The paperwork has got much better. Across financial services the governance artefacts are now largely in place: policies, a named owner for each important business service, an impact tolerance signed off, a maturity score moving in the right direction. What is harder to find is evidence that someone has watched a critical service come back and timed it.
// 01Why the paperwork improved
Two things drove the improvement. Firms have been on the hook since 31 March 2025 for staying within impact tolerances for each important business service, and boards have been paying closer attention since the 2025 retail attacks.
The Cyber Security and Resilience Bill, now through second reading in the Lords, will put comparable expectations on data centres, managed service providers and the IT suppliers behind regulated firms — part of why resilience is now a board-level issue.
The result is a great deal more evidence. Whether it is evidence of the right thing is a separate question, and the FCA has already answered it.
// 02What the evidence usually proves
The FCA published its findings a year on from the deadline in March. One line stands out: some firms state in their self-assessments that there is no scenario they would not be able to recover from, but include no evidence of having tested this using sufficiently severe scenarios.
That claim is worth sitting with before the question of testing even arises, because no scenario at all is a remarkable thing to put in writing. It takes in the ransomware that reaches the backup estate as readily as the key supplier going dark for a fortnight. It holds for every important business service, on any day of the year, with whoever is available. Little a firm could say about itself claims more, and the FCA's point is that it usually arrives with nothing behind it.
In practice the confidence comes from failures that have already been rehearsed: a lost data centre, a failed node, a supplier with a contractual alternative ready. It gets stretched to cover the ones nobody has rehearsed, which is what the FCA's phrase "sufficiently severe" is doing. The regulator's good practice asks firms to widen scenario testing and to write down their assumptions and the recovery times claimed. Those assumptions are where the confidence sits, and most have never been written down.
// 03What maturity scoring rewards
Maturity scoring against NCSC CAF or NIST CSF rewards what is present and documented: a policy exists, an owner is named, the recovery procedure is written down and under version control. All of that is real work, and none of it tells you the service comes back. We found the same pattern in alerting on an alert management maturity review: strong tooling, weak ownership, output nobody trusted.
// PLANS VERSUS RECOVERY
Among UK large businesses, 76% now hold a formal incident response plan. In At-Bay's analysis of US ransomware insurance claims, 92% of the businesses hit had a backup solution — and only 63% of those got their data back.
// 04Testing what you have already claimed
None of this argues against assessment. There is a case for treating the self-assessment as a starting point, because the sentence that matters is a narrow one: whether this named service can be restored by the people who happen to be on shift, inside the tolerance the board signed off.
That is harder to evidence, and it runs through more than technology. The FCA found the same seam from the other side. Mapping, it noted, has been largely focused on the technology supporting important business services, when it also needs to cover facilities, people, processes, information and third-party resilience — the transparency business architecture is built to provide. The restore path runs through all of those, and so does the incident.
Nobody is being dishonest here. Each part is usually done properly in isolation, and what tends to be missing is the exercise that tests them together: one important business service, worked backwards from its impact tolerance through the technology, the people on shift at three in the morning and the third parties in the chain, then run against a scenario nobody wrote the answers to first.
// 05What good evidence looks like
Evidence that answers it is unglamorous: a date, the service tested, the scenario, who was in the room, the point it was genuinely usable again, and a list of what had to be improvised. That last item is the useful one.
"A test that produced no improvisation was probably not severe enough."
TOM HURST · PRINCIPAL CYBER CONSULTANT
Our new Operational and Cyber Resilience service is built around that gap, and it does more than mark the homework. We map the services that have to keep running, trace them to the technology, people and third parties underneath, build the plans and playbooks that protect them, then exercise the lot until it holds. What comes out is evidence a board and a regulator can both use, and a named owner to keep it current.
// SOURCESReferences
- FCA, Operational resilience: insights and observations one year on, 27 March 2026.
- FCA, PS21/3 Building operational resilience — source of the 31 March 2025 impact tolerance deadline.
- DSIT, Cyber security breaches survey 2025/2026, 30 April 2026.
- At-Bay, Backup Breakdown: How Data Recovery Impacts the Outcome of Cyber Attacks, 17 October 2023.
- UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill — Lords second reading 14 July 2026, committee stage listed from 1 September 2026.
