Operational resilience starts from the customer's side: which service must not stop, and what supports it in people, systems and suppliers? We map this and test it with realistic scenarios.
And you need to show you know and manage them.
With no clear map of dependencies.
For continuity, recovery and cyber, with no link between them.
From the customer's and the market's point of view.
People, processes, systems and outside parties.
Maximum acceptable disruption, and tests with severe but plausible scenarios.
A dependency map for each service.
Approved by management.
Gaps and a plan to close them.
With the executive team.
With process owners.
And find the weak points.
Ordered by impact.