Lesson 4.31: Important business services and impact tolerances
Operational resilience starts from the outside: which services, if disrupted, would cause intolerable harm to customers or the market, and for how long could each be down before that happens? Financial regulators made this a rule (the UK FCA and PRA operational resilience rules, and the EU's DORA for financial entities), and the idea works for any company. You map each important business service to the people, processes, technology and third parties it needs, then test severe but plausible scenarios against the tolerance. In the lab you map Northwind's four services, find two shared dependencies, test four scenarios and find which tolerances would be breached.
20 min
You will learn to
- Define important business services from the customer's view
- Set and read impact tolerances
- Map services to their resources
- Test scenarios against tolerances
- Turn breaches into investment cases
Key terms
- Important business service
- A service to external users whose disruption could cause intolerable harm.
- Impact tolerance
- The maximum tolerable disruption to a service, usually a time limit, set by the board.
- Mapping
- Linking each service to the people, processes, technology and third parties it needs.
- Severe but plausible scenario
- A disruption that is serious yet realistic, used to test whether tolerances hold.
- DORA
- EU Digital Operational Resilience Act for financial entities, applicable since 17 January 2025.
← PCI DSS v4.0: scope and segmentation · All lessons · Running vulnerability disclosure and bug bounty at scale →