Regulator

Markets rarely price in the damage a failed bank or a stopped hospital inflicts on customers and the wider economy, so left alone, firms underinvest in continuity. The regulator exists to correct this: it converts public interest into binding rules for a sector and holds licence holders to them. For an executive this changes the nature of continuity work, because it is no longer an internal preference but an external obligation with a named authority behind it. The board's first question therefore becomes which regulators cover the organisation and what each of them expects.

In the UAE the landscape is layered. NCEMA owns the national continuity framework, and its standard NCEMA 7000 is mandatory for government entities and critical infrastructure, while the Central Bank of the UAE (CBUAE) sets its own resilience expectations for banks; in the UK the FCA plays a comparable role for financial services. Voluntary standards such as ISO 22301 sit alongside these regimes, adopted by choice rather than by command. One service chain can face several authorities at once: a bank answers to CBUAE while its data-centre provider falls under NCEMA. Mapping which authority governs which part of the operation is the starting point of any compliance programme.

The typical mistake is to treat the regulator as an audience for paperwork: documents mirror the rulebook while actual recovery capability stays untested. The gap between the binder and reality surfaces at the first inspection or real disruption, with the regulator watching. Mature organisations build the relationship on evidence instead: exercises performed, tolerances tested, findings closed on time. How regulators shape the resilience agenda is covered in ERGP module M5, Regulatory requirements for resilience.