Topic starter
11/07/2026 8:33 pm
TL;DR: HKMA OR-2 asks banks to prove they can see critical dependencies, contain disruption, and recover through severe but plausible scenarios, according to Illumio. Dependency mapping and tested containment decide whether critical services stay available when an incident spreads.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “How to Meet HKMA OR-2 Compliance with Illumio”.
By the numbers:
- ICBC’s 2023 ransomware attack disrupted its U.S. broker-dealer operations.
Key questions
Q: Why do hidden dependencies increase operational resilience risk in banking?
A: Hidden dependencies turn small incidents into service-wide outages because teams cannot predict which processes, vendors, or workarounds will fail together.
Q: How do banks know whether containment controls are actually working?
A: They know it by testing whether a disruption can be isolated without taking down connected critical services.
Q: What breaks when a bank cannot map critical dependencies for OR-2?
A: The bank loses the ability to prove which services are essential, how disruption spreads, and where containment should begin.
Practitioner guidance
- Map critical service dependencies end to end Build and maintain a live view of how business services, data flows, third parties, and manual workarounds connect so OR-2 evidence reflects the current operating model.
- Prove containment with disruption scenarios Run exercises that show how a compromised segment, failed vendor, or cyber event can be isolated while unaffected services continue to operate.
- Test recovery through realistic banking failure modes Include customer communication, regulator reporting, and manual processing fallbacks in scenarios that mirror the bank’s actual interdependencies.
Bottom line: HKMA OR-2 is less about writing resilience policies and more about proving that critical business services can still operate when disruption spreads.
Glossary terms: Containment, Operational Resilience, Impact tolerance, Dependency Mapping
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 48 minutes ago by NHI Mgmt Group
11/07/2026 8:59 pm
Visibility is the first governance control OR-2 really tests: banks cannot prove resilience if they cannot see how services, systems, vendors, and manual workarounds connect. Documentation without dependency clarity creates an assurance gap that only appears when disruption hits. The control issue is not theoretical mapping, it is whether the institution can explain its own operational topology under stress.
A question worth separating out:
Q: What should banks do when OR-2 resilience testing exposes manual workarounds?
A: Treat the workaround as a control signal, not an operational inconvenience. If staff must rely on alternate channels or ad hoc procedures to keep trading, servicing, or reporting alive, the bank should review the dependency, the access path, and the containment boundary that failed. The goal is to eliminate ungoverned recovery habits before they become normal practice.
👉 Read our full editorial: HKMA OR-2 compliance depends on visibility and containment