Cyber and digital resilience
Cyber risk becomes systemic when shared software, shared providers or shared protocols let one compromise or one outage reach many organisations at once.
- 01In briefThe short answer
- 02Three mandatesThe field, seen three ways
- 03The systemic questionCommon dependencies and correlated outages
- 04FrameworksStandards and regulation
- 05CouplingsDigital dependencies everywhere
- 06GroundingThe methods behind the field
- 07Key termsTerms used on this page
GCRI · Institution · service level R0
The short answer.
Cyber and digital resilience as a field of risk covers the security and continuity of digital systems and the services that depend on them, against attack, failure and dependency on few providers. In the Nexus Consortium it is studied as science at GCRI by Cybersecurity and Digital Resilience as well as Quantum Technologies, governed at GRF by AI and Digital Governance, and understood financially at GRA by Fintech Nexus as well as Payments and Market Infrastructure; this gateway links those platforms and the methods they share.
Digital demand and connectivity in the Nordic and Baltic region.
Urban demand centres and the hubs that anchor digital and data infrastructure, shown for the Nordic and Baltic region as an example geography for this subject.
The field, seen three ways.
Science and evidence
Cybersecurity and Digital Resilience, Quantum Technologies, Digital Public Infrastructure
Financial understanding
Fintech Nexus, Payments and Market Infrastructure, Financial Cyber and Operational Resilience, Financial Crime and Fraud Risk
Common dependencies and correlated outages.
A widely used library vulnerability, a cloud region outage, a faulty update pushed to endpoints worldwide, or ransomware against a managed service provider produce correlated losses across sectors. Insurers and supervisors model these as accumulation scenarios; operators experience them as a dependency they could not see in their own risk register.
- Software supply chain: provenance and integrity of components (SBOM, SLSA).
- Concentration in cloud, identity and content delivery providers.
- Operational technology where cyber events have physical consequences.
- Cryptographic transition as quantum computing matures.
Standards and regulation.
| Framework or body | What it governs or supplies |
|---|---|
| NIST Cybersecurity Framework 2.0 | Govern, identify, protect, detect, respond and recover |
| ISO/IEC 27001 | Information security management systems |
| EU NIS2 and DORA | Cybersecurity duties for essential entities and digital operational resilience in finance |
| MITRE ATT&CK and CISA Known Exploited Vulnerabilities | Shared threat and vulnerability knowledge |
Digital dependencies everywhere.
- Infrastructure: industrial control systems.
- Financial stability: payment and market infrastructure.
- Digital public infrastructure: identity and payments at national scale.
- Quantum: migration to post-quantum cryptography, studied on Quantum.
The science sits on Cyber and Digital Resilience; methods start from cybersecurity.
The methods behind the field.
- Cybersecurity and cryptography
- Software and safety-critical systems engineering
- Communications and network technology
- Network science and contagion
- Reliability and resilience engineering
- Quantum computing, sensing and communication
- Physics and quantum science
- Materials science and chemistry
- Probability and statistics
- Digital identity and public digital systems
- Data engineering, interoperability and stewardship
- Payment and financial market technology
- High-performance, cloud and edge computing
- Distributed ledgers and digital assets
- Artificial intelligence and machine learning
- AI evaluation and assurance engineering
- Policy, institutional and decision science
Terms used on this page.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Cybersecurity | The protection of information and systems against unauthorised access, use, disruption, modification or destruction. |
| Operational resilience | The ability of a firm to deliver critical operations through disruption, by anticipating, absorbing, recovering from and adapting to it. |
| Cyber resilience | The ability to anticipate, withstand, recover from and adapt to adverse conditions, stresses and attacks on systems that use cyber resources, in NIST usage. |
| Operational technology | Hardware and software that monitor and control physical devices and processes. |
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Questions and answers.
Why does GCRI host field gateways?
Around GCRI.
Start with an enquiry.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.