Resilience, the way it should be done. End-to-end.
Operational resilience maturity across seven pillars, practitioner-authored. Most resilience tools stop at business continuity. This module covers the full picture - strategy, business, technology, supplier, cyber, AI system resilience, and crisis management.
ISO 22301 · 27001
NIST CSF 2.0
End-to-end. Not just BCP.
Most resilience tools focus on business continuity and disaster recovery. That's one slice of the picture. Real operational resilience needs seven connected disciplines - strategy at the top, crisis at the bottom, with five domain-specific resilience layers in between.
Stop at BCP / DR.
Covers the full stack.
Seven pillars. One resilience score.
Each pillar is practitioner-authored, scored on the unified 0–4 scale, and weighted into the cross-domain cascade. Together they answer the only question that matters: can the organisation absorb shock and keep operating?
Resilience Governance & Strategy
Board-approved resilience strategy, executive accountability, three-lines model, risk appetite cascade, committee charters, regulatory alignment.
Business Resilience
Critical operations, customer-impact assessment, tolerance levels, BCP framework, RTO/RPO discipline, recovery strategies and exercise discipline.
Technology Resilience
Application and infrastructure resilience, redundancy, failover, capacity, change management, technology lifecycle, cloud and platform dependencies.
Supplier Resilience
Material service provider resilience, exit planning, joint testing, contractual resilience clauses, fourth-party visibility, concentration risk.
Cyber Resilience
Ransomware-specific scenarios, immutable backup posture, recovery testing, integration with cyber module, secure-by-design recovery.
AI System Resilience
Model failure modes, drift detection, fallback paths, AI dependency mapping, autonomous-decision recovery, model retraining discipline.
Crisis Management & Communication
Crisis team activation, severity model, internal and external communications, stakeholder management, regulator engagement, post-incident discipline.
Five levels. One unified scale.
Every resilience pillar is scored on the 0–4 maturity scale - the same scale every other MaturityOne module uses. So resilience maturity reconciles directly with Cyber, Third Party Risk and Compliance.
Score once. Map to many.
Every regulatory add-on is a clause-level mapping from the resilience maturity score to a specific standard. Four add-ons live today, covering the full AU regulatory landscape.
Full mapping to CPS 230 operational resilience requirements. The Australian prudential standard for operational risk. Maps critical operations, tolerance levels, BCP, scenario testing, and material service providers. Required by July 2025.
The Australian prudential standard for information security. Maps resilience to CPS 234 capability requirements, control implementation and incident notification. Relevant for the cyber-resilience overlap.
The international standard for business continuity management systems. Maps maturity to ISO 22301 clauses 4–10 - context, leadership, planning, support, operation, and performance evaluation.
Annex A control mapping for resilience-relevant controls. Maps to controls covering business continuity, incident management, supplier relationships and physical security.
NIST Cybersecurity Framework 2.0 - Recover function focus. Particularly the Recover (RC) and the new Govern (GV) function added in CSF 2.0. Widely adopted globally.
The EU Digital Operational Resilience Act - covers ICT risk management, incident reporting, testing, and third-party risk. Required by EU financial entities since Jan 2025.
Resilience scope is set by other modules.
You cannot run a resilience program without knowing which services are critical. MaturityOne wires Resilience into the specialist modules that define its scope.
From Enterprise Risk to tolerance windows
Board-set risk appetite drives recovery objectives by criticality tier. Critical service classification from Enterprise Risk drives the resilience module's in-scope list.
From tolerance breaches to residual risk
Failed disaster recovery tests and lessons-learned flow back into Enterprise Risk as residual risk signals. Tolerance breaches flow into Compliance for reporting.
Triggers fire from cyber and TP
A material cyber incident automatically triggers a resilience tolerance review. A critical vendor incident triggers a recalculation. Live, not annual.
Two views. One source of truth.
The resilience lead sees granular detail across all 7 pillars and underlying capabilities. The board sees a single score, the cascade impact, and CPS 230 conformity status.
Per-pillar breakdown with weighted markers.
Resilience lead sees per-question scores, evidence references, reviewer comments, and the gap-to-target.
Single score with CPS 230 conformity.
Executive sees a single number, downstream cascade, regulatory conformity, and a plain-English board narrative.
Thirty minutes. A practitioner.
A walkthrough of the Resilience module isn't a product demo. It's a practitioner showing you how the seven pillars score, how CPS 230 maps clause-by-clause, and the honest picture of what it can and can't do. If we're not the right fit, we'll tell you.