Regulators and external stakeholders are focusing on the ability of companies to prevent, respond to, and recover from operational disruption