Operational resilience, not a compliance checklist