Operational resilience is a data problem as much as a tech one

Regulators have different acronyms. The underlying ask is the same: know which business services cannot fail, which systems they run on, which vendors sit underneath, and how you recover without a heroics weekend.

Most firms have an application inventory. Fewer have a living map from ‘customer payments’ to the actual jobs, queues, and third parties. That gap shows up the first time you try to write a realistic recovery objective.

Treat the mapping as a product. Version it. Assign an owner in the business, not only in IT. Test the recovery of one critical function end-to-end each quarter — not a tabletop, a restore.

Technology partners should be able to tell you which interfaces are on the critical path and which are convenience. If they cannot, they are not ready to modernize that estate.