ELI5

Resilience and regulation, explained simply

Resilience means the important things keep running when something breaks, including when it breaks at a supplier.

The big idea

Think about a bakery. Security asks: can someone break in? Resilience asks a different question: if the oven breaks, or the flour delivery doesn't come, can we still sell bread tomorrow?

Modern organisations rely on hundreds of suppliers for their computer systems, and an outage at one of them can stop many companies at once. Regulators have noticed. Rules such as DORA in the EU, which applies to banks, insurers and other financial firms, now ask whether the most important services can keep going through a disruption, not only whether the right controls exist.

One of DORA's plainest demands is a list of every computer supplier a firm uses and what each one supports. Making that list turns out to be hard in almost any organisation, because nobody ever wrote down which business service depends on which system, and which contract keeps that system running. The list is worth having anyway, because it answers the first question every outage raises: who else depends on this supplier?

Words you will meet

• Operational resilience: being able to keep important services running, or bring them back quickly, when something goes wrong.
• Third party: a supplier or outside company you depend on.
• ICT: information and communication technology, meaning computers, networks and software.
• DORA: the EU's Digital Operational Resilience Act, which sets these rules for financial firms.
• Register: an official list, here of every ICT supplier and what it supports.

The field notes, in plain words

• DORA in practice: what the third-party register reveals

  A new EU law makes financial firms list every computer supplier they rely on, and making the list shows how hard it is to say what depends on what.

Ready for more? Resilience and regulation: where things stand

Personal work and my own view, not my employer's. Sources are public.