<![CDATA[Financial institutions increasingly depend on interconnected digital infrastructure, making cyber disruptions a threat not only to individual banks but also to macrofinancial stability. While cybersecurity regulations in Indonesia and globally have shifted toward resilience-oriented frameworks, most literature remains normative, explaining what organizations should do rather than how resilience unfolds in practice, particularly in emerging-market contexts. This study aims to understand the capabilities financial institutions build to face digital infrastructure disruptions, using a qualitative single-case study of the 2023 Bank Syariah Indonesia (BSI) service disruption. Data were collected through semi-structured interviews with eight external informants such as regulators, cybersecurity/incident-response consultants, IT auditors, and an industry practitioner, triangulated with secondary data, and analyzed using thematic analysis structured through the Gioia Methodology. Findings show that the anticipate, withstand, recover, and adapt capabilities did not develop linearly but compensated for one another, with weaknesses in anticipation shifting burden onto withstand capability, further constrained by rigid command structures and third-party coordination gaps. A cross-cutting socio-technical foundation proved more decisive than technological sophistication alone. The transition from cybersecurity to cyber resilience was driven by the interaction of internal post-incident trauma and tightening external regulation. This study contributes an inductive capability model of cyber resilience grounded in an emerging-market financial institution, complementing evidence previously centered on developed countries, with practical implications for financial institution management and regulators.]]>
