Operational Resilience Isn’t Optional: IBM Power Servers and the DORA Mandate

Cyber threats aren’t just growing, they’re evolving, with 40% of cyber attacks now AI driven, the likelihood of a successful breach has multiplied.

Resilience and security teams are now adopting a stance of “not if, but when”, shifting the paradigm from cyber “security” (focused on understanding exposure and establishing defences) to cyber “resilience” (which adds preparedness for the consequences of a successful attack).

In light of recent newsworthy breaches, and the evident impact of not being able to recover quickly (£300m at M&S), the NCSC CEO recently called for organisations to give more focus to this aspect of resilience – being prepared for re-establishing critical operations when the inevitable happens.

So, what does this mean for financial services organisations who continue to be a prime target for cybercriminals?

23% of all cyber-attacks target financial institutions (IBM Threat Index Report, 2025).

Many of these organisations rely on IBM Power systems and other business-critical platforms where unplanned downtime is unacceptable. Fast, clean recovery isn’t a nice-to-have; it’s essential.

In addition, with regulations like DORA (Digital Operational Resilience Act) now in force, financial organisations are under pressure to proactively prove they can bounce back from disruption without compromising data integrity or compliance.

This article explores:

• Why traditional backup and recovery approaches don’t cut it anymore
• What DORA means for operational resilience
• The critical role of testing, cleaning, and validating your backup data
• How modern recovery solutions (like those from @Celerity) are helping Financial Services organisations achieve resilience

The Problem with Traditional Backup Approaches

Legacy recovery methods were never designed for today’s threat landscape. Slow recovery times, limited visibility into backup health, and the very real risk of restoring infected backups… are all common pain points.

Just having a backup doesn’t mean you're resilient. Unless you're regularly testing and validating those backups, you can’t be confident they’re clean, complete, or even usable. Many organisations still only test their ability to recover backups once or twice a year due to the amount of manual effort involved.  It’s a process that is ripe for automation.

Proving Resilience Under DORA

DORA raises the bar. It’s no longer enough to protect your data, you need to be able to prove that you can respond and recover quickly, safely and without compromise.

A robust foundation for a cyber resilience strategy is:

• Routine testing ensures that backup processes work and can withstand the pressures of a real-world incident
• Cleaning ensures backup datasets are malware-free to ensure clean restoration, critical in ransomware scenarios
• Validation confirms backup integrity, giving you confidence that the data is both accurate and usable

To meet DORA’s expectations, many organisations are turning to automated solutions that bring consistency, speed, and auditability to the table. Automated assurance testing automates recovery and integrity checking of backups, whilst continuous monitoring alerts to signs of compromise or anomalies and AI-driven cleanroom validation isolates backup recovery workflows, confirming that only uncompromised data is permitted for restoration.

What We’re Seeing at Celerity

At Celerity, we’ve been helping financial services organisations secure their data for over 20 years. One thing’s clear: cyber recovery is foundational to both security and compliance strategies.

Celerity’s Cyber Recovery as a Service delivers automated, proactive recovery assurance across diverse environments.

Our unique CopyAssure CleanRoom technology continuously recovers and validates immutable backups for IBM Power systems (IBM i, AIX, Linux, PowerVS), ensuring fast, secure recovery that meets your RPO/RTO targets. Through our partnership with Predatar, we extend the same assurance to dependent X86 environments, enabling full recovery for your Minimum Viable Company.

With AI-powered validation, air-gapped backups, and continuous testing, we help financial institutions meet compliance obligations and stay resilient in the face of evolving cyber threats.