Operational resilience is moving from documentation and compliance toward demonstrable technical capability. New regulations such as NIS2 and DORA require critical infrastructure providers, such as banks, to demonstrate that their mission-critical services can sustain disruptions.