Download the ORF & Supporting Materials
This page includes the Operational Resilience Framework, Maturity Model, Implementation Aids and Scenarios
ORF Rules - Overview of all components of the Operational Resilience Framework targeted to practitioners including information on the steps, rules, terminology, implementation aids, and future activities.
ORF Rules and Maturity Model (spreadsheet) - A spreadsheet containing the ORF v2 Rules and maturity model to serve as a vital tool for organizations to assess their operational resilience progress and readiness. Also includes a mapping of ORF Rules to associated NIST 800-53 and ISO 27001 controls.
ORF Glossary (spreadsheet) - a maturity model to serve as a vital tool for organizations to assess their progress and readiness in implementing operational resilience practices.
Scenarios and Exercises: The Business Resilience Council working groups continue to develop interactive scenarios and exercises that help provide context and understanding to participants. Please contact orf@grf.org to participate.
The President’s Council of Advisors on Science and Technology has submitted to the president the report “Strategy for Cyber-Physical Resilience: Fortifying Our Critical Infrastructure for a Digital World.” In the report, Global Resilience Federation’s work on maintaining operational resilience has been highlighted as an example of setting “minimum viable operating capabilities” from which to weather an attack or other adverse event.
This spring, Global Resilience Federation and Nacha held free tabletop exercises to allow organizations to assess resilience after a simulated, destructive wiperware incident that included a major ACH outage. The half-day event helped to increase operational resilience awareness and build greater maturity through the sharing of cyber risk, resilience and continuity practices. In addition to IT operations and risk, exercise components included media management, law enforcement and regulatory engagement, and an examination of prioritizations. Players discussed and took simulated action in the emergency as facilitators progressed the exercise timeline and injected additional information.
Acme Pipeline- Similar to Colonial Pipeline, this west coast company experiences a disruption. This document provides a short illustration of the steps ACME took to become more resilient by prioritizing customers, determining Minimum Viable Service Levels, and setting Service Delivery Objectives.
Enhancing Operational Resilience for ACH Network Participants– Co-authored by Nacha and Global Resilience Federation (GRF), the paper provides a strategic framework and guidance based upon the ORF to address the risk of ACH Network disruptions.