Operational resilience diagnostic

A board-approved list of important business services, phrased from the client's viewpoint, exists.

Each important service has a designated owner, accountable for the end-to-end chain.

A quantified impact tolerance is set for each service, independently of current capability.

The gap between tolerance and measured capability is known and declared as a vulnerability.