Grant Duxbury of 11:11 Systems argues resilience must be designed into digital transformation from the start rather than run as a separate work stream.
Duxbury says regulators now want evidence of operational readiness, meaning proof that firms have tested their plans, not just documentation of them.
Duxbury urges boards to ask when their top five to 10 services were last tested and whether the firm could survive losing its largest technology or cloud provider for 48 hours.
Why banks must prove their resilience plans actually work
Financial institutions modernising amid ageing technology, hybrid environments, third-party reliance and sharper cyber threats can no longer treat resilience as a paperwork exercise. Duxbury argues the real measure is how confidently a firm can keep critical services running during an incident, proven through testing under realistic conditions. Customers expect always-on services and regulators now want that evidence rather than documentation.
Takeaways
Resilience belongs inside transformation, not beside it. Duxbury argues transformation only creates value if the business can depend on the changed service. Firms must decide how to keep operating while change is under way, and resilience and security left out of the plan will cost far more later.
An untested plan is only a hypothesis. Testing of assumptions and plans is often neglected. Plans exercised only under controlled conditions, with everyone available, prove little. Every exercise should generate new findings that feed a repeatable process for continual improvement.
Regulators now demand evidence of operational readiness. Under DORA and the FCA's operational resilience rules, plus closer third-party scrutiny, supervisors want a business services framework showing disruption impact, dependencies and actions under pressure. Firms should show proof the plan was tested, not just the plan.
Compliance is a baseline, not confidence. Compliance gives a backward-looking snapshot and a necessary floor. Confidence requires a continual forward-looking posture, staying auditable and responding to changes that occur after the compliance snapshot was taken.
Cyber recovery differs from disaster recovery. Prevention remains the first line of defence, but firms must assume a critical service can still fail. In a cyber incident the trigger point is dynamic and the adversary moves, so security, continuity, governance and communications must work together to contain it.
The business, not IT, owns resilience. Before touching legacy platforms that cannot be switched off, firms must map each critical service to its data, applications, people and suppliers. Business leaders define tolerable disruption and agree what recovery looks like.
Questions boards should ask
Which services matter most to customers, people and continued operations, and what do they depend on?
How confident is the firm that it could maintain or recover those services?
When were the top five to 10 services last tested, under what conditions, and what improved as a result?
Could the firm keep operating if it lost its largest technology or cloud provider for 48 hours?
Tap a name to go there · tap a line to see why they are linked
On this episode 2
Show 1
What share of the transformation budget goes to resilience, and is the plan resilient and secure by design?
Who has authority to invoke recovery, and has that decision-making been tested?
Where to start this year
Set a clear business-led baseline and communicate a roadmap.
Identify critical services, processes and suppliers, mapping people, technology and facilities behind them.
Prioritise the gaps instead of fixing everything at once, using a practical remediation plan that makes adaptation easier.
Build a repeatable improvement process so each round of testing strengthens the next.