticated cyberattacks. This is especially true of financial firms, which are 300 times more likely than other institutions to experience cyberattacks, according to a report by the Boston Consulting Group. That’s why the UK government has launched a new regulatory framework-Operational Resilience- taking effect on March 31 2022 that outlines how organisations in the financial services industry must build resilience into their business.

Here’s what you should know about the new regulation and the path forward for organisations affected by it.

What is operational resilience?

The term “operational resilience” has become the defacto name of the regulation and is as defined by the regulators – Bank of England, Prudential Regulation Authority (PRA), and Financial Conduct Authority (FCA) – the ability to prevent, adapt and respond to, recover, and learn from operational disruption. These disruptions include risks like cyber threats, technology outages, and accidental data loss caused by human error.

Operational resilience goes beyond business continuity planning and involves developing a comprehensive framework that covers all potential impacts, risk factors and tolerance levels affecting a business’s successful operation.

The new operational resilience rules will apply to a wide range of institutions in, and related to the financial services industry, such as banks, investment firms, insurance companies, building societies, payment service providers and insurers.

Operational resilience requirements

By March 31, 2022 in-scope firms must have formalised and documented plans that:

  1. identify their important business services and data, determined by considering the impact of those service on consumers
  2. define an impact and recovery tolerance for disruption to each of those services
  3. articulate mitigation strategies and demonstrable processes to ensure data integrity, security, and resiliency in the event of plausible/severe/extreme scenarios

A further requirement to remain within impact tolerances for each important business service will only apply in full from March 2025. This three-year transition period also gives in-scope firms extra time to refine their scenario testing and mapping exercises.

What steps can companies take to comply?

The past few years have shown us that financial firms must adapt to new ways of working, particularly with cloud-based tools. The operational resilience regulation is yet another reason for these organisations to accelerate their digital transformations and embrace cloud technology.

However, for all of the advantages of moving to the cloud, like scalability, cost-savings, and reliability, there is also a responsibility that comes with housing all of your data in the cloud: you’re on the hook for what happens to it. While you might be thinking, “my SaaS data is protected because it’s in the cloud”, nearly all SaaS apps require shared responsibility for keeping data safe. That means you can count on your SaaS provider to ensure the security and integrity of the platform, but as a customer, you are responsible for the data you put into it, and who you allow to access it.

SaaS solutions like Salesforce, ServiceNow, and Microsoft Dynamics 365 guarantee very high uptime for customers, so while downtime is unlikely, reliability and resiliency are not the same thing.Reliability is the system or platform having limited downtime, whereas resiliency is the system recovering quickly when disruptions inevitably occur. This regulation aims to ensure the embedding of capabilities, processes, behaviours and systems into the everyday running of financial organisations so that in the face of disruption, they can continue with their mission.

So, where to start? This is a significant task, but there are steps that organisations can begin taking now to assess and plan for requisite updates to their systems, policies, and practises. Some good questions to begin considering are:

  • Where does critical data currently reside?
  • How protected is that data from internal and external threats?
  • Who can access that data and how are permissions controlled?
  • How prepared is the organisation in the event that critical data is compromised?
  • Is there a data backup and recovery process in place, and if so, how robust is it?

To comply with this new framework, investing in technology that can help you mitigate/recover from data loss and corruption is critical. At Own, our solutions have already helped many of the world's largest financial services organisations navigate complex regulations, protect their critical data and minimise risk.

In our next post, we’ll dig deeper how Own’s solutions can help you maintain operational resilience. In the meantime, learn more about Own here.

Get started

Submit your details and we will contact you shortly to schedule a custom 25-minute demo.

Book a demo
Get started

Submit your details and we will contact you shortly to schedule a custom 25-minute demo.

Book a demo

You may also like

Backup and Recovery

Just Because Your M&A Deal is Done Doesn't Mean Your Security Risks Are

Security concerns are the second most common reason M&A deals are abandoned. Here are some steps you can take to mitigate the risks.

Backup and Recovery

Dynamics 365 Release Wave: How Might Your Power Platform Data be Impacted?

We’ve reviewed more than 600 pages of release notes and highlighted the features that are more likely to impact your data.

Backup and Recovery

Build vs Buy: Should You Develop an In-House Backup Tool for Your SaaS Data?

Whether you’ve already developed an in-house tool or are investigating the feasibility of doing so, here are the six questions to think about as you consider the best option for your company.

Backup and Recovery
Backup and Recovery
Backup and Recovery

Get started

Share your details and we’ll contact you shortly to schedule a custom 25-minute demo.

Schedule a Demo