Technical Resilience Assessment: Measure Your IT Resilience

Technical Resilience Assessment FAQs

• 1. What is a Technical Resilience Assessment (TRA)?

  A TRA is a structured, practitioner-led assessment of how well a defined technology domain can withstand, respond to and recover from serious disruption. Your technical teams work through realistic failure scenarios with our facilitators, and capability is scored against the five-level CM-Alliance Resilience Maturity Model, producing a maturity baseline and a prioritised remediation roadmap.

• 2. How is a TRA different from an audit or penetration test?

  A TRA is an assessment, not an audit. It's collaborative, blame-free and built to find improvement, not fault. Unlike a penetration test, which probes for exploitable vulnerabilities, the TRA evaluates your capability to detect, respond to and recover from disruption, including catastrophic scenarios a pen test can't safely simulate.

• 3. How much of my team's time does it take?

  Each assessment is a single focused session of one to two hours with your technical and IT leads. We handle all preparation, facilitation and reporting, so demand on your team is deliberately minimal.

• 4. What scenarios does the Technical Resilience Assessment cover?

  Scenarios are tailored to the domain being assessed, but typically include catastrophic platform failure or unavailability, application-layer data exfiltration or compromise, and infrastructure dependency failure. Each scenario tests detection, response and recovery capability.

• 5. What is the CM-Alliance Resilience Maturity Model?

  It's our proprietary five-level scoring framework, ranging from Level 0 (Unprepared — no procedures, no backups, no testing) to Level 4 (Operationally Resilient — automated detection and response with continuous testing). Every scenario in your TRA receives a maturity score against this model, giving you a consistent, defensible baseline.

• 6. What do we actually receive at the end?

  A confidential report containing detailed findings with evidence, a maturity score per scenario, documented areas of strength, and a consolidated set of prioritised recommendations — each with rationale, timeline, effort/cost, required resources, implementation steps and success criteria.

• 7. Is this a questionnaire or document review?

  No. The TRA is interactive by design. It's a facilitated, scenario-based discussion with the people who actually run your critical systems in the room. Documentation supports the assessment, but findings are based on real capability, not paperwork alone.

• 8. We've already run tabletop exercises. Why do we need a TRA?

  Tabletops test how you respond on the day; a TRA measures the underlying resilience — architecture, documentation, recovery capability and detection visibility — and gives you a prioritised improvement path. It's the natural next step after tabletop exercises.

• 9. Who should attend the TRA session?

  Your technical and IT leads for the domain being assessed: typically application owners, infrastructure and platform engineers, database administrators and IT operations. These are the people who build, run and recover the systems, so their input drives accurate findings.

•  10. Will individuals or teams be blamed for gaps?

  No. The TRA is explicitly blame-free. Its purpose is to measure capability and identify improvement opportunities collaboratively — not to apportion blame or grade individuals. The report also records areas of strength, so teams get a balanced, confidence-building picture. 

• 11. How often should we repeat the assessment?

  We recommend re-assessing each domain annually, or sooner after any material change to the platform, its dependencies or the applications it hosts. Re-assessment evidences your movement up the maturity levels and demonstrates the return on your remediation investment.

• 12. How does the TRA relate to the Operational Resilience Assessment (ORA)?

  They're standalone, companion assessments sharing the same evidence base and maturity scoring. The TRA serves technical teams with detailed remediation; the ORA translates the same findings into business impact, growth implications and regulatory relevance for board and risk-committee audiences. Take either on its own, or both — having done one, the other is the natural next step.