Operational resilience delivery

Most resilience work stops at the assessment.

The gap analysis lands, the board sees it, and the organisation discovers it has bought a roadmap it cannot actually drive.

If you are the person who will be asked whether you are ready for 18 March 2027, you need an answer you can defend. Not another document you cannot action.

If you are the person who will be asked how your organisation is meeting the reporting rules, you need an answer you can defend. Not another document you cannot action.

Who you would be working with

Twenty years delivering technology and resilience programmes inside UK regulated financial services, including Lloyds Banking Group, NatWest, Virgin Money, Tesco Bank, Royal London and Royal Bank of Scotland.

Most recently, an enterprise-wide accelerated recovery programme at a financial services organisation following a major cyber attack. Tier 1 and Tier 2 application criticality, recovery sequencing across cloud and on-premise estates, and business impact analysis against a £2.2M budget.

216 days to 18 Mar 2027

Three new obligations take effect on 18 March 2027

Report operational incidents to the regulator on a clock. Notify before taking on a material third party. Submit an annual register of every material third party arrangement you hold.

Most organisations track material outsourcing. The register goes wider, to all material third party arrangements. That is a bigger population, and in most organisations nobody has counted it yet.

The rules are in force. Supervisors are testing whether it works.

The question stopped being whether you are preparing. It is now whether your register holds up, whether your incident process can produce a report on the clock, and whether anyone owns either of them.

Registers assembled to meet a date rather than to be maintained tend to show it at the second annual submission. And an incident does not wait for a process to mature.

Who we work with

Built for organisations without a resilience department

If you are a large bank you already have a team and a Big Four firm on retainer. This is not for you. It is for everyone else caught by the same rules with a fraction of the resource.

Building societies Credit unions Specialist and challenger banks E-money and payment institutions Wealth and asset managers CASS firms Mid-tier insurers

If resilience currently sits with someone who already has another full-time job, you are exactly who this was built for.

What you end up with

Not a report. A plan you can fund.

Plenty of people will assess you. Very few hand you something your board can actually approve and your team can actually execute.

A numberHow many material third party arrangements you actually have, counted from source data rather than the register you already hold
A gap registerEvery gap with a named owner, a target date and an effort estimate. Not a list of concerns
A sequenced pathPrioritised, with internal effort sized in days and the external quotes you will need identified early enough to get them
A one-page board summaryWritten for the people who approve the budget, not for the people who read the detail
Three templates, yours to keepThe material third party register, the incident reportability criteria, and the board reporting pack
A ninety-minute readoutWalked privately with you first. You are never surprised in front of your own board

You do not leave knowing more. You leave holding something you can put in front of a board and fund.

How it works

Ten working days. You know the size of the problem within one week.

Delivered across three calendar weeks, because your diary is not empty.

Days 1 to 2Sponsor session to fix the board question. We read your registers, policies, incident log and last self-assessment.
Days 2 to 4We build the real third party population from contract, procurement and accounts payable data. Six to eight short conversations across your team.
Day 5You get the number. How many material third party arrangements you actually have, and the gap against what you are tracking today.
Days 6 to 8We trace two important business services end to end, walk a real past incident against the 24 hour expectation, and size the gaps.
Days 9 to 10Draft walked privately with you, then the board readout.

What we need from you

Six to eight conversations and a document folder. That is genuinely it. We do the digging, your people answer questions.

We work from exports rather than system access, so there is no security review to schedule and no access request to chase.

What people who have worked with Owen say

Twenty years of delivery, in other people's words

Recommendations published on LinkedIn.

I worked with Owen on two programmes, the first to migrate Oracle databases onto a private Oracle Cloud and on a separate initiative to plan the transfer of those databases onto the next generation of Oracle Cloud. Owen is a dedicated and driven PM that demonstrated his strength in working with a diverse range of stakeholders and grasping complex issues and bringing to resolution. Owen is a fantastic Senior PM and would very much recommend the value Owen brings to delivering complex change programmes.
Rob MarsdenProduct Leader, Lloyds Banking Group
I worked with Owen on a major project with very high visibility at board level. I am glad to say that I could absolutely rely 100% on Owen to manage the complex and critical infrastructure deliveries required to keep this programme on track. Owen is not only a strong reliable delivery manager, but also a pleasure to work beside.
Gary Sharp, PMPProgramme Manager, Financial Services
I worked closely with Owen on an O365 project which had it's challenges. Owen displayed resilience in the face of adversity and strong leadership qualities in steering his disparate team to get the project over the line which for me, was key to it's successful and timely delivery.
Nicola CooperSenior Information Security GRC Leader, Supply Chain Cyber Risk Management
I engaged with Owen on various projects when working at Clydesdale Bank. It was a pleasure to work with Owen who displayed excellent stakeholder management skills, commercial acumen, integrity and pragmatism. He understood the end to end Procurement process and contributed to ensuring deliverables were executed in a timely manner.
Susan McPhersonLead Supply Chain Manager, NatWest Group

Not a single point of failure

The scoping session and the diagnostic are delivered personally. There is no handover and no graduate in week two.

For the remediation that follows, Owen draws on a wider group of independent consultants he has worked alongside. Experienced practitioners across resilience, third party risk, infrastructure and programme delivery, who can be brought in for larger programmes of work.

You get one accountable person throughout. You do not get a team you did not ask for, and you do not hit a ceiling if the work turns out to be bigger than one person can carry.

What it costs

Published, because the hardest part of asking for help is not knowing if you can afford it

For context: comparable readiness assessments in this market run £15,000 to £25,000. A Big Four scoping exercise typically starts around £30,000. They are good firms doing thorough work. They are also priced for organisations several times your size.

Start small: scoping session

Half a day. We look at what you already have, tell you whether you have a real problem, and give you a straight answer on whether the full diagnostic is worth your money.

  • Ninety minutes with you and whoever owns resilience today
  • A one-page written view within 48 hours
  • An honest answer, including if that answer is that you are fine
£850Credited in full against the diagnostic if you go ahead.
Most organisations start here

The readiness diagnostic

Two weeks. You end up holding a costed, owned, sequenced plan your board can approve.

  • Everything in the section above
  • Fixed fee. No variable element, no overrun within scope
  • Delivered personally. No graduate arrives in week two
£6,500Credited in full against any remediation work commissioned within 60 days. If you go on to fix what we find, the diagnostic effectively cost you nothing.

Our guarantee

If, at the readout, you tell us we have shown you nothing you did not already know, we will not invoice the balance.

You pay half on signature and half on delivery. That means the decision is genuinely yours to make at the end, when you have seen the work, rather than at the start when you are taking us on trust.

Straight answers

The things you are probably thinking

Could we not just do this internally?

Often, yes. Two reasons organisations do not. Your people are too close to it, so the assumptions that have quietly become facts are invisible to them. And whoever owns resilience already has another full-time job, which is why it has slipped this far. A supervisor also gives more weight to an assessment somebody independent has signed their name to.

We have already done our self-assessment.

Most organisations have. In its March 2026 review the FCA noted that some firms state there is no scenario they would not be able to recover from, but include no evidence of having tested it against sufficiently severe scenarios. A self-assessment records what you believe. This tests whether it holds.

Why not ask our auditor or existing adviser?

Ask them. If they already do this work well for you, you do not need us. What they usually give you is an assessment, because assessment is what they are set up to do. The gap in this market is not knowing what is wrong. It is having someone who can run the fixing afterwards.

What if you find problems we cannot afford to fix?

A fair worry, and the reason some organisations avoid looking. A documented gap you have not closed is harder to defend than one you never found. So the plan is sequenced and costed by priority, not delivered as a flat list. You leave knowing what has to be done before March, what can wait until after, and what it costs. That is a fundable position, which an unranked list of forty findings is not.

How can you cost anything when third parties are involved?

We do not pretend to. Where a supplier has to do work, they will run their own scoping and come back with their own number, usually in six to eight weeks. What we give you is the internal effort sized in days, our own fees where relevant, and a clear list of what needs an external quote and who to ask. The value there is lead time rather than precision. Knowing in October that you need three quotes is what protects the March date. Discovering it in January does not.

We have never heard of you.

Correct. Resilience Restore Group Ltd is new. The twenty years behind it are not, and they are verifiable. Start with the £850 session, decide whether the thinking is any good, and commit to nothing further until you have seen it.

The method behind it

R.E.S.T.O.R.E.™

The diagnostic is not improvised. It runs against seven capabilities that decide whether an organisation survives disruption well or badly, each working on two lanes at once: what the organisation must do, and what the people in it must do.

RRecogniseRead the signals before the incident
EEstablishCount what you actually depend on
SSafeguardKeep the picture true as it changes
TTestProve the claim rather than state it
OOrchestrateAgree decision rights in advance
RRecoverKnow the order, not just the list
EEvolveKeep the capability afterwards

Boundaries

What we are not

Knowing where someone stops is as useful as knowing what they do.

  • We are not lawyers and we do not give legal or regulatory advice. Whether a specific arrangement is material remains your determination, made by your compliance and legal functions.
  • We are not auditors and this is not assurance. We will not sign anything off.
  • We are not your compliance function and we will not pretend to replace one.
  • We are delivery practitioners. We work alongside your risk and compliance people rather than competing with them.
  • If the work finds you are already in reasonable shape, that is the answer and we will say so. You will have paid to stop worrying, which is a fair trade.

Is your March 2027 readiness a number, or a view someone holds?

Half a day and £850 turns it into a number. If the answer is that you are fine, we will tell you that too.

Is your resilience a capability you own, or a report you filed?

Half a day and £850 will tell you which. If the answer is that you are in good shape, we will say so.

Book a scoping session

R.E.S.T.O.R.E FRAMEWORK waitlist

Full Name*
Company
Please fill all the required fields!
Please accept terms and conditions to proceed
Please wait