Operational Resilience
The ability of a financial institution to deliver critical operations through disruption.
How the laws define this
Both regulatory sources establish that operational resilience centers on an institution's capacity to continue delivering critical functions or operations during disruptions, particularly cyber incidents or attacks. They share a core focus on maintaining the continuous availability of services through structured response strategies when adverse events occur. However, the instruments diverge in their threat scope and specified implementation measures. The Policy Document on Risk Management in Technology (RMiT) frames the concept specifically around financial institutions maintaining essential financial services against a wide spectrum of disruptions, including natural disasters, cyberattacks, and unforeseen events, through preparedness, effective response, and rapid recovery capabilities. In contrast, the Bank Negara Malaysia — Policy Document on Risk Management in Technology (RMiT) (updated) defines the subject around an institution's critical functions generally and explicitly highlights specific tactical safeguards, namely incident response planning and regular cyber drills, to build resilience against adverse events.
Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| Malaysia | Bank Negara Malaysia — Policy Document on Risk Management in Technology (RMiT) (updated) | In Force | This definition widens the scope by explicitly including cyber incidents as adverse events and adds emphasis on building resilience through incident response planning and regular cyber drills. |
| Malaysia | Policy Document on Risk Management in Technology (RMiT) | Repealed | This definition widens the scope by listing specific disruption causes like cyberattacks and natural disasters, while adding emphasis on preparedness, effective response, and rapid recovery for continuous service availability. |
What it triggers
- Under the Policy Document on Risk Management in Technology (RMiT) (updated), Bank Negara Malaysia sets out measures like incident response planning and regular cyber drills to build resilience.source
Definitions (2)
Operational Resilience is defined as the ability of a financial institution to deliver critical operations through disruption, whether caused by cyberattacks, natural disasters, or other unforeseen events. It emphasizes preparedness, effective response, and rapid recovery capabilities to ensure continuous availability of essential financial services.
Operational Resilience refers to an institution's ability to deliver critical functions in the face of adverse events, including cyber incidents. The policy emphasizes building resilience through measures like incident response planning and regular cyber drills.
Questions and answers
What measures does the updated RMiT policy emphasize for operational resilience?
The updated RMiT policy emphasizes building resilience through measures like incident response planning and regular cyber drills. It covers board accountability and cyber resilience.
How does the repealed RMiT define operational resilience?
The repealed RMiT defines it as the ability to deliver critical operations through disruptions like cyberattacks or natural disasters. It stresses preparedness, response, and recovery for continuous services.