[OR] [P2] [S1] [CBS] [C1] Introduction to Identifying Critical Business Services

[P2] [S1] Chapter 1

Identifying Critical Business Services (CBS)

Introduction

 The identification of Critical Business Services (CBS) represents the starting point of any effective Operational Resilience (OR) programme.

In an increasingly complex and interconnected operating environment—where disruptions can arise from cyber threats, third-party failures, regulatory changes, or systemic shocks—organisations must clearly understand which services are essential to their customers and stakeholders.

This chapter introduces the concept of CBS, explains its purpose, and establishes its role as the foundation for building resilience capabilities.

Purpose of Identifying Critical Business Services in Operational Resilience

The primary purpose of identifying CBS is to enable organisations to focus their resilience efforts on the services that are most vital to their stakeholders.

Rather than attempting to make every process or system resilient, organisations prioritise the continuity of services whose disruption would cause significant harm.

By identifying CBS, organisations can:

• Establish clear priorities for resilience planning and investment
• Define measurable resilience objectives, such as impact tolerances
• Align business continuity, crisis management, and risk management efforts
• Demonstrate compliance with regulatory expectations

This targeted approach ensures that resilience is both effective and proportionate, concentrating resources where they will have the greatest impact.

Importance of a Service-Centric Perspective

A key shift in operational resilience is the move from a process-centric view to a service-centric perspective. Traditional approaches often focus on internal processes, systems, or functions. However, customers and stakeholders experience outcomes—not processes.

A service-centric perspective emphasises:

• The end-to-end delivery of value to customers
• The integration of multiple processes, systems, and teams into a single service outcome
• The importance of maintaining service continuity regardless of internal disruptions

For example, while multiple internal processes support “Deposit Transactions Processing,” the customer perceives a single service: the ability to access and manage their funds.

CBS identification must therefore reflect this external, outcome-based view.

Link Between CBS Identification and Resilience Outcomes

CBS identification is not an end in itself—it directly enables key components of the operational resilience framework. Once CBS is defined, they serve as the basis for:

• Impact Tolerance Setting:  the maximum acceptable level of disruption for each critical service
• Mapping and Dependency Analysis: Understanding the resources required to deliver each service
• Scenario Testing: Evaluating the organisation’s ability to maintain services under severe but plausible disruptions
• Crisis Management: Prioritising response and recovery actions based on service criticality

This linkage ensures that resilience activities are coherent, measurable, and aligned with the organisation’s most important services.

By focusing on services that matter most to customers and stakeholders, organisations can move beyond fragmented, process-driven approaches and adopt a structured, outcome-oriented resilience strategy.

This chapter sets the stage for the subsequent sections, which will define CBS in detail, explore regulatory expectations, and provide a practical methodology for identifying and managing these critical services.