Operational Resilience
Consulting

Business continuity is the discipline: the plans and capability to keep operating through disruption. Operational resilience is the outcome regulators now supervise — demonstrating that your critical services stay within defined tolerance through cyber incidents, outages, and supplier failures, with evidence to prove it. Regimes like APRA CPS 230 and EU DORA define the resilience outcomes; ISO 22301:2019 provides the certifiable management system — BIA, recovery objectives, tested plans, continual improvement — that produces the evidence. In practice, an ISO 22301-grade BCMS is how a vendor operationalises operational resilience.

It depends on what your contracts say. In the UAE, the wave that began in December 2025 increasingly demands accredited ISO 22301 certification from banks’ critical suppliers, so alignment alone may not pass. Under SAMA, CPS 230, and DORA, customers typically need credible evidence — a BIA, recovery objectives, tested plans, exercise results — rather than a certificate per se, and a well-documented aligned BCMS often clears due diligence. We scope to what your contracts actually require and build the BCMS so you can step up to accredited certification without rework if a customer later insists on it.

Engagements are custom-scoped — to headcount, sites, the number of products in scope, your regulator or contract deadlines, and whether accredited ISO 22301 certification is included. We provide a fixed, all-inclusive quote after a short scoping call: no hourly billing, no scope creep. That covers scoping, the business impact analysis, RTO/RPO definition, continuity and crisis plans, exercising, and certification preparation. If you proceed to certification, the accredited certification body’s audit fees are billed separately by that body.

Plan on 8–16 weeks end to end: scoping and gap assessment in weeks 1–2, the BIA and risk assessment by week 5, the BCMS build through week 10, exercising and evidence by week 13, and certification-audit support through week 16 where certification is in scope. Smaller single-product vendors land at the lower end. If you are facing a hard contract deadline — a UAE bank cutoff or a CPS 230-driven renewal — we compress by running the BIA and plan build in parallel.

No — and you should be wary of anyone who offers both. TCSA is the implementation consultant: we build the BCMS, run the exercises, and prepare you for audit. The certificate is issued by an independent, accredited certification body after its own Stage 1 and Stage 2 audits, which keeps the certification credible to the banks and regulators reading it. We support you through both stages and stay on call for auditor questions.

In substance, yes — each regime asks a vendor for the same core artefacts: a business impact analysis, recovery objectives, documented and tested continuity plans, supplier-continuity arrangements, and incident response. We build those once, anchored on ISO 22301:2019, and map them outward to each regulator’s vocabulary. What differs is contract-specific detail — notification timelines, audit rights, exit plans — which we fold into the same BCMS rather than running parallel programmes. One caveat: we are implementation consultants, not regulatory counsel; interpretation of a regime’s legal obligations for your customer stays with their advisers.