Start Here: The Board Just Demanded a Map

• Who should join this discovery so we don't miss anyone critical? (select all relevant roles) Options: COO, CRO, CIO, Head of Operational Resilience, Head of Third-Party Risk, Head of Technology Operations, Chief Compliance Officer, Board Risk Chair, Head of Business Lines, Other
• How soon has the board asked for a full dependency map and a board-ready resilience statement? Options: Immediately / Emergency request, Within 30 days, Within 60 days, Within 90 days, Within 6 months, No timeline given / ongoing expectation
• Briefly describe the outage impact we should know about (services affected, duration, public coverage) — tell the story in a few sentences.
• Which regulatory or examiner priorities are driving this work right now? (select all that apply) Options: PRA / UK operational resilience, ECB / DORA, OCC / US guidance, Fed expectations, Local/regional supervisors, Internal audit focus, Legal / compliance requirements, No clear regulator focus yet, Other
• Who currently owns presenting resilience status and the annual resilience statement to the board risk committee? Options: COO, Head of Operational Resilience, CRO, CIO, CISO, Chief Risk Officer + COO jointly, Other

Are You Sure You Know Who’s Really in Charge?

• When the payment processor fails again tomorrow, who will have the authority to accept customer impact and speak for the institution to the board? Options: COO, CRO, CIO, Head of Operational Resilience, Head of Business Line, Incident Commander (named person), No single decision-maker is defined, Other
• Do you have a documented RACI or decision-rights matrix for resilience incidents, and how current is it? Options: Documented and up-to-date, Documented but partially out-of-date, Informal / tribal knowledge only, No matrix exists
• Give a recent example where decision responsibilities blurred during the outage — who stepped in, and what consequence followed?
• Which of these governance levers were used to set remediation timelines after the outage? Options: Board mandate, Executive committee decision, CRO/COO agreement, Regulatory pressure, Vendor SLA negotiation, Vendor-imposed timelines, No formal timeline set
• How do your CRO and COO currently align on defining impact tolerances — workshop, formal policy, ad hoc conversations, or something else? Options: Formal policy and sign-off, Periodic workshops, Ad hoc conversations, No formal alignment process, Other

Where the Lights Flickered: What Actually Happened

• What single failure point from the outage still makes you wince when the board asks questions?
• Which business services were degraded or unavailable during the outage? (select all that applied) Options: Payments / card processing, Customer-facing digital banking (web/mobile), Lending origination, Claims processing, Customer support/contact centres, ATM/cash network, Clearing/settlement, Other
• How accurate are your existing continuity plans when compared to what actually failed in the incident? Options: Fully accurate, Mostly accurate with small gaps, Partially accurate — significant gaps, Largely inaccurate, No continuity plans existed
• How long did it take your team to reconcile internal logs, vendor timelines, and customer impacts after the outage? Options: Under 24 hours, 24–72 hours, 3–7 days, Over 1 week, Still reconciling
• What incident evidence do you already have that would be useful for an examiner (select all that apply)? Options: System logs/telemetry, Incident report / timeline, Vendor communications / RCA, Customer complaints / complaints data, Board/exec meeting minutes, Change/configuration records, None / incomplete
• How did the public and media coverage affect your internal priorities and the urgency of fixes? Tell us one concrete change that happened because of the coverage.

The Blind Spots You Don’t Want to Find Under Pressure

• If a regulator asked for a full end-to-end dependency map tomorrow, which critical service would you be least confident mapping? Options: Payments, Lending, Claims, Customer channels (web/mobile), Treasury/clearing, Back-office settlements, We could map all confidently, Not sure / need to investigate
• Which types of dependency data do you currently struggle to produce reliably? (select all that apply) Options: Technology components (servers, databases), Network topology / links, Third-party vendor dependencies, Personnel / owners / on-call, Physical facilities and failover locations, Telemetry and monitoring metrics, Contracts and SLAs, Configuration items in CMDB, Other
• Tell us about one supplier or vendor concentration you suspect is an undocumented single point of failure and why it worries you.
• How do you currently surface hidden dependencies: manual interviews, CMDB, application mapping, vendor attestations, observability tools, or something else? Options: Manual interviews with SMEs, CMDB/configuration tools, APM/observability traces, Automated dependency mapping tools, Vendor attestations and questionnaires, We don't have a reliable method, Other
• Practically speaking, how long would it take to assemble a consolidated dependency view for a single critical service today? Options: Under 1 week, 1–4 weeks, 1–3 months, Over 3 months, Unknown / depends on service
• When you think about those blind spots, what feels like the biggest personal risk to you or your leadership team (embarrassment, regulatory finding, customer loss, financial exposure)? Options: Regulatory finding / sanction, Board criticism / loss of confidence, Customer churn and reputational damage, Financial loss / penalties, Operational inability to recover, Other

What Tolerances Would Keep the Board Calm?

• If the board demanded a quantifiable impact tolerance for payments today, what single metric would you give them—and why might that number fail an examiner’s scrutiny?
• Which impact tolerance dimensions do you currently track or have proposed? (select all that apply) Options: Customer-facing outage duration (hours), Maximum acceptable transaction loss, Financial loss threshold, Percentage of customers affected, Regulatory breach threshold, Reputational / media impact metric, Service-level / throughput degradation, Other
• Who in your organisation is empowered today to define or approve impact tolerances? Options: CRO, COO, CFO, Head of Operational Resilience, Board Risk Committee, Business Line Heads, Executive Committee, No single owner / shared responsibility, Other
• Describe a recent example where a tolerance threshold was exceeded — what happened, who notified the board, and what remediation occurred?
• How would you prefer impact tolerances and supporting evidence to be presented to the board? Options: Single yes/no resilience statement with evidence bundle, Interactive dashboard with drilldowns, Scenario narratives with artifacts, Heatmap with metric thresholds, Executive summary plus technical annex, Other

Can Your Tests Actually Prove Resilience?

• When you run a resilience scenario today, does it feel like a meaningful test of real-world failure or merely a compliance exercise? Options: Meaningful, realistic test, Mostly compliance-oriented, Mixed — some realistic elements, We do not run scenario tests
• Which of these test types have you executed in the last 12 months? (select all that apply) Options: Tabletop / workshop scenarios, Live failover to DR environment, Simulated cloud-region outage, Vendor outage simulation, Chaos engineering experiments, No tests executed, Other
• How often does the board require scenario testing and evidence of resilience? Options: Quarterly, Semi-annually, Annually, Ad hoc after incidents, Not defined
• What artifacts or evidence do you currently capture during tests that you think would satisfy an examiner? (select all that apply) Options: Telemetry traces and logs, Business impact metrics, Witness statements and minutes, Vendor confirmations, Remediation tickets and closure evidence, None / insufficient evidence
• Who owns scheduling tests and driving remediations from test findings? Options: Business owners, Technology operations, Operational resilience team, Third-party risk / procurement, Governance committee, No clear owner
• Recall one test that failed to validate resilience — what specific gap surfaced and how long did remediation take (or is taking)?

If We Had a Clear Runbook — What Would Change?

• Imagine your dependency map is live, testable, and audit-ready — what are the first three decisions you would make differently?
• Which platform capabilities would create the most immediate operational lift for your teams? (select up to three) Options: Live end-to-end mapping, Scenario simulation engine, Vendor concentration alerts, Audit-ready evidence bundling, Impact tolerance tracking, Playbook automation / remediation workflows, Role-based dashboards for execs and SMEs
• What integrations are non-negotiable for deployment to be viable (SIEM, CMDB, ITSM, cloud telemetry, vendor portals)? (select all that apply) Options: SIEM / security logs, APM / observability, CMDB / asset inventory, ITSM / ticketing (ServiceNow/Jira), Cloud provider telemetry (AWS/Azure/GCP), Vendor portals / supplier APIs, Financial / transaction systems, Other
• Realistically, how much team capacity can you allocate to an initial deployment (people-hours per week across teams)? Options: Under 5 hours/week, 5–10 hours/week, 10–20 hours/week, 20–40 hours/week, Over 40 hours/week
• What would success look like at 30 days, 90 days, and 180 days after going live? Be specific about deliverables and governance changes.

Next Steps: What Would Make Us Move Together?

• If you had to sign off on one deliverable to convince the board the program is working, which single artifact would that be? Options: Board-ready resilience statement with evidence, Complete end-to-end dependency map, Quarterly scenario-testing plan with results, Regulator-ready evidence bundle for examiners, Governance and acceptance criteria + operating model
• What pilot timeline from kickoff to a board-ready statement feels realistic for your organisation? Options: 30 days, 60 days, 90 days, 6 months, Depends on scope / need to agree scope first
• Who must sit on the steering group and how often should it meet to keep momentum without governance fatigue? (select roles and preferred cadence) Options: COO, CRO, CIO, Head of Operational Resilience, Head of Third-Party Risk, Head of Business Line, Board Risk Chair (ex-officio), Monthly cadence, Bi-weekly cadence, Quarterly cadence, Ad hoc as issues arise
• Which metrics would make you declare this program a success after 12 months? (select all that apply) Options: Reduced time to produce dependency map, Number of scenarios passed within tolerance, Percentage of critical gaps closed, No regulatory findings on resilience, Board acceptance of resilience statement, Reduced mean time to detect/recover
• What outstanding concerns or constraints would give you pause before committing to a pilot?
• Is there any other context, historical issue, or stakeholder dynamic we should know that would change how we approach your organisation?

How Did We Get Here? (A Quick Check‑In)

• Who is the day‑to‑day owner driving your operational resilience program today? Options: COO, Head of Operational Resilience, CRO, CIO/CTO, Head of Third‑Party Risk, Other
• Give a brief factual summary of the recent nine‑hour outage and its immediate business impacts.
• Which customer‑facing services were most visibly degraded or unavailable during the outage? Options: Payment processing, Retail banking portal, Card authorization, Lending origination, Claims processing, Other
• How did your board and executive team react within the first 72 hours? Options: Demanded immediate root‑cause and remediation plan, Requested dependency map within 30 days, Asked for a regulatory‑facing statement, Escalated to external PR/legal, No substantive direction yet, Other
• What timeline has leadership imposed for delivering a complete dependency map and quarterly scenario testing cadence? Options: Immediate (within 2 weeks), 30 days, 60–90 days, By next quarter, Not yet defined

So this outage was a warning — or a new normal?

• What makes you think the nine‑hour outage was a one‑off rather than the first sign of systemic fragility?
• Do you have evidence that the root cause was isolated (internal process) or systemic (third‑party/vendor/cloud)? Options: Internal application/configuration, Third‑party vendor failure, Cloud region/ISP outage, Combined/multi‑factor, Still under investigation/unknown
• Were there any services or teams that successfully routed around the failure? Tell us which ones and how they did it.
• How worried are you that undocumented single points of failure still exist? Options: Extremely worried, Very concerned, Somewhat concerned, Not concerned
• Has any regulator or examiner signaled an immediate review or requested evidence since the outage? Options: Yes — explicit request, Informal inquiry, No contact yet, Unsure

Where the Paper Plans Fail: What We Really Need to Know

• If an examiner opened your business continuity binders right now, what key claims could you not substantiate?
• Do you maintain formal continuity plans for each critical business service, or are they consolidated at a program level? Options: Service‑level plans for each critical service, Consolidated program‑level plans, Hybrid (some service plans, some program), No formal plans
• When were those plans last exercised end‑to‑end (not just tabletop)? Options: Within last 3 months, 3–6 months, 6–12 months, Over 12 months, Never
• Which inventory areas do you believe are incomplete or unreliable today? (select all that apply) Options: People/roles/backup contacts, Applications and services, Technology components (DBs, queues), Networks & cloud regions, Third parties & subcontractors, Facilities (data centers, offices)
• Where do you suspect dependency data is missing most — and why do you think it went undocumented?

Show Me the Map — Can You Point to Every Dependency?

• Can you honestly point to every third party, cloud region, and internal service whose failure would break a critical customer journey? Options: Yes — we can point to each dependency, Partially — some dependencies mapped, No — we cannot identify all dependencies
• Do you currently have a live dependency map (service→technology→vendor) that updates from telemetry or inventories? Options: Yes — dynamic and integrated, Static map (manual updates), Partial automation, No map
• Which classes of resources are already mapped (select all that apply)? Options: Business processes/services, Applications/microservices, Databases & storage, Networks & cloud regions, People & roles, Third‑party vendors
• How visible are vendor concentration points (e.g., single vendor providing a shared capability across services)? Options: High visibility — documented and monitored, Some visibility — known for major vendors only, Low visibility — ad hoc awareness, No visibility
• Which telemetry or feeds do you currently integrate with any mapping tool (select all that apply)? Options: CMDB/asset inventory, Cloud provider APIs (AWS/Azure/GCP), SIEM/logs, APM/tracing, Third‑party vendor portals, None
• Who owns each layer of the map (business, application, infrastructure, vendor) and how often are they accountable for updates?

If the Board Asked for Proof Today, What Would You Deliver?

• Would your current evidence package support a PRA/ECB/OCC spot‑check without ad hoc followups? Options: Yes — fully supportable, Partially — gaps exist, No — insufficient evidence
• Have impact tolerances been defined for your most critical services, and who set them? Options: Defined by CRO/Risk, Defined jointly with COO/CIO, Drafted but not approved, Not defined
• What concrete artifacts would you be able to present to prove a scenario test (logs, telemetry, remediation tickets, board slides)? Options: Test run recordings & telemetry, Remediation tracking and closure evidence, Board‑ready summary statement, Third‑party attestations, We cannot produce these today
• What parts of the regulator checklist give you the least confidence (e.g., mapping, tolerances, scenario realism, governance)? Options: Mapping completeness, Impact tolerance justification, Scenario realism and scope, Test evidence & audit trail, Governance and escalation paths
• How often does the board expect a resilience update, and what would they accept as the minimum evidence in that update? Options: Quarterly with evidence, Semi‑annual summary, Annual statement only, Board hasn't specified

What Would Real, Stressful Testing Look Like Here?

• If we simulated a simultaneous cloud‑region failure plus your largest payment vendor outage, what would your end‑to‑end customer impact likely look like?
• Have you ever executed a scenario using actual services and vendor inputs (not just tabletop)? Options: Yes — full live scenario, Hybrid (some live components), Only tabletop exercises, Never
• Who would be required to participate in a regulator‑grade scenario run (roles, teams, vendor contacts)?
• How are scenario failures tracked and closed today (ticketing systems, project trackers, or informal emails)? Options: Formal ticketing with SLA, Project tracker with owners, Ad hoc emails/meetings, No tracking
• What time window of system telemetry would you expect to present as evidence for a single scenario run? Options: Full run logs + 24h before/after, Run logs only, Summary metrics, Unsure

What Would Never Happen Again If You Had the Right Visibility?

• If you could never be surprised by an undocumented single point of failure again, what would change for your team and the board?
• What are the top three outcomes you need from a resilience platform to regain regulatory confidence? Options: Complete, evidence‑backed dependency maps, Regulator‑aligned scenario testing, Clear impact tolerance framework, Automated evidence collection for exams, Ongoing governance cadence & reporting
• What impact tolerances feel realistic today for your two most critical services (name service and tolerance in hours or % customers affected)?
• Which reporting format would the board find most convincing: a concise board‑ready statement, a technical appendix with full evidence, or both? Options: Board‑ready statement only, Technical appendix only, Both statement and appendix
• How much executive time and budget could you realistically allocate over the next 90 days to close top‑tier mapping and testing gaps? Options: Significant (dedicated budget & time), Moderate (some resources), Limited (tight constraints), None currently
• What would cause you to say ‘this solved the problem’ three months after deployment?

Quick Inventory: Concrete Inputs We'll Need to Start Mapping

• Which of these source systems can you provide access to for automated mapping (select all that apply)? Options: CMDB/asset inventory, Cloud provider accounts (AWS/Azure/GCP), Vendor portals/SSO, APM/tracing tools, Network/topology data, None available currently
• Do you have a canonical list of critical business services and their business owners we can use as the mapping seed? Options: Yes — up to date, Yes — but needs validation, No canonical list, Partially (top services only)
• Which teams should be invited to initial discovery workshops (select all that apply)? Options: Business service owners, CIO/Infrastructure, Risk & Compliance/CRO, Third‑party risk team, Legal/PR, Customer operations
• What constraints should we be aware of before proposing integrations or automated data pulls (legal, vendor contracts, security approvals)?
• Realistically, when could you provide the first batch of inventories and owner contacts for an initial mapping sprint? Options: Within 1 week, 1–2 weeks, 2–4 weeks, Longer than a month, Not sure

Quick Snapshot — Who's in the Room?

• Which role are you answering these questions for? Options: COO / Program owner, CRO / Impact tolerance owner, CIO / Technology owner, Head of Operational Resilience, Board risk lead, Other (please specify)
• Which best describes your organisation? Options: Large global bank, Large regional bank, Major insurance company, Specialist financial services firm, Holding company / conglomerate, Other (please specify)
• Briefly describe the recent outage that triggered this work (services affected, public impact, duration).
• Who formally owns the resilience programme and which roles are expected to be engaged in delivery? (pick all that apply) Options: COO / Programme owner, CRO / Risk owner, CIO / Tech owner, Head of Operational Resilience, Head of Third‑Party Risk, Legal / Compliance, Other — specify
• What is the immediate board ask or regulatory trigger we should prioritise in this engagement? Options: Full dependency map for all critical services, Quarterly scenario testing cadence, Board-ready resilience statement, Remediation plan for gaps identified, Other — specify

If This Happens Again, What Breaks First?

• If another nine-hour outage hit tomorrow, what would materially change about customer trust, market confidence, or regulator scrutiny?
• How concerned are you that undocumented single points of failure exist in your critical services? Options: Extremely concerned, Very concerned, Somewhat concerned, Not concerned / confident
• Which areas do you suspect are the most fragile right now? (select all that apply) Options: Third‑party vendor concentration, Cloud / region dependencies, Data availability and integrity, People / role single points, Physical facilities, Configuration and change management, Other — specify
• Tell us about any regulator interactions, supervisory findings, or near misses related to resilience in the last 24 months.
• How does this threat feel politically inside your organisation—an urgent executive priority, a board crisis, or a longer-term program? Options: Immediate board crisis, Executive priority with deadlines, Operational program workstream, Compliance checkbox / low priority

Where the Data Lives — Can We Map It?

• Imagine we attempted a full dependency map tomorrow and key inventories were missing—whose problem would that be and what would likely happen?
• Do you have an authoritative, single-source inventory of critical business services today? Options: Yes — centralised and maintained, Partial — service lists exist but fragmented, No — spreadsheets / local lists only, Not sure
• Which primary systems currently hold the data we’ll need to map dependencies? (select all that apply) Options: CMDB / ITSM, Vendor registry / third‑party portal, Business unit spreadsheets, GRC platform, Cloud provider consoles (AWS/Azure/GCP), HR / org charts, Other — specify
• What access method would we most likely use to ingest data from each source? (pick all that apply) Options: API (preferred), Database read / SQL, SFTP / file drops, Manual CSV upload, No direct access — would need extraction by your team, Unsure
• Who are the nominated data stewards or owners responsible for inventories, and how reachable are they for mapping work?

Integration Reality Check — Can We Execute Scenarios?

• What would stop us from executing a realistic scenario against your live topology this quarter?
• Do you have non‑production environments that faithfully mirror production for testing? Options: Yes — production parity for key services, Partial — some services mirrored, No — little to no parity, Unsure / need help assessing
• Are there contractual, privacy, or regulatory constraints that limit what data or vendor behaviours we can simulate? Options: Yes — significant constraints, Some constraints but manageable, No constraints, Unsure — need legal review
• Who provides authorisation for simulated outages, data extracts, or vendor testing (select all that apply)? Options: Business unit owner, CIO / IT security, Legal / Compliance, Third‑party vendor, Board or executive sponsor, Other — specify
• What telemetry or monitoring feeds can we integrate to validate scenario outcomes? (e.g., APM, network, vendor SLAs)

People, Governance, and the Clock — Who Moves Fast?

• If regulators requested evidence in 30 days, could your team produce a defensible dependency map and one scenario test report? Options: Yes — confident, Maybe — with focused support, No — would need more time, Unsure
• Please list the core team members (name, role, % availability) who will be allocated to the pilot phase.
• What governance cadence is realistic for delivery (select the cadence your leadership expects)? Options: Weekly delivery / steering, Biweekly, Monthly, Quarterly, Ad hoc as needed
• Are there fixed external deadlines we must align to (regulatory exam date, board meeting, public disclosure)? Please specify dates.
• Which internal KPIs or success metrics will convince the board that this solution is working? Options: Reduction in undocumented dependencies, Quarterly scenario pass rate, Evidence package completeness for exams, Reduced mean time to recovery estimates, Other — specify

What 'Board‑Ready' Actually Means to You

• When you imagine a board‑ready resilience statement, what would make you feel confident handing it to the board?
• Which formats of evidence are mandatory for your board/regulator? (select all that apply) Options: Executive summary / slide pack, Detailed dependency maps, Scenario test logs and timelines, Runbooks and remediation actions, Raw telemetry extracts, Other — specify
• Which regulatory frameworks or examiner expectations must we explicitly align to for your institution? Options: UK PRA, ECB / DORA, US OCC, Local regulator, Internal audit, Other — specify
• What acceptance thresholds or impact tolerances are already defined versus what still needs to be set? Options: Fully defined and approved, Drafts exist, Not defined, Don't know — need support
• Who must formally sign off the final resilience statement and evidence package? Options: COO, CRO, CIO, Head of Operational Resilience, Board risk committee, Other — specify

Hidden Costs, Politics, and What Breaks the Plan

• What's the single internal objection that could stop deployment even if the technical work is flawless?
• Which teams are most likely to resist deeper dependency mapping and why? (select all that apply) Options: Infrastructure / Cloud, Application owners, Third‑party management, Legal / Compliance, Business units, Other — specify
• Have previous cross‑functional programmes failed because of resource shortages, procurement delays, or conflicting priorities? Tell us one short example.
• Are there procurement, licensing, or budget cycles we must align to before we begin work? Options: Yes — specific window, Yes — flexible within quarter, No constraints, Unsure
• Are employee privacy, union rules, or data residency concerns likely to affect our ability to ingest or simulate data? Options: Significant impact, Some impact but manageable, No impact, Unsure — need legal review

What Would Make You Say Yes — The Minimal Viable Win

• If we removed your top three obstacles in the next 30 days, what specific deliverable would make you sign off on a pilot?
• Which pilot scope would you prefer as the fastest route to board confidence? Options: Single critical business service (end‑to‑end), Bundle of 3–5 high‑risk services, Technology stack / third‑party focused pilot, Enterprise discovery pilot
• What is an acceptable timeline to complete an initial pilot and present board‑ready results? Options: 2–4 weeks, 1–2 months, 3 months, Longer than 3 months
• Who must be present on the decision call to approve the pilot (name or role)?
• Are there any immediate compliance or legal steps you want us to begin before technical work (SLA reviews, DPA amendments, NDAs)? Options: Yes — start now, Yes — but after scoping, No immediate steps, Unsure — ask legal

Opening: A Quick Snapshot

• Which role are you completing this with today? Options: COO, CRO, CIO, Head of Operational Resilience, CISO, Legal/Compliance, Other
• Briefly describe the outage that prompted this program — what failed, when, and for how long?
• Which customer-facing services were most visibly impacted? Options: Payments processing, Online banking/web portal, Mobile apps, Loan origination, Claims processing, Customer support/contact centre, ATM/POS services, Other
• How quickly did leadership treat this as an operational resilience issue and who was assigned program ownership? Options: Immediately — COO owned, Within 24 hours — COO/Resilience lead, Within a week — CIO-led, Multiple owners/steering group, No single owner yet, Other
• What regulatory or examiner engagement has followed the incident (tick all that apply)? Options: PRA inquiry (UK), ECB / DORA engagement (EU), OCC / US supervisory contact, Informal regulator questions, Public enforcement or fine, None yet, Other
• What timeline do you have in mind to produce a board-ready resilience statement? Options: Immediate (<30 days), 1–3 months, 3–6 months, 6–12 months, No timeline yet

If This Happens Again, Who's Going to Answer?

• Who will be on the hook if a similar outage results in an examiner finding — and are those people prepared to defend the record today?
• Please confirm the primary decision roles and owners for the resilience program. Options: COO, CRO, CIO, Head of Operational Resilience, Legal/Compliance, Procurement, Vendor Management Office, Other
• How do the COO, CRO, CIO and Head of Resilience currently coordinate—formal governance, periodic check-ins, or ad-hoc? Options: Formal governance committee (regular), Monthly alignment meetings, Ad-hoc when issues arise, Siloed handoffs across functions, Other
• Who is responsible for setting and signing off on impact tolerances within your organisation? Options: CRO, COO, Board/Board Risk Committee, Regulatory/Compliance, Cross-functional committee, Not yet assigned
• When there’s disagreement on tolerances or protections, how are trade-offs resolved and recorded?
• How would the executive team feel if they had to publicly account for unresolved third‑party concentration after the next outage? Options: Confident and prepared, Uneasy but capable, Very uncomfortable, Prefer not to speculate

Where the Maps Stop and the Unknown Starts

• Which critical services could you not fully trace end‑to‑end if an examiner asked for a complete dependency map tomorrow? Options: Payments processing, Card acquiring / gateway, Settlement/clearing, Customer authentication, Loan origination, Claims adjudication, Other
• List the top three vendors, platforms or cloud regions where you suspect there may be undocumented single points of failure.
• Do you maintain a central, searchable inventory of technology components, third parties and facilities that can be used to build dependency chains? Options: Yes — live automated inventory (CMDB integrated), Yes — manual spreadsheets, Partial — fragmented sources, No central inventory
• Which data sources are unreliable or missing when you try to stitch together service→technology→vendor dependencies? Options: CMDB / asset inventory, Vendor contracts and SLAs, Network / topology maps, Application ownership records, Telemetry / logs, Cloud tenancy mappings, None — all present
• How often is your dependency mapping refreshed and who signs off on updates? Options: Continuous / automated, Weekly, Monthly, Quarterly, Ad-hoc / infrequently
• Tell us about a specific incident where an undocumented dependency caused escalation — what lingered and why?

When Regulators Knock, What Will They See?

• What is the single most likely gap an examiner would flag in your current resilience program?
• Which regulatory frameworks does your resilience program aim to satisfy? Options: PRA / UK operational resilience, ECB / DORA, OCC / US guidance, Local/national regulators, Multiple jurisdictions, Unsure
• How are impact tolerances defined today—by service, by customer cohort, by transaction, or not formally defined? Options: By critical business service, By customer segment/class, By transaction type, Not formally defined, Other
• Do you have documented acceptance criteria and evidence templates that would satisfy a regulator’s request? Options: Yes — evidence templates and packs ready, Partial — templates only, No — nothing formalised, Unsure
• When was the last regulator-focused review of your resilience controls or reporting? Options: Within 3 months, 3–12 months ago, >12 months ago, Never
• Who in your organisation would be the named owner for examiner-facing evidence and submissions? Options: Head of Operational Resilience, Legal / Compliance, CIO, CRO, External consultant, Multiple owners

Do Your Scenarios Mirror Reality — Or Your Paper Plans?

• When you run scenario tests, do they simulate compound, real-world failures (e.g., a cloud-region outage plus a vendor outage) or do you run simplified checklists? Options: Realistic compound scenarios, Mostly idealised tabletop checklists, We don’t run scenario tests, Hybrid / some realistic, some checklist
• Which actual services and vendor telemetry feeds are included in your current scenario runs? Options: Payments platform, Core banking systems, Primary cloud provider, Identity & authentication providers, Third-party payment gateway, Network/telemetry feeds, None
• How do you validate that scenario outcomes meet your declared impact tolerances (e.g., automated metrics, executive sign-off)? Options: Automated quantitative metrics, Executive / CRO sign-off, Narrative post-mortem, No formal validation, Other
• Have you ever run a live scenario against production‑like services (not just synthetic test data)? If yes, what did you learn?
• How often do you conduct cross-functional exercises that include business owners, tech teams and key third parties? Options: Monthly, Quarterly, Bi-annually, Annually, Never
• What currently prevents you from running realistic, high‑impact scenarios more frequently? Options: Risk of customer impact, Lack of test environment / integrations, Vendor contractual limits, Governance objections, Resource constraints, Other

What Would 'Board‑Ready' Sound Like?

• If the Board asked you to prove payments resilience in one slide, what key element would you be missing right now?
• Which metrics would most convince the Board—pick all that apply? Options: Time-to-recover (RTO) vs tolerance, % of customers affected, Estimated financial impact, Vendor concentration score, Testing cadence & outcomes, Regulatory compliance status
• Does the Board require quarterly scenario testing results and a formal resilience statement as a condition of acceptance? Options: Yes — formal requirement, Yes — informal expectation, Not currently required, Unsure
• How do you typically present resilience evidence to the Board today—dashboards, slides, narrative, live demo, or other? Options: Dashboards, Slide decks, Narrative reports, Live simulation demo, Ad-hoc emails or memos, Other
• What would make the Board stop asking for more detail—standardised evidence packs, live demos, third‑party attestation, or regulatory confirmation? Options: Standardised evidence pack, Live demo of scenario, Third-party attestation, Regulatory sign-off, Other
• How comfortable are you with the current level of transparency to the Board about unresolved resilience gaps? Options: Very comfortable, Somewhat comfortable, Uncomfortable, Prefer to limit disclosure

What Would It Take to Close the Critical Gaps?

• What would you be willing to change—process, budget, vendor terms, or architecture—to remove a material single point of failure within 90 days? Options: Re-architect service, Add redundancy/alternate vendor, Renegotiate vendor contracts/SLA, Increase monitoring and telemetry, Not prepared to change within 90 days, Other
• What internal resources can you commit to mapping, testing and evidence collection (FTE count, SMEs, budget)? Options: Dedicated team & budget, Shared resources across functions, Ad-hoc SME availability, Rely on external partner, No resources available
• Which governance cadence would be most effective for you—weekly runbooks, monthly execution reviews, or quarterly board-ready reporting? Options: Weekly execution stand-ups, Bi-weekly working group, Monthly governance review, Quarterly board reporting, Other
• What contractual or procurement barriers with third parties limit scenario testing or telemetry sharing today?
• How do you define success for a resilience improvement—fewer outages, faster recovery, improved regulator feedback, or reduced customer impact? Options: Faster recovery (RTO), Fewer incidents, Positive regulator feedback, Reduced customer complaints/impact, Cost reduction, Other
• If we proposed a time‑boxed pilot to validate one payment service end‑to‑end in 30 days, what would need to be true for you to greenlight it?

Ready, Set, Validate

• Can you currently run a regulator‑aligned scenario and produce examiner‑grade evidence with your existing tools? Options: Yes — ready now, Partially — needs automation or templates, No — cannot with current toolset, Unsure
• Which types of evidence do you capture today during tests? Select all that apply. Options: System logs and traces, Telemetry dashboards (metrics), Third‑party attestations or reports, Video or session recordings, Playbooks and step notes, None
• Do you have test environments that reliably mirror production for the services you must validate? Options: Full mirrored environments, Partial / subset mirrors, Sandbox or feature flags only, No production-like environments, Unsure
• Who is expected to sign off that a test met impact tolerances and that evidence is exam-ready? Options: CRO, Head of Operational Resilience, COO, Board Risk Committee representative, Legal / Compliance, Multiple signatories
• What typical inhibitors stop you from closing evidence gaps after a test—time, data access, vendor cooperation, or competing priorities? Options: Lack of time / capacity, Insufficient data access, Vendor cooperation limits, Tooling gaps, Competing business priorities, Other
• If we delivered a validation checklist that mapped each board acceptance criterion to specific evidence artifacts, what single feature would be most valuable to you?
• When would you like to schedule an initial discovery workshop to capture the critical-service map and run a baseline scenario? Options: Immediately, Within 2 weeks, 2–6 weeks, 2–3 months, Unsure