Operational Resilience Consulting

You have plans. You don't have a program that holds together.

In nearly every organization we’ve assessed, each resilience function runs from its own plans. Information security owns the cyber incident response plan. Crisis management owns the crisis plan. Business continuity owns a library of department plans. IT owns the disaster recovery runbooks. Communications has its own plan, or none at all.

Individually, those plans might be solid. Together, they’re disjointed. When a disruption hits, your executives get approached by several teams with several frameworks, each activating its own process. Nobody can say how long the business can survive without a given service, or what that service depends on.

What results is not resilience. It’s complexity.

“We have two crisis teams. The responsibilities overlap. The severity levels are confusing.”

“We wouldn’t be in a good spot should we have to recover. We don’t know what’s tied to what.”

“The board wants action. I keep reporting risk and getting told to do something about it.”

What operational resilience means

Operational resilience is your ability to keep delivering your most important services through a severe disruption, within limits your executives set in advance.

Business continuity asks, “How do we recover this department?” Operational resilience asks, “How long can our members go without claims processing, and what has to be true for us to stay inside that limit?”

It isn’t a new discipline. It’s business continuity, crisis management, IT disaster recovery, cyber response, and third-party risk, organized around services instead of org charts.

Financial regulators wrote the playbook. The Federal Reserve, OCC, and FDIC published Sound Practices to Strengthen Operational Resilience in October 2020. UK regulators required firms to identify important business services and set impact tolerances by March 31, 2022. The EU’s Digital Operational Resilience Act (DORA) has applied since January 17, 2025. Health insurers, health systems, and utilities face the same expectations from boards, auditors, and customers, without a rulebook written for them.

Old View	New View
Every department has a plan	Every important service has a tolerance, a map, and a tested recovery
Continuity, crisis, and IT DR run separately	One program, one governance model, one set of severity levels
Recovery time objectives set by IT	Impact tolerances set by executives, in business terms
Vendors answer a questionnaire	Critical vendors are mapped and exercised with you
Report risk to the board	Show the board which services can stay inside tolerance, and which can’t yet

Five steps, on the Resilience Operating Model®

We build operational resilience on the Resilience Operating Model®, which runs business continuity, crisis management, and IT disaster recovery as one system. It has three layers.

Core resilience domains. The what: business continuity, crisis management, crisis communications, IT disaster recovery, information security and cyber resilience, life safety and emergency procedures, physical security, and enterprise risk management.

Enabling functions. The how: governance and accountability, risk-based prioritization, integrated planning and lifecycle management, a crisis operating rhythm, metrics and maturity measurement, and culture and capability building.

Execution lifecycle. How we deliver it: Diagnose. Design. Deliver. Evolve. Resilience is never done, so the lifecycle repeats.

Operational resilience puts that system to work on your most important services:

1. Name your important business services

The handful of services whose failure would harm your customers, members, patients, or the business itself. Claims adjudication, not “the claims department.” Power to the grid, not “operations.”

2. Set impact tolerances

Your executives decide the maximum tolerable disruption for each service, in hours and in consequences. This is a leadership decision, so we put it in front of your leadership.

3. Map what each service depends on

People, processes, applications, data, facilities, and third parties. This is where most programs find the gap: the vendor nobody listed, the application with no recovery plan, the single team that knows how it works.

4. Test against severe but plausible scenarios

Ransomware on the core platform. Loss of a critical vendor. A regional disaster that takes out a site and the people who run it. We exercise the full chain, from technical recovery to the executive decision, and we run scenarios long enough to test whether you can stay inside tolerance for weeks, not hours.

From 869 observations across 32 exercises (2023 to 2026): most organizations practice starting a crisis response, and almost none practice finishing one. Nearly half of the after-action reports we reviewed had no plan for a crisis that runs for weeks. In long scenarios, nobody owned the decision about which routine work slips while the incident consumes a fifth of the organization’s capacity. That is the gap operational resilience closes. (What We Saw in the Room, Bryghtpath, September 2026)

5. Report in terms your executives use

Which services can stay inside tolerance today, which can’t, and what it costs to close the gap. A board-ready view, refreshed as the program matures.

Start where you are

• Resilience Operating Model® Briefing and Workshop. Start with your executives. A briefing walks your executives through the model. A workshop maps it to your structure, capabilities, and priorities, so the program starts with clear owners and executive sponsorship. Request a briefing.
• Resiliency Diagnosis®. Fixed fee, based on scope. A maturity score against ISO 22301, ISO 27031, NIST, and FFIEC, with a prioritized roadmap. The fastest way to know where you stand. Explore the Resiliency Diagnosis®.
• Operational Resilience Program Build. Scoped engagement. Important business services, impact tolerances, dependency mapping, governance, and integrated plans, built with your team. Schedule a consultation.
• Resilience as a Service. Managed program, launches within 30 days. We run the whole program for you: business continuity, crisis management, IT disaster recovery, and exercises, under one governance model. Explore Resilience as a Service.
• Third-Party and Dependency Exercises. From $25,000. Test the relationships your important services depend on, on your own or jointly with the vendor, with an independent evaluation of their response. Explore Third-Party Exercises.

Operational resilience, in practice

Operational resilience starts with the program, not the exercise. Three organizations where we built the system around the services that matter most.

Built for organizations outside the big-bank rulebook

Operational resilience grew up in banking regulation. Most organizations don’t operate under those rules, in the US or anywhere else, and still answer to boards, auditors, regulators, and customers who expect critical services to keep running. We work with health insurers, health systems, healthcare technology companies, utilities, insurers, manufacturers, and mid-market financial services firms, with clients operating across more than 40 countries. The common thread: services people depend on every day, a board that wants proof, and a continuity team of one or two people trying to cover an enterprise.

Before founding Bryghtpath, our CEO built and led Target’s global crisis management, business continuity, and intelligence programs. Our team has spent two decades doing this work inside organizations like yours, with credentials including MBCP, MBCI, and CISSP.

Operational resilience questions

Go deeper

• The Resilience Operating Model®. Our whitepaper on running resilience as one system: the eight domains, the six enabling functions, and how to implement them.
• The Polycrisis Playbook. Ten threat themes for 2026, and the shift from technical recovery to integrated operational resilience.