Digital operational resilience regimes require institutions to withstand, respond to and recover from ICT disruptions, including failures of third-party providers on which whole sectors depend. This section of the Digital, Cyber and AI subsite sets records for ICT dependencies, resilience testing, incident reporting and third-party concentration so that resilience is verified from evidence, with the trust and assurance system conformance observation applied. Every artifact of the area carries a UNI (Unique Nexus Identifier), which identifies and never certifies.
Context entry PROPOSED for the Nexus Standards registry.
Nexus Standards (2026). Cyber resilience and digital operational resilience: area brief, Digital, Cyber and AI (PROPOSED). https://nexustandards.com/digital-ai/cyber-resilience-and-digital-operational-resilience/. Last reviewed 2026-10-17.
Files carry the credits and the licence line; they are generated in your browser and nothing is sent. Downloads need script.
The risk disciplines section of Digital, Cyber and AI. Scope as the area context entry states it (PROPOSED).
In scope 5
Out of scope 3
Jurisdictions No jurisdiction note is recorded for this area yet; jurisdiction narrows what applies and never implies that a Nexus profile satisfies a law.
Each coupling names the mechanism that links this area to another; select a card on the canvas to trace it. Mechanisms are stated in the context bank (PROPOSED).
Fig.RUNNING marks the area you are reading; DONE an area in the same subsite, QUEUED an area elsewhere and GATE a subsite reached. Tags give reading order only, never a status. Design, not a record.
The Nexus Standards the area context entry lists. Every one is proposed or specified; none is adopted by an authority.
Status proposed · 12 rules stated. Read NS-0
Status proposed · 5 rules stated. Read NS-9
Status proposed · 7 rules stated. Read NS-10
Status proposed · 6 rules stated. Read NS-11
Status proposed · 4 rules stated. Read NS-12
Indicator names and codes as their stewards publish them; values appear only from a governed GRIx source, never typed into a page.
Relations are register entries (NS-14), never conformance or equivalence statements; hover or focus a relation for its meaning. Names of standards bodies and their standards belong to their stewards and are used only to identify the documents; no text of an external standard is reproduced here.
adopt2
NIST SP 800-207 Zero Trust ArchitectureNISTregister · nist-sp-800-207Open Security Controls Assessment Language (OSCAL)NISTregister · nist-oscalHazards and threats 5
Sectors 4
Sources the area reads or proposes. Delivery follows GRIx first; a source is shown live only after an owner decision admits it for public pages.
No legal register row admits any of these sources for live display on public pages yet, so nothing is read from them here. A register row that exists records the source for the governed GRIx path; admission for public pages is a separate owner decision.
Known Exploited Vulnerabilities cataloguepending admission
U.S. Cybersecurity and Infrastructure Security Agency · daily
U.S. Government work, public domain
GRIx governed readproposed register row
National Vulnerability Database (CVE enrichment API)pending admission
NIST · continuous
U.S. Government work, public domain
GRIx governed readproposed register row
OSV open source vulnerability databasepending admission
OSV project (Google, OpenSSF) · continuous
Per-source licences; OSV schema CC BY 4.0
GRIx governed readproposed register row
Test suites, conformance statements and attestations per standard; no attestation is recorded yet, and none would certify.
Pending admissionVersion and feed state per standard; every row reads source feed pending admission until a register row admits a feed.
PlannedReference deployments and the sandbox on simulated data; planned until the path is wired.
A console computes from the registry and shows its reasons; it never decides, approves or certifies.
GCRI Canada may admit anonymised incident and testing records as research evidence on digital resilience; GCRI Canada decides under its own evidence and research rules, and no approval is implied.
GRF may record institutions publishing resilience evidence on the shared profile as a dialogue item; GRF decides under its own recognition rules, and no recognition or endorsement is implied.
GRA may read resilience evidence when it considers digital operational risk; GRA decides under its own capital-readiness rules, and no approval, rating or investment view is implied.
Each institution decides under its own rules what it reads as evidence; no pathway is an approval, a readiness statement or investment advice.
Closed or paywalled standards appear by name and link only; any compatibility profile of one is built on simulated data and kept on protected pages until an institutional arrangement with the issuing body is recorded. Nexus Standards is not affiliated with, endorsed by or certified by any standards body named here.
Records for ICT dependencies, testing and incidents with verification.
No working group is chartered yet; a community may charter this one under NS-13 through a docket.
Peer-reviewed sources and published statistics on the publishers' own domains, as the context entry cites them. No Risk Academy faculty pathway is linked to this area yet; one is linked when a faculty publishes a pathway that fits.
Risk Academy disciplines that teach Cyber resilience and digital operational resilience, with their courses; the GCRI Canada, The Global Risks Forum (GRF) and The Global Risks Alliance (GRA) subsites that carry those disciplines; and the Nexus Foundry systems the standards name. Mappings are proposed for review (Risk Academy standards map, 2026-10-17); a link says a page on the same subject exists, never an endorsement or a conformance statement; framework names in course titles are named and linked, never reproduced.
Propose a change, join the working group or name a source. Area entries are PROPOSED content for the Nexus Standards registry; a UNI identifies and never certifies, and nothing on this site is a certification, an approval or a readiness statement.
Nexus Standards documents CC BY 4.0 · tooling Apache-2.0 · counsel review pending (DEC-2026-10-16-NEXUS-STANDARDS-OPEN-LICENCE). External standards are named and linked under their own licences; a UNI (Unique Nexus Identifier) identifies, it never certifies. · Generated from the Nexus Standards corpus at commit 437ae044c5cb (2026-10-17); proposed and open.