Resilient Operating Models

The compliance trap

Regulators have done an effective job of putting operational resilience on board agendas. PRA, FCA, DORA — the frameworks are clear and the deadlines are real. But there's a danger in building resilience programmes designed to pass regulatory assessments rather than genuinely withstand disruption.

Compliance-driven resilience creates tick-box governance: impact tolerances set but never tested, business service maps drawn but never updated, continuity plans written but never exercised. When real disruption arrives, organisations discover their resilience programme was a documentation exercise rather than an operational capability.

The question isn't 'Are we compliant?' — it's 'Could we actually keep operating if our primary data centre went offline tomorrow?' If you can't answer that with evidence, compliance is a veneer.

Resilience as an operating model

Genuine resilience means embedding it into how the organisation operates — not treating it as a separate governance layer. This means connecting business service maps to real CMDB data, linking continuity plans to live infrastructure, testing recovery capabilities regularly, and monitoring impact tolerances continuously rather than annually.

Making it sustainable

ServiceNow provides the platform to make resilience operational: automated monitoring, connected data, triggered testing workflows, and real-time dashboards. But the platform is the enabler, not the solution. Sustainable resilience requires ownership, governance cadences, and a culture that treats disruption as inevitable rather than theoretical.