Operational vulnerability

The Operational vulnerability capability in Operational Resilience empowers users to flag operational vulnerabilities or critical functionality gaps, engage with key stakeholders, analyze underlying causes, and identify remedies.

Using Operational vulnerability, teams can address issues stemming from violations, software gaps, or breaches. Users can submit reports on operational vulnerabilities through the Employee Center or directly create a report in the Operational Resilience Workspace.

Some typical operational vulnerabilities include the following situations:

• Exposed customer data
• Third party issues
• Software defects
• Political or environmental situations

Benefits of Operational vulnerability

The Operational vulnerability capability offers the following advantages to your organization:

• Empowers business users to report any discrepancies, breaches, or complaints that need team attention.
• Enables creation from multiple sources like importance and impact tolerance assessments, scenario analyses, self-attestations, and services.
• Records impacted and related organizational areas requiring attention, such as entities, locations, users, and companies.
• Facilitates collaboration among teams to investigate, assess, gather evidence, record observations, and decide on responses for further review.
• Enables initiation of remediation and preventive measures and conducts root cause analysis to eliminate the source of the vulnerability.

Defining technical and operational vulnerabilities

In an organization, operational vulnerabilities can be categorized into main groups:

1. Technical vulnerabilities: These are substantial gaps, flaws, or weaknesses within an organization's IT infrastructure. This category includes deficiencies in security protocols, system designs, internal controls, or daily operational practices.
2. Operational vulnerabilities: These pertain to non-IT, process-related, or external factors that could impact an organization's operations. Typically, these involve issues with third parties, facilities, or external situations that evade detection by scanning tools.

Workflows for Operational vulnerability

Resolving an Operational vulnerability involves several key steps:

1. Identification: Recognize the operational gap.
2. Assessment: Evaluate if the vulnerability needs to be addressed. This assessment, which can be done once or repeatedly, involves weighing the repair costs against the potential savings from fixing the issue.
3. Decision-making: Based on the assessment, determine the course of action. If the decision is to address the vulnerability, complete the following tasks:
   • Task assignment: Assign specific tasks to the relevant individuals.
   • Completion and verification: Once tasks are completed, verify that the vulnerability has been resolved.
4. Alternative path as acceptance: After assessment, the vulnerability may be accepted as is. In this case, no further action is taken, and the vulnerability is acknowledged and closed.

Use cases for Operational vulnerability

The situations outlined in the following examples demonstrate operational vulnerabilities. These issues cannot be detected by IT scanners but can be identified by subject matter experts. They represent weaknesses or gaps in daily operations, such as working with a particular third party or depending on a single facility.

Scenarios	Description
Working with a third party or relying on a single facility	Consider a company outsourcing its critical processes to third parties from a particular geography. Due to current affairs, the third-parties are prevented from providing the services and the company is prevented from receiving services from this geography. With a commitment to deliver the services to the customers, the company must identify an alternate third-party swiftly to continue operations. The key takeaway for the company is to address the risk of third-party concentration.
Non-IT related vulnerability that requires manual intervention	Consider a vital financial institution situated in a distant location. If a nearby situation puts the area at risk, the management team might identify this as a vulnerability. This serves as another example of a non-IT related vulnerability that necessitates manual intervention.

To tackle these operational vulnerabilities, an organization could investigate various approaches such as diversifying third parties across multiple regions or moving financial facilities. To implement these solutions, an organization would usually perform a cost-benefit analysis, weighing factors like the cost of mitigating the operational vulnerability and whether the solution is a one-time fix, temporary measure, or permanent solution.