What’s changed in operational resilience?
The BCI, in association with Riskonnect, is pleased to present its much‑anticipated Operational Resilience Report 2026, examining global progress and challenges over the past 12 months.
How is the scope of operational resilience changing?
This year’s research shows that operational resilience has moved beyond regulatory compliance, becoming an integral part of how organizations operate. There is also an awareness that external dependencies are more of a risk than ever before.
Over the past year, more organisations have implemented operational resilience programmes and regulatory expectations are expanding beyond financial services. This shift is reflected in frameworks such as the EU’s NIS2 Directive, which strengthens resilience requirements across sectors including energy, transport, healthcare, and the European Commission Critical Entities Resilience (CER) Directive outlining resilience requirements for critical infrastructure operators.
Organizations are also now subject to multiple region regulations and are relying on a wider mix of partners and suppliers. This increased pressure has placed third‑party risk and supply chain dependencies firmly in focus. Stronger regulatory scrutiny and the faster pace of change now mean that managing external dependencies is no longer optional, it is central to maintaining the delivery of important services.
New focus for organizations
With frameworks and governance structures largely in place, organizations are turning their attention from compliance to assurance.
Operational resilience is no longer focused solely on whether regulated firms have identified their important business services and tested severe-but-plausible scenarios, requirements. The emphasis has evolved to include timely, structured intelligence on incidents and the components that may trigger them.
What are the current challenges?
Despite strong progress, many organizations are struggling to turn high‑level plans into consistent, day‑to‑day practices across the business. Practitioners report that embedding resilience, securing adequate resources, and maintaining momentum beyond initial programme implementation remain key challenges.
As one practitioner noted, “I think the main challenge, and it is not unique to us, is the siloed nature of organizations. The question is how you embed resilience across every team and get them fully on board.”
What support do organizations need next?
Regulation has played an important role in raising awareness and engaging senior leaders, but as organizations move beyond the basics there is growing demand for clearer, more practical guidance from regulators. In order to move forward, the focus is now on turning expectations into action and on building operational resilience that is effective, sustainable, and built to last.
Over the past year, there’s been a clear shift in how organizations approach operational resilience. The primary driver for implementation is good practice with nearly 68% of respondents citing it as their organisation’s main reason for an operational resilience programme. It is evident that what was once treated primarily as a regulatory requirement is now widely recognised as a core part of how organizations operate and deliver essential services.
Maria Florencia Lombardero Garcia, Thought Leadership Manager at the BCI, said:
“As geopolitical instability, escalating cyber threats, regulatory complexity, and growing reliance on third parties continue to intensify globally, operational resilience has become a strategic business imperative rather than a compliance exercise. Organizations are now expected not only to withstand disruption, but to maintain critical services across increasingly interconnected supply chains and technology ecosystems. In this environment, resilience is fundamental to trust, continuity, and long-term sustainability”
Discover the insights and emerging risks shaping operational resilience today. Download the Operational Resilience Report 2026 to benchmark your programmes, explore expert analysis, and uncover actions and guidance you can apply immediately to your own organization.
Download the Report
More on
