---
title: "[OR] [GCash] [E2] [P3] [C14] Five Stages of the \"Sustain\" Phase"
description: "[OR] [GCash] [E2] [P3] [C14] Five Stages of the \"Sustain\" Phase"
image: https://blog.bcm-institute.org/hubfs/GCash%20Graphic%20Folder/%5BOR%5D%20%5BGCash%5D%20%5BP1%5D%20%5BS1-S5%5D%20%5BC14%5D%20Five%20Stages%20of%20the%20_Sustain_%20Phase.jpg
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Strengthening Operational Resilience at GCash: An Enterprise Implementation Guide
![BB OR \[B\] 11](https://blog.bcm-institute.org/hs-fs/hubfs/OR%20picture/OR%20Pictures%20A/BB%20OR%20Folder%20B/BB%20OR%20%5BB%5D%2011.jpg?width=2000&height=1333&name=BB%20OR%20%5BB%5D%2011.jpg "BB OR [B] 11")
# \[OR\] \[GCash\] \[E2\] \[P3\] \[C14\] Five Stages of the "Sustain" Phase
[![\[OR\] \[GCash\] \[Full Banner\] Strengthening Operational Resilience at GCash](https://no-cache.hubspot.com/cta/default/3893111/3a39ca09-f7ed-4e75-858f-941c41224c31.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3a39ca09-f7ed-4e75-858f-941c41224c31)
The **Sustain** phase ensures that Operational Resilience at **GCash** remains effective after the initial planning and implementation activities are complete.
[![x eBook Cover \[OR\] \[GCash\] \[E2\] \[2D\]](https://no-cache.hubspot.com/cta/default/3893111/31f88f39-251a-4717-874a-1adc1c9f5c77.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/31f88f39-251a-4717-874a-1adc1c9f5c77)Operational Resilience cannot be treated as a one-time project because the organisation’s products, technology, customer expectations, cyber threats, third-party relationships and regulatory requirements continue to evolve.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/a95777af-0036-479c-8f57-0f52ddb08108)The Sustain phase therefore focuses on embedding resilience into organisational culture, maintaining clear communication, building staff capability, assessing whether the framework remains effective and subjecting the programme to independent review.
For a highly digital financial services organisation such as GCash, sustaining resilience is especially important because weaknesses can emerge quickly as operating conditions, technology architectures, and external dependencies change.
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/cd40e631-43df-4dc6-85e8-3544d151d6d8)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) Aug 14, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### **[![\[OR\] \[GCash\] \[Disclaimer\] Legal Disclaimers and Usage of eBook Banner](https://no-cache.hubspot.com/cta/default/3893111/454a0c6c-3084-45f4-b724-65b4ca4eb6d1.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/454a0c6c-3084-45f4-b724-65b4ca4eb6d1)**
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/cd40e631-43df-4dc6-85e8-3544d151d6d8)
### **Introduction to GCash’s “Sustain” Phase of the Operational Resilience Planning Methodology**
#### Introduction
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/a95777af-0036-479c-8f57-0f52ddb08108)[![\[OR\] \[GCash\] \[E2\] \[P1\] \[S1-S5\] \[C14\] Five Stages of the Sustain Phase](https://no-cache.hubspot.com/cta/default/3893111/f4a2626b-1f0d-4cc3-9380-d0f94f333197.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f4a2626b-1f0d-4cc3-9380-d0f94f333197)
The **Sustain** phase ensures that Operational Resilience at **GCash** remains effective after the initial planning and implementation activities are complete.
Operational Resilience cannot be treated as a one-time project because the organisation’s products, technology, customer expectations, cyber threats, third-party relationships and regulatory requirements continue to evolve.
The Sustain phase therefore focuses on embedding resilience into organisational culture, maintaining clear communication, building staff capability, assessing whether the framework remains effective and subjecting the programme to independent review.
For a highly digital financial services organisation such as GCash, sustaining resilience is especially important because weaknesses can emerge quickly as operating conditions, technology architectures, and external dependencies change.
#### **Purpose of the Chapter**
[![\[OR\] \[PM\] \[P3\] How the Five Sustain Stages Work Together](https://no-cache.hubspot.com/cta/default/3893111/9eb31310-d86c-4079-8a3f-4d468f3ba820.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/9eb31310-d86c-4079-8a3f-4d468f3ba820)The purpose of this chapter is to introduce the reader to the **Sustain phase** of GCash’s Operational Resilience Planning Methodology and explain how its five stages help preserve and strengthen resilience capabilities over time.
While the Plan phase establishes direction and governance, and the Implement phase applies resilience requirements to Critical Operations, the Sustain phase ensures that the programme remains embedded, understood, measured, challenged and continuously improved.
It provides the mechanisms required to prevent Operational Resilience from becoming outdated, fragmented or reduced to a periodic compliance exercise.
By the end of this chapter, the reader should understand the purpose and sequence of the five Sustain stages—**Introduce Cultural Change, Develop Communication Strategy, Implement Training and Awareness, Provide Self-assessment, and Conduct Independent Quality Review**—and how each stage contributes to long-term Operational Resilience at GCash.
The reader should also recognise how these stages support ongoing governance, accountability, organisational learning, regulatory readiness and continuous improvement across Critical Operations.
#### **Introduction to GCash’s Operational Resilience Planning Methodology**
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/20a326ca-c911-4623-beaa-a91d9f3fb29c)GCash’s Operational Resilience Planning Methodology can be viewed as a three-phase lifecycle:
- The Plan phase establishes the strategic foundation.
- The Implement phase builds and tests resilience capabilities.
- The Sustain phase ensures that those capabilities remain effective over time.
Together, the three phases create a continuous resilience lifecycle rather than a linear project.
The Sustain phase answers five important questions:
- **Is Operational Resilience embedded into organisational behaviour?**
- **Are resilience expectations communicated clearly?**
- **Do employees understand their responsibilities?**
- **Does management periodically assess whether the programme remains effective?**
- **Is the programme independently challenged and assured?**
These questions correspond to five stages:
#### **Phase 3: Sustain**
**[](https://cta-redirect.hubspot.com/cta/redirect/3893111/62d152d9-6757-40e4-8e37-498c73bd9d50)**
The objective of the Sustain phase is to embed Operational Resilience into GCash's normal management and operating practices.
This means ensuring that resilience is not dependent upon:
- a single programme team;
- a regulatory deadline;
- one annual exercise;
- one executive sponsor; or
- one set of documents.
Instead, resilience should become part of:
- organisational culture;
- risk management;
- technology management;
- business decision-making;
- product development;
- supplier management;
- incident response;
- governance;
- performance measurement; and
- continuous improvement.
The Sustain phase therefore converts Operational Resilience from an implementation programme into an enduring organisational capability.
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/39c458ea-4c66-4a6d-a919-f8b6b2bd3b0f)
#### Stage 1: Introduce Cultural Change
###### \[Sustain Phase – Stage 1\]
The first stage is to **introduce cultural change**.
Operational Resilience cannot be sustained through policies and procedures alone.
Employees and management must understand that resilience is part of normal business responsibility.
The objective of cultural change is to establish behaviours where employees:
- understand the importance of Critical Operations;
- recognise vulnerabilities;
- escalate concerns promptly;
- consider resilience when making decisions;
- participate actively in exercises;
- learn from incidents;
- challenge unsafe assumptions; and
- take ownership of resilience outcomes.
For GCash, cultural change is particularly important because resilience spans multiple functions such as:
- Business Operations;
- Technology;
- Cybersecurity;
- Operational Risk;
- BCM;
- Customer Operations;
- Third-Party Risk;
- Compliance; and
- Product Management.
A strong culture of resilience reduces the risk that each function manages its responsibilities in isolation.
##### **Example for GCash**
Suppose a new digital payment feature is being developed.
Without an Operational Resilience culture, teams may focus primarily on:
- functionality;
- customer experience;
- speed to market; and
- commercial performance.
With a strong resilience culture, the project should also consider:
- whether the new feature supports a Critical Operation;
- technology dependencies;
- third-party concentration;
- recovery arrangements;
- transaction integrity;
- potential customer harm; and
- whether existing Tolerance for Disruption remains appropriate.
This demonstrates that resilience has become embedded into day-to-day decision-making.
##### **Key Output**
The outputs may include:
- Operational Resilience culture objectives;
- leadership messages;
- behavioural expectations;
- resilience values;
- performance-management criteria; and
- culture assessment results.
#### **Leadership and Cultural Change**
Leadership plays a critical role in sustaining Operational Resilience.
Senior management should consistently reinforce that Operational Resilience is:
- an enterprise responsibility;
- connected to customer outcomes;
- part of risk management;
- relevant to strategic decisions; and
- expected across all levels of the organisation.
Leadership actions may include:
- communicating resilience priorities;
- reviewing scenario-test results;
- challenging overdue remediation;
- recognising resilience improvements;
- including resilience in management objectives; and
- requiring resilience considerations within major business changes.
The tone set by senior management will strongly influence how seriously the organisation treats resilience.
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/1254b6b1-d231-458e-a683-65d65f753fa3)Stage 2: Develop Communication Strategy
###### \[Sustain Phase – Stage 2\]
The second stage is to **develop a communication strategy**.
Operational Resilience depends upon accurate and timely communication before, during and after disruption.
The communication strategy should therefore cover both:
**Routine resilience communication**
and
**Incident-related communication**
Routine communication helps employees understand:
- resilience priorities;
- Critical Operations;
- responsibilities;
- regulatory expectations;
- changes in resilience arrangements; and
- lessons from incidents and tests.
Incident communication supports:
- escalation;
- decision-making;
- customer notification;
- regulatory reporting;
- employee instructions;
- third-party coordination; and
- public communication.
##### **Example for GCash**
During a significant digital-wallet disruption, GCash may need coordinated communication across:
**Incident Management Team**
↓
**Executive Management**
↓
**Customer Support**
↓
**Technology and Cybersecurity**
↓
**External Providers**
↓
**Customers and Merchants**
↓
**Bangko Sentral ng Pilipinas**
Without an established communication strategy, different teams may provide inconsistent messages.
A predefined communication framework helps ensure that information is:
- accurate;
- approved;
- timely;
- coordinated; and
- appropriate for each audience.
##### **Key Output**
The outputs should include:
- Operational Resilience Communication Strategy;
- stakeholder communication matrix;
- escalation procedures;
- crisis communication protocols;
- regulatory notification procedures;
- message templates; and
- communication testing arrangements.
#### **Stakeholders in the Communication Strategy**
The communication strategy should identify all relevant stakeholder groups.
For GCash, these may include:
| Stakeholder | Communication Requirement |
| --- | --- |
| Board and Senior Management | Strategic resilience status and material concerns |
| Business Units | Operational responsibilities and vulnerabilities |
| Technology Teams | Recovery priorities and service impacts |
| Cybersecurity | Cyber threat and response information |
| BCM and Crisis Management | Incident coordination and continuity arrangements |
| Customers | Service availability and appropriate actions |
| Merchants | Payment or settlement impact |
| Employees | Operating instructions and escalation |
| Third Parties | Recovery coordination and dependency status |
| BSP | Required regulatory notifications and reporting |
| Internal Audit | Evidence supporting independent assurance |
Different stakeholders require different levels of information.
Communication should therefore be designed according to both audience and purpose.
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3f912f03-03f9-4a0b-980a-1b5eafa28fdb)Stage 3: Implement Training and Awareness
###### \[Sustain Phase – Stage 3\]
The third stage is to **Implement Training and Awareness**.
Training develops the knowledge and skills required to perform specific resilience responsibilities.
Awareness ensures that the wider organisation understands the importance of resilience.
The programme should therefore include both:
**General awareness**
and
**Role-specific training**
General awareness may cover:
- Operational Resilience concepts;
- Critical Operations;
- escalation;
- incident reporting;
- continuity responsibilities;
- cyber awareness; and
- customer impact.
Role-specific training should be more detailed.
##### **Example for GCash**
Different groups may require different training.
**Board and Senior Management**
- governance;
- risk appetite;
- Tolerance for Disruption;
- scenario-testing oversight;
- regulatory expectations.
**Critical Operation Owners**
- dependency mapping;
- tolerance setting;
- scenario testing;
- remediation.
**Technology Teams**
- technology resilience;
- failover;
- recovery;
- monitoring.
**Customer Operations**
- incident communication;
- customer harm;
- alternate procedures.
**Third-Party Risk Teams**
- provider resilience;
- concentration risk;
- contractual requirements.
This ensures that training is linked directly to responsibilities.
##### **Key Output**
The outputs should include:
- training strategy;
- annual training plan;
- role-based curriculum;
- attendance records;
- competency assessments;
- exercise participation records; and
- awareness materials.
#### **Testing Knowledge Through Exercises**
Training should not be limited to classroom or online learning.
Exercises are an important way to confirm whether employees can apply their knowledge during disruption.
GCash may use:
- tabletop exercises;
- simulation exercises;
- cyber incident exercises;
- technology failover exercises;
- crisis-management exercises;
- third-party exercises; and
- full end-to-end scenario tests.
For example, a tabletop exercise involving a prolonged payment outage may test whether participants understand:
- escalation thresholds;
- decision authority;
- Tolerance for Disruption;
- regulatory reporting;
- customer communication; and
- recovery prioritisation.
The results should feed back into the training programme.
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c1e2c603-05d8-4a06-bade-0a6c26d2ed54)
#### Stage 4: Provide Self-Assessment
###### \[Sustain Phase – Stage 4\]
The fourth stage is to **Provide Self-assessment**.
Self-assessment allows GCash to periodically evaluate whether its Operational Resilience Framework remains effective.
The purpose is not merely to confirm compliance.
It should determine:
- whether Critical Operations remain correctly identified;
- whether Tolerance for Disruption remains appropriate;
- whether dependency maps are current;
- whether Severe but Plausible Scenarios remain relevant;
- whether scenario testing is effective;
- whether third-party risks are understood;
- whether lessons are being implemented;
- whether governance remains effective; and
- whether resilience capability is improving.
Self-assessment should therefore be evidence-based.
##### **Example for GCash**
An annual self-assessment may identify that:
- Digital Wallet Operations remain a Critical Operation;
- dependency maps are current;
- the Tolerance for Disruption remains appropriate;
- scenario tests were completed;
- several vulnerabilities were identified;
- most remediation actions were completed;
- one high-priority third-party issue remains overdue.
The self-assessment should then explain:
**Current Status**
↓
**Evidence**
↓
**Gap**
↓
**Risk**
↓
**Required Action**
This gives management a structured view of programme effectiveness.
##### **Key Output**
The principal output should be an:
**Operational Resilience Self-Assessment Report**
#### **Recommended Self-Assessment Areas**
The assessment may cover:
| Assessment Area | Example Question |
| --- | --- |
| Governance | Are roles and accountabilities current? |
| Critical Operations | Are all significant operations identified? |
| Tolerance for Disruption | Are thresholds approved and still appropriate? |
| Dependency Mapping | Are internal and external dependencies current? |
| Scenario Testing | Have tests challenged Severe but Plausible Scenarios? |
| BCM | Are continuity strategies aligned to Critical Operations? |
| ICT Resilience | Are recovery capabilities validated? |
| Cyber Resilience | Are cyber scenarios integrated into testing? |
| Third-Party Risk | Are critical providers assessed and tested? |
| Incident Management | Are escalation and recovery arrangements effective? |
| Training | Are responsible personnel competent? |
| Remediation | Are findings closed within agreed timelines? |
| Reporting | Does management receive sufficient resilience information? |
The self-assessment should be supported by evidence rather than subjective opinion.
#### **Evidence for Self-Assessment**
Evidence may include:
- policies;
- governance minutes;
- Critical Operation registers;
- dependency maps;
- Tolerance for Disruption approvals;
- test reports;
- incident records;
- risk assessments;
- training records;
- third-party reviews;
- remediation registers;
- management reports; and
- audit findings.
This enables management to demonstrate the basis for its assessment.
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/41505b41-9239-435f-a63d-6e5132a6f5f9)Stage 5: Conduct an Independent Quality Review
###### \[Sustain Phase – Stage 5\]
The final stage of the Sustain phase is to conduct an I**ndependent Quality Review**.
Self-assessment provides management's view of resilience.
Independent review provides objective challenge.
The purpose is to determine whether:
- the Operational Resilience Framework is appropriately designed;
- governance is effective;
- methodology is being applied consistently;
- resilience evidence is reliable;
- vulnerabilities are appropriately managed;
- testing is sufficiently challenging; and
- management's assessment is reasonable.
Independent review should be conducted by parties sufficiently removed from the programme's operational implementation.
This may include:
- Internal Audit;
- independent risk assurance;
- external specialists; or
- other qualified assurance functions.
##### **Example for GCash**
Suppose GCash's self-assessment concludes that its Digital Wallet Operations can remain within the approved Tolerance for Disruption.
An independent review may examine:
- dependency maps;
- scenario-test evidence;
- failover performance;
- third-party participation;
- data-integrity results;
- recovery times;
- management decisions; and
- open remediation actions.
The reviewer may conclude that:
**Management Assessment:** Satisfactory
but identify:
**Independent Observation:** Recovery assumptions depend heavily on a critical third-party provider that has not participated in an end-to-end test.
This creates valuable independent challenge.
##### **Key Output**
The principal output should be an:
**Independent Operational Resilience Quality Review Report**
#### **Role of Internal Audit**
Internal Audit should provide an important element of independent assurance.
Its review may cover:
- governance;
- Critical Operation identification;
- Tolerance for Disruption;
- dependency mapping;
- scenario-testing quality;
- third-party resilience;
- ICT resilience;
- cyber resilience;
- remediation management;
- management reporting; and
- regulatory compliance.
Internal Audit should remain independent from the teams responsible for designing and operating the Operational Resilience programme.
#### **How the Five Sustain Stages Work Together**
The Sustain phase can be understood as a continuous reinforcing cycle.
**Stage 1**
**Introduce Cultural Change**
Ensures resilience becomes part of organisational behaviour.
↓
**Stage 2**
**Develop Communication Strategy**
Ensures resilience information reaches the right stakeholders.
↓
**Stage 3**
**Implement Training and Awareness**
Ensures people have the required knowledge and capability.
↓
**Stage 4**
**Provide Self-assessment**
Determines whether the framework remains effective.
↓
**Stage 5**
**Conduct Independent Quality Review**
Provides objective assurance and challenge.
↓
**Continuous Improvement**
The results then feed back into culture, communication, training and programme improvement.
#### **Example Sustain Phase for GCash**
| Sustain Stage | Core Question | Example Application to GCash | Key Output |
| --- | --- | --- | --- |
| Stage 1 – Introduce Cultural Change | Is resilience embedded into behaviour? | Include resilience considerations in product, technology and risk decisions | Culture Programme |
| Stage 2 – Develop Communication Strategy | Is resilience information communicated effectively? | Establish customer, management, employee and BSP communication protocols | Communication Strategy |
| Stage 3 – Implement Training and Awareness | Do people understand their responsibilities? | Provide role-based resilience training for management, Critical Operations owners and technical teams | Training Programme |
| Stage 4 – Provide Self-assessment | Is the framework still effective? | Conduct annual assessment of Critical Operations, tolerances, tests and remediation | Self-Assessment Report |
| Stage 5 – Conduct Independent Quality Review | Has the programme been independently challenged? | Internal Audit or independent specialists review resilience capability | Independent Review Report |
#### **Relationship Between the Three Phases**
GCash's complete Operational Resilience methodology can now be viewed as:
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/8f21052d-df77-4800-a1aa-d8814f521b1f)
This produces a complete Operational Resilience lifecycle.
#### **Integration with Business Continuity Management**
The Sustain phase should also reinforce GCash's BCM programme.
Examples include:
| Sustain Activity | BCM Connection |
| --- | --- |
| Cultural Change | Continuity responsibility becomes embedded |
| Communication Strategy | Crisis communication is strengthened |
| Training and Awareness | BCP roles and responsibilities remain understood |
| Self-assessment | BCM effectiveness is periodically reviewed |
| Independent Review | BCM receives objective assurance |
Operational Resilience, therefore, strengthens BCM by situating continuity capabilities within a broader enterprise resilience framework.
#### **Sustaining Technology and Cyber Resilience**
For GCash, technology and cyber resilience require continuous attention.
The Sustain phase should ensure that:
- technology dependencies remain current;
- cyber threats are reassessed;
- recovery procedures are updated;
- failover capabilities are tested;
- capacity remains adequate;
- changes are assessed for resilience impact;
- vulnerabilities are remediated; and
- lessons are incorporated into technical architecture.
A system that was resilient twelve months ago may no longer remain resilient after:
- architecture changes;
- new integrations;
- increased transaction volumes; or
- new cyber threats.
Sustainment therefore requires continual reassessment.
#### **Sustaining Third-Party Resilience**
Third-party relationships also change over time.
GCash should periodically reassess:
- critical provider status;
- concentration risk;
- subcontractors;
- recovery capability;
- service performance;
- incident history;
- contractual resilience obligations; and
- exit arrangements.
Critical providers should also participate in relevant scenario-testing activities where feasible.
This helps ensure that external dependencies remain aligned with GCash's resilience requirements.
#### **Sustaining Resilience Through Metrics**
The Sustain phase should include measurable indicators.
Possible measures include:
- percentage of Critical Operations assessed annually;
- percentage of dependency maps updated;
- percentage of scenario tests completed;
- percentage of personnel trained;
- percentage of high-risk remediation actions completed on time;
- number of Critical Operations breaching Tolerance for Disruption;
- number of material incidents;
- number of overdue third-party resilience actions;
- number of repeat findings; and
- number of unresolved independent assurance findings.
These indicators allow management to determine whether Operational Resilience is improving or deteriorating.
#### **Continuous Improvement Cycle**
The Sustain phase should operate as an improvement cycle:
**Culture**
↓
**Communication**
↓
**Training**
↓
**Assessment**
↓
**Independent Review**
↓
**Lesson Identified**
↓
**Remediation**
↓
**Improved Capability**
↓
**Reassessment**
This ensures that Operational Resilience evolves continuously.
### **[![\[Banner\] \[Summing\] \[OR\] \[E2\] \[C14\] Five Stages of the _Sustain_ Phase](https://no-cache.hubspot.com/cta/default/3893111/5667aa64-e221-49b1-b02b-b4a00910c56b.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/5667aa64-e221-49b1-b02b-b4a00910c56b)**
The **Sustain phase** ensures that GCash's Operational Resilience programme remains effective after the initial Plan and Implement activities are complete.
Its five stages—**Introduce Cultural Change, Develop Communication Strategy, Implement Training and Awareness, Provide Self-assessment, and Conduct Independent Quality Review**—create the organisational mechanisms required to embed resilience, maintain employee capability, communicate effectively, assess programme effectiveness and provide independent assurance.
Together, these activities transform Operational Resilience from a project into an enduring management capability.
For GCash, sustainment is especially important because the digital financial services environment is constantly evolving.
Technology architectures evolve, transaction volumes grow, cyber threats develop, third-party relationships change, and customer expectations increase.
Operational Resilience must therefore be regularly reassessed and improved.
When the Sustain phase operates effectively alongside the Plan and Implement phases, GCash can maintain a continuous lifecycle of **planning, implementation, testing, learning, assurance and improvement**, strengthening its ability to protect customers and continue Critical Operations through severe disruption.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/3aefb2d2-3110-47c1-ad4f-d3e6e5381066)
Blogs marked \[x\] are under construction
[![\[OR\] \[GCash\] \[3/4 Banner\] Strengthening Operational Resilience at GCash](https://no-cache.hubspot.com/cta/default/3893111/f32c765b-c3ba-4ed6-bd15-6dc928547f19.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f32c765b-c3ba-4ed6-bd15-6dc928547f19)
| **C1** | **C2** | **C8** | **C14** | | | |
| --- | --- | --- | --- | --- | --- | --- |
| [![\[OR\] \[GCash\] \[E2\] \[C1\] OR Planning Methodology](https://no-cache.hubspot.com/cta/default/3893111/9b28ba29-58a9-45d1-81fb-45f5db254385.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/9b28ba29-58a9-45d1-81fb-45f5db254385) | [![\[OR\] \[GCash\] \[E2\] \[P1\] \[S1-S5\] \[C2\] Five Stages of the Plan Phase](https://no-cache.hubspot.com/cta/default/3893111/f8047da8-0830-4215-a8aa-753a4cf258b3.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f8047da8-0830-4215-a8aa-753a4cf258b3) | [![\[OR\] \[GCash\] \[E2\] \[P1\] \[S1-S5\] \[C8\] Five Stages of the Implement Phase](https://no-cache.hubspot.com/cta/default/3893111/4e62cb7c-f73d-48a7-9652-264863e1294c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4e62cb7c-f73d-48a7-9652-264863e1294c) | [![\[OR\] \[GCash\] \[E2\] \[P1\] \[S1-S5\] \[C14\] Five Stages of the Sustain Phase](https://no-cache.hubspot.com/cta/default/3893111/f4a2626b-1f0d-4cc3-9380-d0f94f333197.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f4a2626b-1f0d-4cc3-9380-d0f94f333197) | | | |
| ##### "Sustain" Phase of the Operational Resilience Planning Methodology | | | | | |
| --- | --- | --- | --- | --- | --- |
| **C14 \[x\]** | **C15 \[x\]** | **C16 \[x\]** | **C17 \[x\]** | **C18 \[x\]** | **C19 \[x\]** |
| [![\[OR\] \[GEN\] \[E2\] \[P3\] \[C14\] The Five Stages of the Sustain Phase](https://no-cache.hubspot.com/cta/default/3893111/931ae9fa-0925-4f30-ba78-fa9be7662fb7.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/931ae9fa-0925-4f30-ba78-fa9be7662fb7) | [![\[OR\] \[GEN\] \[E2\] \[P3\] \[S1\] \[C15\] Introducing Cultural Change Management](https://no-cache.hubspot.com/cta/default/3893111/3909fd60-d099-4324-a1d2-2040171a7300.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3909fd60-d099-4324-a1d2-2040171a7300) | [![\[OR\] \[GEN\] \[E2\] \[P3\] \[S2\] \[C16\] Developing a Communication Strategy](https://no-cache.hubspot.com/cta/default/3893111/d3bcd703-2173-4eba-90c3-7d45da459f94.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d3bcd703-2173-4eba-90c3-7d45da459f94) | [![\[OR\] \[GEN\] \[E2\] \[P3\] \[S3\] C17\] Implementing Training and Awareness](https://no-cache.hubspot.com/cta/default/3893111/1e095f66-dca9-4a83-9850-e459cebddbfa.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1e095f66-dca9-4a83-9850-e459cebddbfa) | [![\[OR\] \[GEN\] \[E2\] \[P3\] \[S4\] \[C18\] Providing Self-Assessment](https://no-cache.hubspot.com/cta/default/3893111/076a795c-4733-4fb0-b260-fcec767fb221.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/076a795c-4733-4fb0-b260-fcec767fb221) | [![\[OR\] \[GEN\] \[E2\] \[P3\] \[S5\] \[C19\] Conducting Independent Quality Reviews](https://no-cache.hubspot.com/cta/default/3893111/2cff3f12-e08e-43cf-8ca6-aaa6efe33631.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2cff3f12-e08e-43cf-8ca6-aaa6efe33631) |
| | | | | | |
Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-08-24T17:25:25.253Z",
"datePublished" : "2026-08-14T03:53:46.000Z",
"headline" : "[OR] [GCash] [E2] [P3] [C14] Five Stages of the \"Sustain\" Phase",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-gcash-e2-p3-c14-five-stages-of-the-sustain-phase",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```