From compliance to digital resilience
DORA, NIS2 and sector-specific frameworks have raised the regulatory bar significantly. Most institutions are responding with compliance programs that satisfy reporting requirements. Few are using the regulatory pressure as a catalyst to redesign the underlying resilience operating model — which is what the regulations are actually trying to produce.
Context
Digital resilience has become a board-level topic. Regulators expect not only control inventories and incident reports, but evidence of continuous, integrated, tested resilience across ICT risk, third-party exposure, business continuity and operational recovery. Documentation is not sufficient. Resilience must be demonstrated through testing and operational evidence.
Why compliance programs do not produce resilience
Compliance programs map regulatory requirements to existing controls, identify gaps and close them with documentation, processes and additional reporting. The output is a more compliant institution. It is not necessarily a more resilient one. The fragmentation between IT, security, risk and business continuity remains — it is now better documented rather than better integrated.
Resilience is operational when the disciplines share forums, scenarios and escalation paths — not when they share a compliance report.
From control inventory to tested efficacy
Controls assessed for effectiveness — not only for existence in a register. Many controls survive audit cycles without being tested under realistic conditions. Recovery time and recovery point objectives must be validated in actual exercises, not assumed from design documentation.
Critical vendors as part of the perimeter
Critical third parties are an extension of the institution's risk surface. DORA-style frameworks require integrated monitoring, contractual resilience requirements, incident-handling protocols and exit planning proportionate to the criticality of the relationship.
Tested end-to-end — not just documented
Recovery plans tested across the full stack: technology recovery, people, processes, third parties and communications — on scenarios that reflect actual threat patterns. A plan that has never been exercised end-to-end is a hypothesis, not a plan.
Forward-looking resilience indicators
Boards moved from retrospective incident counts to forward-looking resilience metrics: tested recovery times, third-party exposure levels, control efficacy trends, scenario coverage. The reporting must enable decisions — not only provide assurance after the fact.
"The regulatory window is finite. Use it to redesign the operating model — not to produce more reports."
— RSV Consult perspective
How to use the regulatory window
DORA-style frameworks create executive attention and budget for resilience. The window is finite. Institutions that use it to redesign the operating model emerge with both compliance and capability. Institutions that use it only for reporting emerge with compliance and the same structural fragility — and less budget to address it next cycle.
Resilience is not a reporting exercise. It is an operating model. Compliance documents what you have. Operational resilience demonstrates that it works under pressure.