How confidently could your organisation explain what it would actually deliver during a severe disruption today?
The FCA’s Operational resilience: demonstrating resilience in practice, published on 11 November 2026, emphasises evidence of current capability. Its observations are not new requirements.
Below, we follow its six findings themes, with a short summary of each followed by our practical interpretation for crisis response. Independent out-of-band communications have a supporting role across these areas, alongside the wider operational arrangements needed to protect services and customers.
The FCA finding: Stronger assessments connect service disruption to harm, using measures beyond elapsed time and explaining current capability.
Putting this into practice
A recovery estimate gives your response team only part of the picture. During an incident, people also need to understand which customers are affected, what is becoming urgent and which temporary actions are available.
Consider a disruption to payments. Technical teams may be working towards restoration while operations identifies customers facing immediate financial difficulty. Leadership needs both perspectives to decide where to direct resources.
Your response arrangements should bring that information together, assign responsibility for decisions and distribute agreed instructions. Record the assumptions behind each decision so that they can be revisited as the situation changes.
Where Sentinel supports the response
Sentinel gives incident teams an independent environment for sharing updates and coordinating action when everyday systems are unavailable or compromised. Teams can use secure channels to raise service impacts and escalate urgent decisions.
The platform supports coordination; the firm must still define its tolerances, assess customer harm and establish workable service continuity arrangements.
The FCA finding: Mapping should cover end-to-end dependencies, with supplier and shared-service assumptions challenged.
Putting this into practice
For crisis communications, map the complete route from an incident occurring to a responder taking action. Include the people authorised to activate the response, their contact information, the documents they need and the systems used to reach them.
Then examine the access path. A backup application may still require the same corporate identity provider, managed device or network connection as the tools it is intended to replace.
Ask practical questions:
Where Sentinel supports the response
YUDU Sentinel’s out-of-band platform operates outside your corporate infrastructure, with a dedicated single-tenant instance for each customer. This provides a separate environment for incident communications and collaboration.
Include Sentinel itself in your dependency assessment. Validate independent access arrangements, suitable devices and connectivity, and the responsibilities for keeping users and documents current.
The FCA finding: Testing should demonstrate service resilience under severe scenarios, including workaround limitations and competing recovery priorities.
Putting this into practice
Build an exercise around a service outcome your organisation needs to deliver. For example, ask participants to coordinate an urgent customer support process while a cyber incident prevents access to corporate systems.
Remove normal email and Teams from the exercise. Introduce an unavailable decision-maker, an uncertain supplier recovery estimate and a second affected service competing for resources.
Observe whether participants can establish contact, verify information, agree priorities and put the temporary process into operation. Extend the scenario far enough to reveal handover problems, growing backlogs or staff capacity constraints.
Useful evidence includes the time taken to obtain an urgent decision, whether instructions reached the right people and whether the proposed workaround was actually usable.
Where Sentinel supports the response
Sentinel can provide the communications environment used during both exercises and real incidents. Secure chat, video collaboration and access to critical documents allow participants to practise the response arrangements they would use when corporate tools are unavailable.
Use the exercise to test those arrangements directly. Participants should activate and use the fallback themselves, allowing observers to identify access failures and coordination delays.
The FCA finding: Remediation needs validation, with open and accepted risks distinguished from resolved weaknesses.
Putting this into practice
Suppose an exercise reveals that several responders cannot access the incident plan. Uploading a replacement document addresses one task, but further questions remain: do participants know where it is, have they downloaded the correct version and can they retrieve it under the original incident conditions?
Assign the improvement an owner, a completion date and a clear test of success. Repeat the failed task after making the change, using the relevant restrictions from the exercise.
For unresolved weaknesses, document the operational consequences and any interim measures. A team awaiting a wider technology change still needs to understand how it will respond in the meantime.
Where Sentinel supports the response
Sentinel’s critical document hosting and mobile offline access can support arrangements for making response material available outside corporate systems. Audit records can also help teams examine how communications performed during an exercise.
Validate the complete process, including document maintenance, user permissions and preparation for offline access. A deployed feature becomes useful when the people who need it can use it successfully.
The FCA finding: Communications need tested alternatives, clear approval routes and messages appropriate to affected audiences.
Putting this into practice
Separate the needs of your audiences. Incident responders need detailed operational information; staff need instructions; customers need relevant service updates; leadership needs a clear account of impact and decisions required.
Define who prepares, approves and distributes each type of message. Provide deputies and an alternative approval route if the usual approver cannot be reached.
Rehearse the transition to fallback communications. Staff need to recognise an authentic instruction, understand where to obtain updates and know how to report an urgent problem. During prolonged disruption, establish a sustainable update schedule and a process for correcting earlier information.
Where Sentinel supports the response
Sentinel combines mass notification and two-way communications with secure collaboration for response teams. This supports both alerting people and coordinating the work behind subsequent updates.
Choose channels against the scenario. Email will have limited value when corporate email is unavailable, while SMS and voice depend on telecommunications availability. Customer-facing arrangements also need to account for accessibility and people unable to use digital routes.
For the regulatory context behind this section, see the communications findings in the FCA’s original publication.
The FCA finding: Governance should evidence informed challenge, clear ownership and assurance, including visibility of group dependencies.
Putting this into practice
Give directors a briefing they can use to make decisions: the affected services, customer consequences, available options, uncertainties and decisions required. State who owns each action and when the next update will arrive.
During exercises, test whether leadership can receive that briefing and challenge its assumptions when normal collaboration tools are unavailable. Record the resulting decisions and the reasons behind them.
Afterwards, bring together service performance evidence, observer findings and the communications record. This helps reviewers assess whether decisions translated into action and whether improvements need further investment or scrutiny.
Where Sentinel supports the response
Sentinel provides an independent environment for leadership briefings and crisis collaboration. Channels and Spaces can organise response groups, while audit trails support subsequent review of communications and activity.
Those records can contribute to assurance alongside exercise results, service data and independent review. Effective oversight still depends on the quality of information presented and the challenge applied by the people responsible.
Use these six themes to plan an exercise that follows a service disruption from activation through to review. Identify the service outcome, map the response dependencies, test difficult conditions, validate improvements, rehearse messaging and involve leadership in real decisions.
Include a specific test of whether your response can operate without normal corporate communications. Record what participants achieve, where they struggle and what needs to change.
An independent out-of-band platform can support that work across the response. It forms part of a wider operational resilience capability; deploying it alone does not establish compliance or prove that services will remain within tolerance.
When your network goes down, your crisis response doesn’t have to.
Explore YUDU Sentinel’s out-of-band communications platform to see how your teams can stay connected during cyber incidents and IT outages.
Based on the six findings themes in the FCA’s Operational resilience: demonstrating resilience in practice, 11 November 2026. The practical examples and Sentinel applications are our interpretation. The FCA does not endorse Sentinel or prescribe a particular communications product.