Guided case and next steps
Case: the system is back, the service is waiting
A bank enables customers to make a payment. Its application is restored in 2 hours, meeting its RTO. The payment queue remains blocked until hour 5. The service impact tolerance is 4 hours in this fictional example.
Before reading the answer: what is the service? Is meeting the RTO sufficient? Which dependencies should you examine?
Guided answer. The service is “enable the customer to make a payment”. The application RTO is met, but the service breaches its tolerance by one hour. Examine the people, processes, technology, information, facilities and third parties needed to process payments, then document and assign the vulnerability. These values are illustrative, not regulatory thresholds.
What this course enables
Recognise a service, distinguish recovery objectives from tolerance, position frameworks and flag a dependency. Designing a complete programme or demonstrating regulatory compliance requires further work.
Choose the next step for your role
| Need | Catalogue next step |
|---|---|
| Define and justify services and tolerances, map and test | Remaining Operational Resilience track then CR-CORP |
| Conduct BIA, continuity strategies and plans | Business Continuity — CR-CBCP |
| Implement DORA ICT obligations | DORA Compliance — CR-CDORA |
| Design and test IT recovery | IT Continuity — CR-CITDR |
| Lead a crisis team and communicate | Crisis Management — CR-CCM |
| Assess risks and controls | Operational Risk — CR-CORM |
| Organise cyber response or manage providers | Cyber Resilience — CR-CCYR; Third-Party Risk — CR-CTPRM |
Choose according to your responsibilities: every role does not require every certification.
Key takeaways
- Measure the service through to the customer outcome
- Fundamentals provide shared language; specialist tracks develop the methods