Eight steps—from mapping vulnerabilities to board-approved self-assessment—must now be embedded and reviewed at least annually . The FCA has warned against narrow time-based impact tolerances and complacency about replaceable suppliers.
Firms must plan for ‘severe but plausible’ events, from cyber failure to pandemics. With AI and third-party risk adding complexity, resilience must be woven into enterprise-wide risk management—or face regulatory consequences.




