Operational Resilience Consulting for FCA-Regulated Firms
Practical, senior-led operational resilience consulting for UK financial services, from important business service mapping to DORA readiness and board reporting.
- FCA PS21/3 & PRA SS1/21
- DORA readiness
- Critical third parties regime
- Board self-assessment
Resilience that is tested and evidenced, not just documented
FCA and PRA operational resilience obligations
UK regulated firms must identify their important business services, set impact tolerances and demonstrate they can remain within them through severe but plausible disruption. We help boards translate PS21/3 and SS1/21 into practical scenarios, mapped dependencies and evidenced testing, not paperwork.
DORA readiness for UK firms
The Digital Operational Resilience Act applies to EU financial entities and reaches UK firms via EU counterparties, group entities and cross-border services. We assess DORA exposure, map it against existing FCA obligations and build a single, non-duplicative control set.
Important business services and impact tolerances
Defining what actually matters to customers and the market, then quantifying how long a disruption can last before harm becomes intolerable. We facilitate the analysis with business, technology and risk leaders together, so tolerances are owned, not imposed.
Third-party and concentration risk
Most resilience failures start with a supplier. We strengthen due diligence, exit planning, sub-outsourcing visibility, incident notification and continuous monitoring, aligned with the UK critical third parties regime, DORA's ICT third-party rules and the new material third-party register and notification requirements under FCA PS26/2 and PRA PS7/26, which come into force on 18 March 2027.
Incident response and cyber resilience
Preparation, executive decision-making, communications, recovery and lessons-learned, so incidents do not become crises. Includes cyber incident exercising, ransomware scenarios and regulator-facing reporting, including readiness for the new FCA and PRA operational incident reporting rules from March 2027.
Cyber security board reporting
Clear, comparable reporting for boards and audit committees covering material risks, control effectiveness, supplier exposure, incident trends, regulatory obligations and progress against the resilience roadmap.
A clear path to supervisory confidence
- 01
Assess
Baseline your services, tolerances, mapping and DORA exposure.
- 02
Map
Trace people, process, technology and supplier dependencies.
- 03
Test
Run severe but plausible scenarios and expose vulnerabilities.
- 04
Evidence
Remediate, retest and produce a board-ready self-assessment.
Related
Operational resilience guide
A practical guide to PS21/3, SS1/21 and DORA for FCA-regulated firms.
Read the guideISO/IEC 27001 consulting
Certification support and ISMS design for regulated organisations.
Read moreVirtual CISO and vCISO
Senior cyber security leadership without a permanent hire.
Explore vCISO services