← Back to W² Advisory
Resilience Rulebook

The Resilience Rulebook

A live map of operational-resilience regulation across the sectors where continuity is supervised — financial services, healthcare and critical infrastructure — spanning US federal and state regulators, the EU, the UK and Canada. What is in force, and what is coming.

A WSquare Advisory analysis In partnership with Resilis
For information purposes only. Automated, LLM-assisted triage reviewed by WSquare Advisory — not legal advice. Applicability is entity-by-entity; confirm against the source rule text.

In force — the rulebook by sector

The obligations that bind today. Each sector opens a filtered, searchable rulebook by jurisdiction, regulator, domain and status.

Sector 01

Financial Services

Banking, insurance, markets and payments — US federal and state regulators, the EU (DORA), the UK (PRA/FCA) and Canada (OSFI).

508 in-force obligations
Sector 02

Healthcare

Providers, payers and medical-device makers — US (CMS, HHS/OCR, FDA), the EU (NIS2, EHDS, MDR/IVDR) and Canada.

306 in-force obligations
Sector 03

Critical Infrastructure

Energy, water, transport, communications and ports — US sector regulators, the EU (NIS2, CER, CRA) and the UK.

636 in-force obligations

Coming up — the pipeline

Proposed rules, enacted-but-not-in-force rules and phase-in deadlines — what to build for before it binds.

Pipeline 01

Financial Services

Forthcoming resilience rules for financial services — proposed, not-yet-in-force, and phase-in deadlines across US, EU, UK and Canada.

Forward outlook
Pipeline 02

Healthcare

Forthcoming resilience rules for healthcare — proposed, not-yet-in-force, and phase-in deadlines across US, EU, UK and Canada.

Forward outlook
Pipeline 03

Critical Infrastructure

Forthcoming resilience rules for critical infrastructure — proposed, not-yet-in-force, and phase-in deadlines across US, EU, UK and Canada.

Forward outlook

Turning this into an operating plan?

Knowing which rules bind you is step one. WSquare Advisory builds the operating capability behind compliance — the continuity, third-party, and recovery disciplines these regimes expect. If that's your challenge, let's talk.

Start a Conversation →