The Sustain phase ensures that Operational Resilience at GCash remains effective after the initial planning and implementation activities are complete.
Operational Resilience cannot be treated as a one-time project because the organisation’s products, technology, customer expectations, cyber threats, third-party relationships and regulatory requirements continue to evolve.
The Sustain phase therefore focuses on embedding resilience into organisational culture, maintaining clear communication, building staff capability, assessing whether the framework remains effective and subjecting the programme to independent review.
For a highly digital financial services organisation such as GCash, sustaining resilience is especially important because weaknesses can emerge quickly as operating conditions, technology architectures, and external dependencies change.
While the Plan phase establishes direction and governance, and the Implement phase applies resilience requirements to Critical Operations, the Sustain phase ensures that the programme remains embedded, understood, measured, challenged and continuously improved.
It provides the mechanisms required to prevent Operational Resilience from becoming outdated, fragmented or reduced to a periodic compliance exercise.
By the end of this chapter, the reader should understand the purpose and sequence of the five Sustain stages—Introduce Cultural Change, Develop Communication Strategy, Implement Training and Awareness, Provide Self-assessment, and Conduct Independent Quality Review—and how each stage contributes to long-term Operational Resilience at GCash.
The reader should also recognise how these stages support ongoing governance, accountability, organisational learning, regulatory readiness and continuous improvement across Critical Operations.
The Plan phase establishes the strategic foundation.
The Implement phase builds and tests resilience capabilities.
The Sustain phase ensures that those capabilities remain effective over time.
Together, the three phases create a continuous resilience lifecycle rather than a linear project.
The Sustain phase answers five important questions:
These questions correspond to five stages:
The objective of the Sustain phase is to embed Operational Resilience into GCash's normal management and operating practices.
This means ensuring that resilience is not dependent upon:
Instead, resilience should become part of:
The Sustain phase therefore converts Operational Resilience from an implementation programme into an enduring organisational capability.
The first stage is to introduce cultural change.
Operational Resilience cannot be sustained through policies and procedures alone.
Employees and management must understand that resilience is part of normal business responsibility.
The objective of cultural change is to establish behaviours where employees:
For GCash, cultural change is particularly important because resilience spans multiple functions such as:
A strong culture of resilience reduces the risk that each function manages its responsibilities in isolation.
Suppose a new digital payment feature is being developed.
Without an Operational Resilience culture, teams may focus primarily on:
With a strong resilience culture, the project should also consider:
This demonstrates that resilience has become embedded into day-to-day decision-making.
The outputs may include:
Leadership plays a critical role in sustaining Operational Resilience.
Senior management should consistently reinforce that Operational Resilience is:
Leadership actions may include:
The tone set by senior management will strongly influence how seriously the organisation treats resilience.
The second stage is to develop a communication strategy.
Operational Resilience depends upon accurate and timely communication before, during and after disruption.
The communication strategy should therefore cover both:
Routine resilience communication
and
Incident-related communication
Routine communication helps employees understand:
Incident communication supports:
During a significant digital-wallet disruption, GCash may need coordinated communication across:
Incident Management Team
↓
Executive Management
↓
Customer Support
↓
Technology and Cybersecurity
↓
External Providers
↓
Customers and Merchants
↓
Bangko Sentral ng Pilipinas
Without an established communication strategy, different teams may provide inconsistent messages.
A predefined communication framework helps ensure that information is:
The outputs should include:
The communication strategy should identify all relevant stakeholder groups.
For GCash, these may include:
|
Stakeholder |
Communication Requirement |
|
Board and Senior Management |
Strategic resilience status and material concerns |
|
Business Units |
Operational responsibilities and vulnerabilities |
|
Technology Teams |
Recovery priorities and service impacts |
|
Cybersecurity |
Cyber threat and response information |
|
BCM and Crisis Management |
Incident coordination and continuity arrangements |
|
Customers |
Service availability and appropriate actions |
|
Merchants |
Payment or settlement impact |
|
Employees |
Operating instructions and escalation |
|
Third Parties |
Recovery coordination and dependency status |
|
BSP |
Required regulatory notifications and reporting |
|
Internal Audit |
Evidence supporting independent assurance |
Different stakeholders require different levels of information.
Communication should therefore be designed according to both audience and purpose.
The third stage is to Implement Training and Awareness.
Training develops the knowledge and skills required to perform specific resilience responsibilities.
Awareness ensures that the wider organisation understands the importance of resilience.
The programme should therefore include both:
General awareness
and
Role-specific training
General awareness may cover:
Role-specific training should be more detailed.
Different groups may require different training.
Board and Senior Management
Critical Operation Owners
Technology Teams
Customer Operations
Third-Party Risk Teams
This ensures that training is linked directly to responsibilities.
The outputs should include:
Training should not be limited to classroom or online learning.
Exercises are an important way to confirm whether employees can apply their knowledge during disruption.
GCash may use:
For example, a tabletop exercise involving a prolonged payment outage may test whether participants understand:
The results should feed back into the training programme.
The fourth stage is to Provide Self-assessment.
Self-assessment allows GCash to periodically evaluate whether its Operational Resilience Framework remains effective.
The purpose is not merely to confirm compliance.
It should determine:
Self-assessment should therefore be evidence-based.
An annual self-assessment may identify that:
The self-assessment should then explain:
Current Status
↓
Evidence
↓
Gap
↓
Risk
↓
Required Action
This gives management a structured view of programme effectiveness.
The principal output should be an:
Operational Resilience Self-Assessment Report
The assessment may cover:
|
Assessment Area |
Example Question |
|
Governance |
Are roles and accountabilities current? |
|
Critical Operations |
Are all significant operations identified? |
|
Tolerance for Disruption |
Are thresholds approved and still appropriate? |
|
Dependency Mapping |
Are internal and external dependencies current? |
|
Scenario Testing |
Have tests challenged Severe but Plausible Scenarios? |
|
BCM |
Are continuity strategies aligned to Critical Operations? |
|
ICT Resilience |
Are recovery capabilities validated? |
|
Cyber Resilience |
Are cyber scenarios integrated into testing? |
|
Third-Party Risk |
Are critical providers assessed and tested? |
|
Incident Management |
Are escalation and recovery arrangements effective? |
|
Training |
Are responsible personnel competent? |
|
Remediation |
Are findings closed within agreed timelines? |
|
Reporting |
Does management receive sufficient resilience information? |
The self-assessment should be supported by evidence rather than subjective opinion.
Evidence may include:
This enables management to demonstrate the basis for its assessment.
The final stage of the Sustain phase is to conduct an Independent Quality Review.
Self-assessment provides management's view of resilience.
Independent review provides objective challenge.
The purpose is to determine whether:
Independent review should be conducted by parties sufficiently removed from the programme's operational implementation.
This may include:
Suppose GCash's self-assessment concludes that its Digital Wallet Operations can remain within the approved Tolerance for Disruption.
An independent review may examine:
The reviewer may conclude that:
Management Assessment: Satisfactory
but identify:
Independent Observation: Recovery assumptions depend heavily on a critical third-party provider that has not participated in an end-to-end test.
This creates valuable independent challenge.
The principal output should be an:
Independent Operational Resilience Quality Review Report
Internal Audit should provide an important element of independent assurance.
Its review may cover:
Internal Audit should remain independent from the teams responsible for designing and operating the Operational Resilience programme.
The Sustain phase can be understood as a continuous reinforcing cycle.
Stage 1
Introduce Cultural Change
Ensures resilience becomes part of organisational behaviour.
↓
Stage 2
Develop Communication Strategy
Ensures resilience information reaches the right stakeholders.
↓
Stage 3
Implement Training and Awareness
Ensures people have the required knowledge and capability.
↓
Stage 4
Provide Self-assessment
Determines whether the framework remains effective.
↓
Stage 5
Conduct Independent Quality Review
Provides objective assurance and challenge.
↓
Continuous Improvement
The results then feed back into culture, communication, training and programme improvement.
|
Sustain Stage |
Core Question |
Example Application to GCash |
Key Output |
|
Stage 1 – Introduce Cultural Change |
Is resilience embedded into behaviour? |
Include resilience considerations in product, technology and risk decisions |
Culture Programme |
|
Stage 2 – Develop Communication Strategy |
Is resilience information communicated effectively? |
Establish customer, management, employee and BSP communication protocols |
Communication Strategy |
|
Stage 3 – Implement Training and Awareness |
Do people understand their responsibilities? |
Provide role-based resilience training for management, Critical Operations owners and technical teams |
Training Programme |
|
Stage 4 – Provide Self-assessment |
Is the framework still effective? |
Conduct annual assessment of Critical Operations, tolerances, tests and remediation |
Self-Assessment Report |
|
Stage 5 – Conduct Independent Quality Review |
Has the programme been independently challenged? |
Internal Audit or independent specialists review resilience capability |
Independent Review Report |
GCash's complete Operational Resilience methodology can now be viewed as:
This produces a complete Operational Resilience lifecycle.
The Sustain phase should also reinforce GCash's BCM programme.
Examples include:
|
Sustain Activity |
BCM Connection |
|
Cultural Change |
Continuity responsibility becomes embedded |
|
Communication Strategy |
Crisis communication is strengthened |
|
Training and Awareness |
BCP roles and responsibilities remain understood |
|
Self-assessment |
BCM effectiveness is periodically reviewed |
|
Independent Review |
BCM receives objective assurance |
Operational Resilience, therefore, strengthens BCM by situating continuity capabilities within a broader enterprise resilience framework.
For GCash, technology and cyber resilience require continuous attention.
The Sustain phase should ensure that:
A system that was resilient twelve months ago may no longer remain resilient after:
Sustainment therefore requires continual reassessment.
Third-party relationships also change over time.
GCash should periodically reassess:
Critical providers should also participate in relevant scenario-testing activities where feasible.
This helps ensure that external dependencies remain aligned with GCash's resilience requirements.
The Sustain phase should include measurable indicators.
Possible measures include:
These indicators allow management to determine whether Operational Resilience is improving or deteriorating.
The Sustain phase should operate as an improvement cycle:
Culture
↓
Communication
↓
Training
↓
Assessment
↓
Independent Review
↓
Lesson Identified
↓
Remediation
↓
Improved Capability
↓
Reassessment
This ensures that Operational Resilience evolves continuously.
The Sustain phase ensures that GCash's Operational Resilience programme remains effective after the initial Plan and Implement activities are complete.
Its five stages—Introduce Cultural Change, Develop Communication Strategy, Implement Training and Awareness, Provide Self-assessment, and Conduct Independent Quality Review—create the organisational mechanisms required to embed resilience, maintain employee capability, communicate effectively, assess programme effectiveness and provide independent assurance.
Together, these activities transform Operational Resilience from a project into an enduring management capability.
For GCash, sustainment is especially important because the digital financial services environment is constantly evolving.
Technology architectures evolve, transaction volumes grow, cyber threats develop, third-party relationships change, and customer expectations increase.
Operational Resilience must therefore be regularly reassessed and improved.
When the Sustain phase operates effectively alongside the Plan and Implement phases, GCash can maintain a continuous lifecycle of planning, implementation, testing, learning, assurance and improvement, strengthening its ability to protect customers and continue Critical Operations through severe disruption.
Blogs marked [x] are under construction
| C1 | C2 | C8 | C14 | |||
"Sustain" Phase of the Operational Resilience Planning Methodology |
|||||
| C14 [x] | C15 [x] | C16 [x] | C17 [x] | C18 [x] | C19 [x] |
Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
|
If you have any questions, click to contact us. |
||
|
|