Operational resilience
Regulators stopped accepting documentation as proof. That single change reorganized this market, for the people selling into it and the people running programs inside it.
What is operational resilience?
An organization’s ability to keep delivering critical services through disruption. As a market term it spans business continuity, third-party risk, crisis management and increasingly the resilience of AI-dependent processes. Regulators moved the test from having a plan to demonstrating the plan works.
Operational resilience is a term several categories claim at once, which means evaluation criteria get set by whoever explains the space most clearly. That is an opportunity, and it is also why buyers arrive confused.
What changed?
The test moved from documentation to demonstration.
DORA, NIS2, CER and APRA CPS 230 all ask for proof that critical services survive disruption. Having a plan is no longer the bar. Showing that people executed it is.
What the leader owns, and where a provider helps
The leader has to demonstrate the organization can keep running. A provider is judged on whether it helps them do that.
- Providers need to match the language buyers already use, and prove the gap between documented and demonstrated with exercises rather than argument.
- Leaders need a program the business will participate in, and reporting a board or regulator accepts without translation.
Neither is helped by a maturity model nobody outside the team recognizes.
Match their language, then show the gap
Buyers use continuity, resilience and third-party risk interchangeably. Match their language instead of correcting it.
Most organizations are strong at documentation and weaker at whether they can actually keep running. Naming that gap precisely, and showing it with an exercise, tends to move a deal further than a capability list. See training and simulation.
Participation is the whole problem
The program lives or dies on participation.
People treat continuity as an annual interruption unless it is short, regular and visibly sponsored. What works: a published cadence, exercises measured in minutes, and a finding each participant can use in their own work. See marketing a resilience program internally.
- Short and frequent beats long and annual.
- Publish the cadence so it becomes a rhythm.
- Give each team a finding they can act on.
- Report decisions and time.
Where documentation runs out
Confusing documentation with readiness. A plan written for review fails when it is needed under cognitive load, which is the finding that keeps surfacing in every exercise worth running.
Supporting reading
- Resilience documentation that nobody reads (and how to fix it).Operating · 5 min
- Microsimulations: why risk programs are converging on play.Field · 8 min
- Selling to the GRC buyer in 2026.GRC · 7 min
- Third-party access is still the front door.GRC · 5 min
What people ask
Who buys in this market?
Leaders who own the objective, and the providers who support them. Vendors selling resilience platforms to risk and continuity buyers, and the internal teams who have to demonstrate the organization can keep running.
What regulations drive it?
DORA, NIS2, CER and APRA CPS 230 among others. All moved the test from having documentation to demonstrating that critical services survive disruption.
Why do internal resilience programs stall?
Participation. Continuity gets treated as an annual interruption unless it is short, regular and visibly sponsored, with a finding each team can use.
How do you prove resilience?
With exercises rather than argument. Measure decisions and time, then show what improved on the next run.
Related: GRC and compliance, training and simulation and physical and converged security.