Financial market infrastructure, exchanges, clearing houses, payment systems, increasingly falls under both physical resilience frameworks and cybersecurity obligations at once. An operator significant enough to be designated critical infrastructure is, in many jurisdictions, also significant enough to fall under essential-entity cybersecurity requirements simultaneously. The physical side gets proportionate attention because it produces visible, inspectable evidence.