BCBS Principles for Operational Resilience (2021)
The Basel Committee's seven principles for operational resilience in banks: governance that sets a tolerance for disruption to critical operations, operational risk management that reassesses controls on change and after incidents, business continuity plans exercised under severe but plausible scenarios, mapped interconnections and interdependencies, third-party due diligence and exit strategies, life-cycle incident management, and resilient ICT including cyber security with immutable offline backup of critical data.
BCBS Principles for Operational Resilience (2021) is a compliance framework from International (Basel Committee member jurisdictions) with 7 domains and 21 controls. The largest domains are Principle 1 Governance (paragraphs 16 to 19) – BCBS Principles for Operational Resilience (2021) (4 controls), Principle 3 Business continuity planning and testing (paragraphs 23 to 27) – BCBS Principles for Operational Resilience (2021) (4 controls), Principle 6 Incident management (paragraphs 33 to 36) – BCBS Principles for Operational Resilience (2021) (4 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (7)
Principle 1 Governance (paragraphs 16 to 19) – BCBS Principles for Operational Resilience (2021)
| Code | Title |
|---|---|
| bcbs-principles-for-operational-resilience-2021::P1-16 | Board approval of the operational resilience approach and the tolerance for disruption, tested against severe but plausible scenarios, with policies for capability shortfalls |
| bcbs-principles-for-operational-resilience-2021::P1-17 | Senior management implements the approach under board oversight and allocates financial, technical and other resources to it |
| bcbs-principles-for-operational-resilience-2021::P1-18 | Timely senior management reporting to the board on the resilience of business units, especially where deficiencies could affect critical operations |
| bcbs-principles-for-operational-resilience-2021::P1-19 | Board communication of the approach and its objectives to personnel, third parties and intragroup entities |
Principle 2 Operational risk management (paragraphs 20 to 22) – BCBS Principles for Operational Resilience (2021)
| Code | Title |
|---|---|
| bcbs-principles-for-operational-resilience-2021::P2-20 | Operational risk function working with other functions to address threats to critical operations and coordinate continuity, third-party, recovery and resolution planning |
| bcbs-principles-for-operational-resilience-2021::P2-21 | Controls and procedures to identify and assess threats in a timely way, with effectiveness reassessed regularly, on change to critical operations and after incidents |
| bcbs-principles-for-operational-resilience-2021::P2-22 | Change management used to assess effects on critical operations and their interconnections and interdependencies |
Principle 3 Business continuity planning and testing (paragraphs 23 to 27) – BCBS Principles for Operational Resilience (2021)
| Code | Title |
|---|---|
| bcbs-principles-for-operational-resilience-2021::P3-23-24 | Forward-looking business continuity plans that identify critical operations and dependencies and incorporate impact analysis, recovery strategies, testing, training, communication and crisis management, exercised under severe but plausible scenarios |
| bcbs-principles-for-operational-resilience-2021::P3-25 | Regular exercises covering critical operations and their interconnections, including third parties and intragroup entities, that build staff awareness and response capability |
| bcbs-principles-for-operational-resilience-2021::P3-26 | Plans give detailed guidance for disaster recovery, set roles and succession of authority for key personnel, and define decision-making and invocation triggers |
| bcbs-principles-for-operational-resilience-2021::P3-27 | Consistency between the continuity plans for critical operations and critical third-party services in recovery and resolution plans and the operational resilience approach |
Principle 4 Mapping interconnections and interdependencies (paragraphs 28 to 30) – BCBS Principles for Operational Resilience (2021)
| Code | Title |
|---|---|
| bcbs-principles-for-operational-resilience-2021::P4-28 | Map the people, technology, processes, information, facilities and their interconnections and interdependencies needed to deliver each critical operation, including third-party and intragroup dependencies |
| bcbs-principles-for-operational-resilience-2021::P4-29-30 | Harmonise mapping with recovery and resolution plans and map at a granularity sufficient to find vulnerabilities and support continuity testing |
Principle 5 Third-party dependency management (paragraphs 31 to 32) – BCBS Principles for Operational Resilience (2021)
| Code | Title |
|---|---|
| bcbs-principles-for-operational-resilience-2021::P5-31 | Risk assessment and due diligence before entering third-party or intragroup arrangements, including verification of at least equivalent operational resilience |
| bcbs-principles-for-operational-resilience-2021::P5-32 | Continuity, contingency and exit strategies for third-party failure, with scenarios that assess substitutability and alternatives such as bringing the service in-house |
Principle 6 Incident management (paragraphs 33 to 36) – BCBS Principles for Operational Resilience (2021)
| Code | Title |
|---|---|
| bcbs-principles-for-operational-resilience-2021::P6-33 | Inventory of internal and third-party incident response and recovery resources |
| bcbs-principles-for-operational-resilience-2021::P6-34 | Incident management scope covers the full life cycle: severity classification, response and recovery procedures linked to continuity plans, and internal and external communication with metrics and lessons learned |
| bcbs-principles-for-operational-resilience-2021::P6-35 | Periodic review, testing and updating of response and recovery procedures, with root causes identified and addressed to prevent recurrence |
| bcbs-principles-for-operational-resilience-2021::P6-36 | Lessons from own and others' incidents reflected in the programme, which covers all incidents including those arising from third parties and intragroup entities |
Principle 7 ICT including cyber security (paragraphs 37 to 38) – BCBS Principles for Operational Resilience (2021)
| Code | Title |
|---|---|
| bcbs-principles-for-operational-resilience-2021::P7-37 | Documented ICT and cyber security policy covering governance, risk ownership, security measures, periodic evaluation of controls, incident response, continuity and disaster recovery |
| bcbs-principles-for-operational-resilience-2021::P7-38 | Identify critical information assets and infrastructure, prioritise cyber efforts by risk, keep critical information intact through secure storage and immutable offline backup, and evaluate threats and vulnerabilities regularly |
What is BCBS Principles for Operational Resilience (2021) and who does it apply to?
BCBS Principles for Operational Resilience (2021) is a compliance framework from International (Basel Committee member jurisdictions) with 7 domains and 21 controls. The Basel Committee's seven principles for operational resilience in banks: governance that sets a tolerance for disruption to critical operations, operational risk management that reassesses controls on change and after incidents, business continuity plans exercised under severe but plausible scenarios, mapped interconnections and interdependencies, third-party due diligence and exit strategies, life-cycle incident management, and resilient ICT including cyber security with immutable offline backup of critical data. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does BCBS Principles for Operational Resilience (2021) actually require?
BCBS Principles for Operational Resilience (2021) has 21 controls organised across 7 domains. The largest domains are Principle 1 Governance (paragraphs 16 to 19) – BCBS Principles for Operational Resilience (2021) (4 controls), Principle 3 Business continuity planning and testing (paragraphs 23 to 27) – BCBS Principles for Operational Resilience (2021) (4 controls), Principle 6 Incident management (paragraphs 33 to 36) – BCBS Principles for Operational Resilience (2021) (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of BCBS Principles for Operational Resilience (2021) do I already cover?
BCBS Principles for Operational Resilience (2021) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement BCBS Principles for Operational Resilience (2021)?
Start your BCBS Principles for Operational Resilience (2021) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about BCBS Principles for Operational Resilience (2021) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 21 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required