Operational-resilience, BCDR, and crisis-handling obligations across banking, insurance, markets and payments — from US federal and state regulators, the EU (DORA), the UK (PRA/FCA) and Canada (OSFI).
| Jur. | Regulator | Domain | Obligation (with source quote) | Citation | Status |
|---|---|---|---|---|---|
| CA | CA_OSFI | business continuity | The institution should establish and maintain an Enterprise Disaster Recovery Program (EDRP) to support ability to deliver technology services through disruption and operate within risk tolerance. “FRFIs should establish and maintain an Enterprise Disaster Recovery Program (EDRP) to support its ability to deliver technology services through disruption and operate within its risk tolerance.” | OSFI B-13, Section 2.9, Principle 12 | in force |
| CA | CA_OSFI | business continuity | The institution should align the disaster recovery program with the business continuity management program. “FRFIs should align the disaster recovery program with its business continuity management program.” | OSFI B-13, Section 2.9.1 | in force |
| CA | CA_OSFI | business continuity | Manage key EDRP dependencies including data security/storage requirements, locations of backup sites, service provider locations relative to primary data centres, and other critical technology assets. “FRFIs should manage key dependencies required to support the EDRP, such as: Information security requirements for data security and storage (e.g., encryption); and, Location of technology asset centres, backup sites, service provider locations and proximity to primary data…” | OSFI B-13, Section 2.9.2 | in force |
| CA | CA_OSFI | business continuity | The institution should regularly perform scenario testing on disaster recovery capabilities against severe but plausible scenarios to validate recovery strategies and confirm ability to meet pre-defined requirements. “FRFIs should regularly validate and report on their disaster recovery strategies, plans and/or capabilities against severe but plausible scenarios...The FRFI's backup and recovery capabilities and processes to validate resiliency strategies, plans and actions, and confirm the…” | OSFI B-13, Section 2.9.3, Principle 13 | in force |
| CA | CA_OSFI | business continuity | DR scenario testing must include critical third-party technologies and integration points with upstream/downstream dependencies, both on- and off-premises. “Critical third-party technologies and integration points with upstream and downstream dependencies, including both on- and off-premises technology.” | OSFI B-13, Section 2.9.3 | in force |
| CA | CA_OSFI | business continuity | DR scenarios should be forward-looking and consider new/emerging risks, material changes to business/technology, situations causing prolonged outage, and prior incident history. “These scenarios should be forward-looking and consider, where appropriate: New and emerging risks or threats; Material changes to business objectives or technologies; Situations that can lead to prolonged outage; and, Previous incident history and known technology complexities…” | OSFI B-13, Section 2.9.3 | in force |
| CA | CA_OSFI | business continuity | The institution should define standards and implement incident/problem management processes including governance structure for timely identification, escalation, system restoration/recovery, and root cause investigation. “FRFIs should define standards and implement processes for incident and problem management. Standards should provide an appropriate governance structure for timely identification and escalation of incidents, restoration and/or recovery of an affected system, and investigation and…” | OSFI B-13, Section 2.7.1 | in force |
| CA | CA_OSFI | business continuity | Implement incident response procedures including internal/external communication with escalation/notification triggers, and establish and periodically test incident management processes with third parties. “Developing and implementing incident response procedures that mitigate the impacts of incidents, including internal and external communication actions that contain escalation and notification triggers and processes...Establishing and periodically testing incident management…” | OSFI B-13, Section 2.7.2 | in force |
| CA | CA_OSFI | business continuity | Conduct periodic exercises and testing of incident management processes, playbooks, and response tools to validate and maintain their effectiveness. “Performing periodic testing and exercises using plausible scenarios in order to identify and remedy gaps in incident response actions and capabilities; Conducting periodic exercises and testing of incident management process, playbooks, and other response tools (e.g.…” | OSFI B-13, Section 2.7.2 | in force |
| CA | CA_OSFI | business continuity | The institution should develop problem management processes for detection, categorization, investigation and resolution of incident causes, including post-incident reviews and root cause/impact diagnostics to improve incident management. “FRFIs should develop problem management processes that provide for the detection, categorization, investigation and resolution of suspected incident cause(s). Processes should include post-incident reviews, root cause and impact diagnostics and identification of trends or…” | OSFI B-13, Section 2.7.3 | in force |
| CA | CA_OSFI | business continuity | The institution should design and implement technology architecture using Resilience-by-Design and Availability-by-Design principles, commensurate with business needs. “Using a risk-based approach, systems and associated infrastructure should be designed and implemented to achieve availability, scalability, security (Secure-by-Design) and resilience (Resilience-by-Design), commensurate with business needs.” | OSFI B-13, Section 2.1.2 | in force |
| CA | CA_OSFI | business continuity | Maintain a current comprehensive asset inventory cataloguing technology assets throughout their lifecycle, including documented interdependencies between critical assets to assist in response to security and operational incidents. “Documented interdependencies between critical technology assets, where appropriate, to enable proper change and configuration management processes, and to assist in response to security and operational incidents, including cyber attacks.” | OSFI B-13, Section 2.2.2 | in force |
| CA | CA_OSFI | business continuity | The institution should continuously monitor technology currency and proactively implement plans to mitigate risks from unpatched, outdated, or unsupported assets; replace/upgrade assets before maintenance ceases. “FRFIs should continuously monitor the currency of software and hardware assets...It should proactively implement plans to mitigate and manage risks stemming from unpatched, outdated or unsupported assets and replace or upgrade assets before maintenance ceases.” | OSFI B-13, Section 2.2.5 | in force |
| CA | CA_OSFI | business continuity | Ensure changes to technology assets in production are documented, assessed, tested, approved, implemented and verified in a controlled manner, with defined emergency change controls. [adjacent] “FRFIs should ensure that changes to technology assets in the production environment are documented, assessed, tested, approved, implemented and verified in a controlled manner...The standard should also define emergency change and control requirements to ensure that such changes…” | OSFI B-13, Section 2.5.1 | in force |
| CA | CA_OSFI | business continuity | The institution should define technology service management standards with performance indicators/service targets and remediation processes to ensure technology services support business continuity. “FRFIs should establish technology service management standards with defined performance indicators and/or service targets that can be used to measure and monitor the delivery of technology services. Processes should also provide for remediation where targets are not being met.” | OSFI B-13, Section 2.8.1 | in force |
| CA | CA_OSFI | business continuity | The institution should define and continuously monitor performance and capacity requirements with thresholds on infrastructure utilisation to ensure technology supports current and future business needs. “FRFIs should define performance and capacity requirements with thresholds on infrastructure utilization. These requirements should be continuously monitored against defined thresholds to ensure technology performance and capacity support current and future business needs.” | OSFI B-13, Section 2.8.2 | in force |
| CA | CA_OSFI | business continuity | The institution should establish cyber incident response capabilities (team, tools, playbooks) available on a continuous basis to rapidly respond, contain and recover from cyber security events materially impacting technology assets. “FRFIs should establish a cyber incident response team with tools and capabilities available on a continuous basis to rapidly respond, contain and recover from cyber security events and incidents that could materially impact the FRFI's technology assets, customers and other…” | OSFI B-13, Section 3.4.4 | in force |
| CA | CA_OSFI | business continuity | The institution should maintain cyber security incident management process and playbooks to enable timely and effective management of cyber security incidents. “FRFIs should maintain a cyber security incident management process and playbooks to enable timely and effective management of cyber security incidents.” | OSFI B-13, Section 3.4.3 | in force |
| CA | CA_OSFI | business continuity | The institution should align and integrate cyber security, technology, crisis management and communication protocols, including capabilities for timely escalation and stakeholder coordination during major cyber events. “FRFIs should ensure the alignment and integration between their cyber security, technology, crisis management and communication protocols. This should include capabilities to enable comprehensive and timely escalation and stakeholder coordination (internal and external) in…” | OSFI B-13, Section 3.4.1 | in force |
| CA | CA_OSFI | business continuity | Conduct forensic investigation for incidents where technology assets may have been materially exposed; perform detailed post-incident assessment including RCA for high-severity incidents. “FRFIs should conduct a forensic investigation for incidents where technology assets may have been materially exposed. For high-severity incidents, the FRFI should conduct a detailed post-incident assessment of direct and indirect impacts...including a root cause analysis to…” | OSFI B-13, Section 3.4.5 | in force |
| CA | CA_OSFI | business continuity | The institution should maintain continuous security logging for technology assets and defence layers; implement minimum log retention periods; ensure logs support timely forensic investigation of cyber events. [adjacent] “FRFIs should ensure continuous security logging for technology assets and different layers of defence tools...FRFIs should implement minimum security log retention periods and maintain cyber security event logs to facilitate a thorough and unimpeded forensic investigation of…” | OSFI B-13, Section 3.3.1 | in force |
| CA | CA_OSFI | business continuity | The institution should proactively identify, defend, detect, respond and recover from cyber security threats and incidents to maintain confidentiality, integrity and availability of technology assets. “FRFIs should proactively identify, defend, detect, respond and recover from external and insider cyber security threats, events and incidents to maintain the confidentiality, integrity and availability of its technology assets.” | OSFI B-13, Section 3.0 | in force |
| CA | CA_OSFI | business continuity | The institution should implement enhanced controls to rapidly contain cyber threats, defend critical technology assets, and remain resilient against cyber attacks, including designing application controls to limit cyber attack impact. “FRFIs should employ enhanced controls and functionality to rapidly contain cyber security threats, defend its critical technology assets and remain resilient against cyber attacks...Designing application controls to contain and limit the impact of a cyber attack.” | OSFI B-13, Section 3.2.3 | in force |
| CA | CA_OSFI | business continuity | Establish technology and cyber risk management framework including risk appetite, tolerance levels, and processes for identifying, assessing, managing and reporting technology/cyber risks including emerging threats. [adjacent] “Technology and cyber risk appetite and measurement (e.g., limits, thresholds and tolerance levels)...Management of unique risks posed by emerging threats and technologies...Reporting to Senior Management on technology and cyber risk appetite measures, exposures and trends.” | OSFI B-13, Section 1.3.2 | in force |
| CA | CA_OSFI | business continuity | The institution should identify critical operations and assess their ability to withstand disruptions; map all internal and external dependencies end to end, covering people, technology, processes, information, facilities, and third parties. “Critical operations should be identified and assessed for their ability to withstand disruptions... Once identified, critical operations should be mapped for internal and external dependencies.” | Guideline E-21, Section 3.1 | in force |
| CA | CA_OSFI | business continuity | The institution should establish tolerances for disruption for each critical operation, setting the maximum level of disruption the institution can withstand across a range of severe but plausible scenarios. “Tolerances for disruption should set out the maximum level of disruption a financial institution can withstand across a range of severe but plausible scenarios.” | Guideline E-21, Section 3.2 | in force |
| CA | CA_OSFI | business continuity | Conduct regular scenario testing of critical operations against severe-but-plausible disruptions, using tabletop exercises, simulations, and live-systems testing, to assess whether operations can persist within tolerances for disruption. “Regular scenario testing improves understanding of when tolerances for disruption would be breached... a variety of testing methodologies should be used, including table-top exercises, simulations, and live-systems testing.” | Guideline E-21, Section 3.3 | in force |
| CA | CA_OSFI | business continuity | Conduct business impact analyses to assess risks and potential impacts of disruptive events, identify the impact of disruptions, and establish maximum recovery objectives; review and update the analyses regularly. “A business impact analysis assesses the risks and potential impacts of a range of disruptive events on operations. It should identify and measure: The impact of disruptions. The maximum limits on recovery objectives before severe consequences or losses occur.” | Guideline E-21, Section 4.1.1 | in force |
| CA | CA_OSFI | business continuity | Develop business continuity plans (BCPs) covering response and recovery actions for a range of threats, including protocols for plan invocation, roles and responsibilities, backup personnel, staff safety, recovery targets, workarounds, and internal/external communication plans. “Business continuity plans set out the response and recovery actions for a range of potential threats... This should include: Establishing protocols for invoking the plan... Defining roles and responsibilities... Setting targets for recovery levels and times.” | Guideline E-21, Section 4.1.2 | in force |
| CA | CA_OSFI | business continuity | Regularly test business continuity plans using scenarios that include long-duration and simultaneous disruptions involving critical third parties; address gaps identified and maintain contingency plans for critical third parties. “Business continuity plan tests should provide reasonable assurance that plans are effective... Tests should consider a range of severe but plausible circumstances, including scenarios with disruptions that: Are long in duration. Are simultaneous in nature. Involve critical third…” | Guideline E-21, Section 4.1.3 | in force |
| CA | CA_OSFI | business continuity | The institution should establish a crisis management plan with escalation protocols to senior management and the board, plan invocation criteria, internal and external communications protocols, and conduct regular testing and lessons-learned exercises. “A crisis management plan should be established that ensures effective, coordinated, and timely responses to potential crises... It should include: Protocols for escalation to senior management and the board. Criteria for invoking the plan. Internal and external communications…” | Guideline E-21, Section 4.3 | in force |
| CA | CA_OSFI | business continuity | Maintain a senior-level crisis management team responsible for decision-making, coordination, and oversight of strategies to address crises affecting operations. “A crisis management team can help ensure effective communication, expedited recovery, and an effective response to the crisis.” | Guideline E-21, Section A5 (definition) and Section 4.3 | in force |
| CA | CA_OSFI | business continuity | Integrate business continuity risk management with operational resilience, evolving its focus from business processes to critical operations end to end, and including business impact analyses and tested BCPs. “Business continuity risk management is the process of planning for, and recovering from, disruptions to operations. It should be integrated with and strengthen operational resilience. Over time, its focus should evolve from business processes to critical operations end to end.” | Guideline E-21, Section 4.1 | in force |
| CA | CA_OSFI | business continuity | The institution should provide staff with training on business continuity plans, including plan activation and management of operations during disruption. “Staff should be provided with training on business continuity plans, including their activation and how operations will be managed during disruption.” | Guideline E-21, Section 4.1.2 | in force |
| CA | CA_OSFI | business continuity | The institution should obtain sufficient information about critical third parties to assess their resilience, and coordinate with them to conduct broader resilience exercises where possible. “Where a third party is identified as critical, sufficient information should be obtained to assess its resilience... The financial institution should also coordinate with critical third parties, where possible, to conduct broader exercises.” | Guideline E-21, Sections 3.1 and 3.3 | in force |
| CA | CA_OSFI | business continuity | The institution should require critical third parties to demonstrate robustness in their own business continuity plans and testing, and maintain contingency plans for critical third-party failures. “Critical third parties should also demonstrate robustness in their own business continuity plans and testing. There should be processes to address gaps identified during testing, as well as contingency plans for critical third parties.” | Guideline E-21, Section 4.1.3 | in force |
| CA | CA_OSFI | business continuity | The institution should implement a data risk management framework including a strategy and programme covering data governance, architecture, classification, integrity/availability controls, and processes for escalating and responding to data breaches and data-related incidents. [adjacent] “It should also comprise a specific data risk management framework that includes a data risk management strategy and program... Processes for escalating and responding to data breaches and other data-related incidents.” | Guideline E-21, Section 4.7 | in force |
| CA | CA_OSFI | business continuity | Ensure data supporting critical operations is accurate, complete, timely, secure, and protected, using methodologies that maintain integrity, adaptability, confidentiality, and availability throughout the data lifecycle. “Effective data risk management ensures that data is accurate, complete, timely, secure, and protected... Methodologies for ensuring the integrity, adaptability, confidentiality, and availability of data throughout its lifecycle.” | Guideline E-21, Section 4.7 | in force |
| CA | CA_OSFI | business continuity | Embed effective technology and cyber risk management as a foundation of operational resilience, aligned with Guideline B-13, to prevent wide-scale operational disruption from technology failure, infiltration, or data loss. “A critical technology failure, infiltration, or loss of data can result in wide-scale disruption impacting operations. Sound technology and cyber risk management is fundamental to bolstering operational resilience.” | Guideline E-21, Section 4.5 | in force |
| CA | CA_OSFI | business continuity | Manage third-party operational resilience risks (including disruption at a third party or loss/corruption of critical data) as part of operational resilience, aligned with Guideline B-10. “Threats to operational resilience can arise from critical third-party arrangements, including disruption at the third party or the loss or corruption of critical data. Accordingly, effective third-party risk management is an important contributor to operational resilience.” | Guideline E-21, Section 4.6 | in force |
| CA | CA_OSFI | business continuity | The institution should conduct scenario analysis at both business-unit and enterprise-wide levels using a range of severe but plausible scenarios; use results to inform operational resilience scenario testing. “Scenario analysis should be conducted using appropriate techniques at both the business unit and enterprise-wide levels and incorporate a range of severe but plausible scenarios... Scenario analysis results may be used to inform operational resilience scenario testing.” | Guideline E-21, Section 2.3.4 | in force |
| CA | CA_OSFI | business continuity | The institution should ensure senior management and the board receive timely reports on operational resilience scenario testing results, including analysis of deficiencies, assessment of whether critical operations can be maintained within tolerances, and plans to address shortcomings. “Senior management and the board of directors should also receive the results of scenario analysis... and scenario testing... This should include: Analysis of deficiencies. An assessment of operational resilience, and whether critical operations can be maintained within…” | Guideline E-21, Section 2.4.2 | in force |
| CA | CA_OSFI | business continuity | Ensure breaches of tolerances for disruption are appropriately escalated to senior management and addressed in a timely and sustainable manner. “Ensuring breaches of tolerances for disruption are appropriately escalated and addressed.” | Guideline E-21, Section 1.1 | in force |
| CA | CA_OSFI | business continuity | Perform change management assessments for significant operational changes (new products, acquisitions, new tech systems, process changes), including deploying tested contingency plans if a change fails and testing changes before implementation. “Deploy tested contingency plans in the event a change fails. Test the change on systems and processes before introducing it.” | Guideline E-21, Section 4.4 | in force |
| CA | CA_OSFI | business continuity | The institution should conduct ongoing monitoring of adherence to tolerances for disruption and operational risk limits, using comprehensive metrics; ensure key risk indicators include escalation protocols when risk levels approach or exceed limits. “Ongoing monitoring should be conducted to help prepare for, and respond to, changes in operational risks. It should assess adherence to the operational risk appetite statement and operational risk limits, as well as tolerances for disruption.” | Guideline E-21, Sections 2.4.1 and 2.3.2 | in force |
| CA | CA_OSFI | business continuity | Capture and analyse operational risk event data (actual, potential, and near-misses) to determine root causes, contributing risk categories, and corrective measures; use findings to strengthen resilience controls. “Operational risk event data exceeding established limits should be captured to assess: What the root cause of the operational risk event is... What corrective measures ought to be taken to address deficiencies or control failures.” | Guideline E-21, Section 2.3.3 | in force |
| CA | CA_OSFI | business continuity | Ensure independent risk and compliance functions oversee and challenge resilience activities, including escalation channels for significant issues, and that internal audit provides independent assurance on operational risk management controls and systems. “The independent risk and compliance functions oversee and challenge the risk and resilience activities... Internal audit or a similar function should provide independent assurance to senior management and the board of directors that operational risk management controls, policies…” | Guideline E-21, Sections 1.3 and 1.4 | in force |
| CA | CA_OSFI | business continuity | The institution should conduct lessons-learned exercises following a crisis and incorporate findings into the crisis management plan; share the plan with relevant business units and impacted external parties. “Lessons-learned exercises should be undertaken following a crisis and incorporated into the plan. The crisis management plan should be regularly tested and shared with the relevant business units in the financial institution and any impacted external parties, as appropriate.” | Guideline E-21, Section 4.3 | in force |
| CA | CA_OSFI | business continuity | Establish and maintain a third-party risk management program that addresses the comprehensive set of third-party risks within an expanded third-party ecosystem, with emphasis on governance and risk management to protect operational and financial resilience. “Addresses a comprehensive set of third-party risks within an expanded third-party ecosystem, placing emphasis on governance and risk management programs and setting outcomes-focused, principles-based expectations” | OSFI Guideline B-10 (April 24, 2023 cover letter) | in force |
| CA | CA_OSFI | business continuity | Apply the Guideline proportionately, based on the level of risk and criticality of each third-party arrangement and the size, nature, scope, complexity, and risk profile of the FRFI, including for operational resilience purposes. “apply the Guideline in a manner that is proportionate to the level of risk and criticality of each arrangement and to the size, nature, scope, complexity, and risk profile of the FRFI” | OSFI Guideline B-10 (April 24, 2023 cover letter) | in force |
| CA | CA_OSFI | business continuity | Manage subcontractor (fourth-party) risk according to the level of risk and criticality of the given third-party arrangement, to protect continuity of critical activities. “FRFIs managing subcontractor risk according to the level of risk and criticality of the given third-party arrangement” | OSFI Guideline B-10 (April 24, 2023 cover letter) | in force |
| CA | CA_OSFI | business continuity | Take reasonable steps to manage concentration risks related to the FRFI's own third-party arrangements (e.g., over-reliance on a single provider for critical services). “taking reasonable steps to manage concentration risks related to their own third-party arrangements” | OSFI Guideline B-10 (April 24, 2023 cover letter) | in force |
| CA | CA_OSFI | business continuity | Assess systemic concentration risk (i.e., sector-wide dependence on common critical third-party providers) to the greatest extent possible. “assessing systemic concentration risk to the greatest extent possible” | OSFI Guideline B-10 (April 24, 2023 cover letter) | in force |
| CA | CA_OSFI | business continuity | Ensure that third-party arrangements commencing on or after May 1, 2024 adhere to Guideline B-10 from inception, including operational resilience requirements. “third-party arrangements commencing on or after the effective date adhere to the guideline” | OSFI Guideline B-10 (April 24, 2023 cover letter) | in force |
| CA | CA_OSFI | business continuity | Review and update pre-existing third-party arrangements at the earliest opportunity so that they adhere to Guideline B-10 by May 1, 2024 or as soon as possible thereafter. “those entered into prior are being reviewed and updated at the earliest opportunity so that they adhere to the guideline by its effective date or as soon as possible thereafter” | OSFI Guideline B-10 (April 24, 2023 cover letter) | in force |
| US | CA_PRIVACY | cybersecurity | Establish and maintain a cybersecurity program consisting of policies, procedures, and practices that protect personal information from unauthorized access, destruction, use, modification, or disclosure, and protect against loss of availability of personal information. [adjacent] “"Cybersecurity program" means the policies, procedures, and practices that protect personal information from unauthorized access, destruction, use, modification, or disclosure; and protect against unauthorized activity resulting in the loss of availability of personal…” | § 7001(k) | in force |
| US | CA_PRIVACY | cybersecurity | Create a cybersecurity audit report documenting the required information for each completed annual cybersecurity audit. [adjacent] “"Cybersecurity audit report" means the document that every business must create as part of its cybersecurity audit. The cybersecurity audit report includes the information set forth in section 7123, subsection (e).” | § 7001(l) | in force |
| US | CA_PRIVACY | cybersecurity | Conduct penetration testing of information systems by authorizing attempted circumvention or defeat of security features to identify vulnerabilities that could compromise availability or security of personal information. [adjacent] “"Penetration testing" means testing the security of an information system by attempting to circumvent or defeat its security features by authorizing attempted penetration of the information system.” | § 7001(bb) | in force |
| US | CA_PRIVACY | cybersecurity | Manage and control privileged accounts to prevent unauthorized configuration changes or unauthorized access that could affect availability and security of personal information. [adjacent] “"Privileged account" means any authorized user account or service account that can be used to perform functions that other user accounts are not authorized to perform, including but not limited to the ability to add, change, or remove other accounts, or make configuration…” | § 7001(hh) | in force |
| US | CA_PRIVACY | cybersecurity | Scope the business's information system (including third-party-owned resources used for processing personal information) within the cybersecurity program and audit, addressing risks to all such resources. [adjacent] “"Information system" means the resources (e.g., network, hardware, and software) organized for the processing of personal information or that can provide access to personal information. The business's information system includes the resources organized for the business's…” | § 7001(t) | in force |
| EU | EU_AI | artificial intelligence | Shall be taken into account when ensuring compliance with those requirements (Art. 9) [adjacent] “shall be taken into account when ensuring compliance with those requirements” | Article 9, Regulation (EU) 2024/1689 | final · applies from 2027-08-02 |
| EU | EU_AI | artificial intelligence | Record-keeping — High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system (Art. 12) [adjacent] “High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system” | Article 12, Regulation (EU) 2024/1689 | final · applies from 2027-08-02 |
| EU | EU_AI | artificial intelligence | High-risk AI systems shall be designed and developed in such a way, including with appropriate human-machine interface tools, that they can be effectively overseen by natural persons during the period in which they are… (Art. 14) [adjacent] “High-risk AI systems shall be designed and developed in such a way, including with appropriate human-machine interface tools, that they can be effectively overseen by natural persons during the period in which they are in use” | Article 14, Regulation (EU) 2024/1689 | final · applies from 2027-08-02 |
| EU | EU_AI | artificial intelligence | Accuracy, robustness and cybersecurity — High-risk AI systems shall be designed and developed in such a way that they achieve an appropriate level of accuracy, robustness, and cybersecurity, and that they perform consistently in those respects throughout their… (Art. 15) [adjacent] “High-risk AI systems shall be designed and developed in such a way that they achieve an appropriate level of accuracy, robustness, and cybersecurity, and that they perform consistently in those respects throughout their lifecycle” | Article 15, Regulation (EU) 2024/1689 | final · applies from 2027-08-02 |
| EU | EU_AI | artificial intelligence | Reporting of serious incidents — Providers of high-risk AI systems placed on the Union market shall report any serious incident to the market surveillance authorities of the Member States where that incident occurred (Art. 73) [adjacent] “Providers of high-risk AI systems placed on the Union market shall report any serious incident to the market surveillance authorities of the Member States where that incident occurred” | Article 73, Regulation (EU) 2024/1689 | final · applies from 2027-08-02 |
| EU | EU_AI | artificial intelligence | Alerts of systemic risks by the scientific panel — The AI Office shall inform the Board of any measure according to Articles 91 to 94 (Art. 90) [adjacent] “The AI Office shall inform the Board of any measure according to Articles 91 to 94” | Article 90, Regulation (EU) 2024/1689 | final · applies from 2027-08-02 |
| EU | EU_ESA | business continuity | Overall risk profile and complexity — When developing and implementing the ICT security policies, procedures, protocols and tools referred to in Title II and the simplified ICT risk management framework referred to in Title III, the size and the overall… (Art. 1) [adjacent] “When developing and implementing the ICT security policies, procedures, protocols and tools referred to in Title II and the simplified ICT risk management framework referred to in Title III, the size and the overall risk profile of the financial entity, and the nature, scale and…” | Article 1, Delegated Reg (EU) 2024/1774 | in force |
| EU | EU_ESA | business continuity | General elements of ICT security policies, procedures, protocols, and tools — Financial entities shall ensure that their ICT security policies, information security, and related procedures, protocols, and tools as referred to in Article 9(2) of Regulation (EU) 2022/2554 are embedded in their ICT… (Art. 2) [adjacent] “Financial entities shall ensure that their ICT security policies, information security, and related procedures, protocols, and tools as referred to in Article 9(2) of Regulation (EU) 2022/2554 are embedded in their ICT risk management framework” | Article 2, Delegated Reg (EU) 2024/1774 | in force |
| EU | EU_ESA | business continuity | ICT risk management — Financial entities shall develop, document, and implement ICT risk management policies and procedures that shall contain all of the following: (a) an indication of the approval of the risk tolerance level for ICT risk… (Art. 3) [adjacent] “Financial entities shall develop, document, and implement ICT risk management policies and procedures that shall contain all of the following: (a) an indication of the approval of the risk tolerance level for ICT risk established in accordance with Article 6(8), point (b), of…” | Article 3, Delegated Reg (EU) 2024/1774 | in force |
| EU | EU_ESA | business continuity | ICT asset management policy — As part of the ICT security policies, procedures, protocols, and tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial entities shall develop, document, and implement a policy on management of ICT… (Art. 4) [adjacent] “As part of the ICT security policies, procedures, protocols, and tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial entities shall develop, document, and implement a policy on management of ICT assets” | Article 4, Delegated Reg (EU) 2024/1774 | in force |
| EU | EU_ESA | business continuity | ICT asset management procedure — Financial entities shall develop, document, and implement a procedure for the management of ICT assets (Art. 5) [adjacent] “Financial entities shall develop, document, and implement a procedure for the management of ICT assets” | Article 5, Delegated Reg (EU) 2024/1774 | in force |
| EU | EU_ESA | business continuity | Encryption and cryptographic controls — As part of their ICT security policies, procedures, protocols, and tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial entities shall develop, document, and implement a policy on encryption and… (Art. 6) [adjacent] “As part of their ICT security policies, procedures, protocols, and tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial entities shall develop, document, and implement a policy on encryption and cryptographic controls” | Article 6, Delegated Reg (EU) 2024/1774 | in force |
| EU | EU_ESA | business continuity | For the purposes of point (b), where encryption of data in use is not possible, financial entities shall process data in use in a separated and protected environment, or take equivalent measures to ensure the… (Art. 7) [adjacent] “For the purposes of point (b), where encryption of data in use is not possible, financial entities shall process data in use in a separated and protected environment, or take equivalent measures to ensure the confidentiality, integrity, authenticity, and availability of data” | Article 7, Delegated Reg (EU) 2024/1774 | in force |
| EU | EU_ESA | business continuity | Financial entities that are not able to adhere to the leading practices or standards, or to use the most reliable techniques, shall adopt mitigation and monitoring measures that ensure resilience against cyber threats (Art. 8) “Financial entities that are not able to adhere to the leading practices or standards, or to use the most reliable techniques, shall adopt mitigation and monitoring measures that ensure resilience against cyber threats” | Article 8, Delegated Reg (EU) 2024/1774 | in force |
| EU | EU_ESA | business continuity | (2) of Regulation (EU) 2022/2554, financial entities shall develop, document, and implement policies and procedures to manage the ICT operations (Art. 9) “(2) of Regulation (EU) 2022/2554, financial entities shall develop, document, and implement policies and procedures to manage the ICT operations” | Article 9, Delegated Reg (EU) 2024/1774 | in force |
| EU | EU_ESA | business continuity | Vulnerability and patch management — As part of the ICT security policies, procedures, protocols, and tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial entities shall develop, document, and implement vulnerability management… (Art. 10) [adjacent] “As part of the ICT security policies, procedures, protocols, and tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial entities shall develop, document, and implement vulnerability management procedures” | Article 10, Delegated Reg (EU) 2024/1774 | in force |
| EU | EU_ESA | business continuity | Data and system security — As part of the ICT security policies, procedures, protocols, and tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial entities shall develop, document, and implement a data and system security… (Art. 11) [adjacent] “As part of the ICT security policies, procedures, protocols, and tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial entities shall develop, document, and implement a data and system security procedure” | Article 11, Delegated Reg (EU) 2024/1774 | in force |
| EU | EU_ESA | business continuity | Logging — Financial entities shall, as part of the safeguards against intrusions and data misuse, develop, document, and implement logging procedures, protocols and tools (Art. 12) [adjacent] “Financial entities shall, as part of the safeguards against intrusions and data misuse, develop, document, and implement logging procedures, protocols and tools” | Article 12, Delegated Reg (EU) 2024/1774 | in force |
| EU | EU_ESA | business continuity | Of Directive (EU) 2022/2555, this Regulation shall be considered a sector-specific Union legal act for the purposes of (Art. 3) [adjacent] “of Directive (EU) 2022/2555, this Regulation shall be considered a sector-specific Union legal act for the purposes of” | Article 3, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | Governance and organisation — Financial entities shall have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk, in accordance with (Art. 5) [adjacent] “Financial entities shall have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk, in accordance with” | Article 5, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | The management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework referred to in Article 6(1) (Art. 6) [adjacent] “The management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework referred to in Article 6(1)” | Article 6, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | ICT systems, protocols and tools — In order to address and manage ICT risk, financial entities shall use and maintain updated ICT systems, protocols and tools that are: (a) appropriate to the magnitude of operations supporting the conduct of their… (Art. 7) “In order to address and manage ICT risk, financial entities shall use and maintain updated ICT systems, protocols and tools that are: (a) appropriate to the magnitude of operations supporting the conduct of their activities, in accordance with the proportionality principle as…” | Article 7, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | Identification — As part of the ICT risk management framework referred to in Article 6(1), financial entities shall identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the… (Art. 8) “As part of the ICT risk management framework referred to in Article 6(1), financial entities shall identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the information assets and ICT assets supporting those functions, and…” | Article 8, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | Protection and prevention — For the purposes of adequately protecting ICT systems and with a view to organising response measures, financial entities shall continuously monitor and control the security and functioning of ICT systems and tools and… (Art. 9) “For the purposes of adequately protecting ICT systems and with a view to organising response measures, financial entities shall continuously monitor and control the security and functioning of ICT systems and tools and shall minimise the impact of ICT risk on ICT systems through…” | Article 9, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | Detection — Financial entities shall have in place mechanisms to promptly detect anomalous activities, in accordance with Article 17, including ICT network performance issues and ICT-related incidents, and to identify potential… (Art. 10) “Financial entities shall have in place mechanisms to promptly detect anomalous activities, in accordance with Article 17, including ICT network performance issues and ICT-related incidents, and to identify potential material single points of failure” | Article 10, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | Response and recovery — As part of the ICT risk management framework referred to in Article 6(1) and based on the identification requirements set out in Article 8, financial entities shall put in place a comprehensive ICT business continuity… (Art. 11) “As part of the ICT risk management framework referred to in Article 6(1) and based on the identification requirements set out in Article 8, financial entities shall put in place a comprehensive ICT business continuity policy, which may be adopted as a dedicated specific policy…” | Article 11, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | Learning and evolving — Financial entities shall have in place capabilities and staff to gather information on vulnerabilities and cyber threats, ICT-related incidents, in particular cyber-attacks, and analyse the impact they are likely to… (Art. 13) “Financial entities shall have in place capabilities and staff to gather information on vulnerabilities and cyber threats, ICT-related incidents, in particular cyber-attacks, and analyse the impact they are likely to have on their digital operational resilience” | Article 13, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | Communication — As part of the ICT risk management framework referred to in Article 6(1), financial entities shall have in place crisis communication plans enabling a responsible disclosure of, at least, major ICT-related incidents or… (Art. 14) “As part of the ICT risk management framework referred to in Article 6(1), financial entities shall have in place crisis communication plans enabling a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts as well as to…” | Article 14, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | Simplified ICT risk management framework — Articles 5 to 15 of this Regulation shall not apply to small and non-interconnected investment firms, payment institutions exempted pursuant to Directive (EU) 2015/2366 (Art. 16) “Articles 5 to 15 of this Regulation shall not apply to small and non-interconnected investment firms, payment institutions exempted pursuant to Directive (EU) 2015/2366” | Article 16, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | ICT-related incident management process — Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents (Art. 17) “Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents” | Article 17, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | Financial entities shall classify ICT-related incidents and shall determine their impact based on the following criteria: (a) the number and/or relevance of clients or financial counterparts affected and, where… (Art. 18) “Financial entities shall classify ICT-related incidents and shall determine their impact based on the following criteria: (a) the number and/or relevance of clients or financial counterparts affected and, where applicable, the amount or number of transactions affected by the…” | Article 18, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | In the event that a technical impossibility prevents the submission of the initial notification using the template, financial entities shall notify the competent authority about it via alternative means (Art. 20) “In the event that a technical impossibility prevents the submission of the initial notification using the template, financial entities shall notify the competent authority about it via alternative means” | Article 20, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | Operational or security payment-related incidents concerning credit institutions, payment institutions, account informat — The requirements laid down in this Chapter shall also apply to operational or security payment-related incidents and to major operational or security payment-related incidents, where they concern credit institutions…… “The requirements laid down in this Chapter shall also apply to operational or security payment-related incidents and to major operational or security payment-related incidents, where they concern credit institutions, payment institutions, account information service providers…” | Article 23, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | General requirements for the performance of digital operational resilience testing — For the purpose of assessing preparedness for handling ICT-related incidents, of identifying weaknesses, deficiencies and gaps in digital operational resilience, and of promptly implementing corrective measures… (Art. 24) “For the purpose of assessing preparedness for handling ICT-related incidents, of identifying weaknesses, deficiencies and gaps in digital operational resilience, and of promptly implementing corrective measures, financial entities, other than microenterprises, shall, taking into…” | Article 24, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | Testing of ICT tools and systems — The digital operational resilience testing programme referred to in Article 24 shall provide, in accordance with the criteria set out in Article 4(2), for the execution of appropriate tests, such as vulnerability… (Art. 25) “The digital operational resilience testing programme referred to in Article 24 shall provide, in accordance with the criteria set out in Article 4(2), for the execution of appropriate tests, such as vulnerability assessments and scans, open source analyses, network security…” | Article 25, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | Advanced testing of ICT tools, systems and processes based on TLPT — Financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, which are identified in accordance with paragraph 8, third subparagraph, of this Article, shall… (Art. 26) “Financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, which are identified in accordance with paragraph 8, third subparagraph, of this Article, shall carry out at least every 3 years advanced testing by means…” | Article 26, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | When financial entities use internal testers for the purposes of undertaking TLPT, they shall contract external testers every three tests (Art. 27) “When financial entities use internal testers for the purposes of undertaking TLPT, they shall contract external testers every three tests” | Article 27, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | General principles — Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and in accordance with the following principles: (a)… (Art. 28) [adjacent] “Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and in accordance with the following principles: (a) financial entities that have in place contractual…” | Article 28, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | When those contractual arrangements concern critical or important functions, financial entities shall, prior to concluding the arrangements, take due consideration of the use, by ICT third-party service providers, of… (Art. 29) “When those contractual arrangements concern critical or important functions, financial entities shall, prior to concluding the arrangements, take due consideration of the use, by ICT third-party service providers, of the most up-to-date and highest quality information security…” | Article 29, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | Key contractual provisions — The rights and obligations of the financial entity and of the ICT third-party service provider shall be clearly allocated and set out in writing (Art. 30) [adjacent] “The rights and obligations of the financial entity and of the ICT third-party service provider shall be clearly allocated and set out in writing” | Article 30, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | (1), shall: (a) designate the ICT third-party service providers that are critical for financial entities, following an assessment that takes into account the criteria specified in paragraph 2 (Art. 32) “(1), shall: (a) designate the ICT third-party service providers that are critical for financial entities, following an assessment that takes into account the criteria specified in paragraph 2” | Article 32, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | Tasks of the Lead Overseer — The Lead Overseer, appointed in accordance with Article 31(1), point (b), shall conduct the oversight of the assigned critical ICT third-party service providers and shall be, for the purposes of all matters related to… (Art. 33) “The Lead Overseer, appointed in accordance with Article 31(1), point (b), shall conduct the oversight of the assigned critical ICT third-party service providers and shall be, for the purposes of all matters related to the oversight, the primary point of contact for those…” | Article 33, Regulation (EU) 2022/2554 | in force |
| EU | EU_ESA | business continuity | Ranking of ICT third-party providers in the supply chain — Financial entities shall assign a rank to each ICT third-party service provider (Art. 2) [adjacent] “Financial entities shall assign a rank to each ICT third-party service provider” | Article 2, Implementing Reg (EU) 2024/2956 | in force |
| EU | EU_ESA | business continuity | General requirements for the templates of the register of information — Financial entities shall use the templates set out in Annex I to IV to maintain and update the register of information in accordance with Article 28(3) of Regulation (EU) 2022/2554, at entity level, or at… (Art. 3) “Financial entities shall use the templates set out in Annex I to IV to maintain and update the register of information in accordance with Article 28(3) of Regulation (EU) 2022/2554, at entity level, or at sub-consolidated and consolidated level” | Article 3, Implementing Reg (EU) 2024/2956 | in force |
| EU | EU_ESA | business continuity | Content of the register of information — Financial entities shall include in the register of information, in accordance with the instructions set out in Annex I, the following information: (a) general information on the financial entity maintaining and… (Art. 5) “Financial entities shall include in the register of information, in accordance with the instructions set out in Annex I, the following information: (a) general information on the financial entity maintaining and updating the register of information at entity, sub-consolidated…” | Article 5, Implementing Reg (EU) 2024/2956 | in force |
| EU | EU_ESA | cybersecurity | Identification of financial entities required to perform TLPT — TLPT authorities shall assess whether any financial entity is required to perform TLPT, taking into account the impact of those financial entities, their systemic character and their ICT risk profile, on the basis of… (Art. 2) [adjacent] “TLPT authorities shall assess whether any financial entity is required to perform TLPT, taking into account the impact of those financial entities, their systemic character and their ICT risk profile, on the basis of all of the following criteria: (a) impact-related and systemic…” | Article 2, Delegated Reg (EU) 2025/1190 | in force |
| EU | EU_ESA | cybersecurity | TCT and TLPT Test Managers — A TLPT authority shall assign the responsibility for coordinating TLPT-related activities to a TCT (Art. 3) [adjacent] “A TLPT authority shall assign the responsibility for coordinating TLPT-related activities to a TCT” | Article 3, Delegated Reg (EU) 2025/1190 | in force |
| EU | EU_ESA | cybersecurity | Organisational arrangements for financial entities — Financial entities shall appoint a control team lead which shall be responsible for the day-to-day management of the TLPT and the decisions and actions of the control team (Art. 4) [adjacent] “Financial entities shall appoint a control team lead which shall be responsible for the day-to-day management of the TLPT and the decisions and actions of the control team” | Article 4, Delegated Reg (EU) 2025/1190 | in force |
| EU | EU_ESA | cybersecurity | Risk management for TLPT — During the preparation phase referred to in Article 9, the control team shall assess the risks associated with the testing of live production systems of critical or important functions of the financial entity, including… (Art. 5) “During the preparation phase referred to in Article 9, the control team shall assess the risks associated with the testing of live production systems of critical or important functions of the financial entity, including potential impacts on: (a) the financial sector” | Article 5, Delegated Reg (EU) 2025/1190 | in force |
| EU | EU_ESA | cybersecurity | Risk management for pooled or joint TLPTs — In the case of a joint TLPT or a pooled TLPT, the control team of each financial entity shall conduct its own risk assessment and establish its own risk management measures (Art. 6) [adjacent] “In the case of a joint TLPT or a pooled TLPT, the control team of each financial entity shall conduct its own risk assessment and establish its own risk management measures” | Article 6, Delegated Reg (EU) 2025/1190 | in force |
| EU | EU_ESA | cybersecurity | Selection of TLPT providers — The control team shall take measures to manage the risks relating to the TLPT and shall in particular ensure that, for each TLPT: (a) the threat intelligence provider and external testers provide the control team with a… (Art. 7) [adjacent] “The control team shall take measures to manage the risks relating to the TLPT and shall in particular ensure that, for each TLPT: (a) the threat intelligence provider and external testers provide the control team with a detailed curriculum vitae and copies of certifications…” | Article 7, Delegated Reg (EU) 2025/1190 | in force |
| EU | EU_ESA | cybersecurity | Specificities for pooled or joint TLPTs — Unless otherwise decided by the lead TLPT authority, where several financial entities, identified in accordance with Article 16(2) or (4), are involved in a pooled or joint TLPT, each financial entity shall follow each… (Art. 8) “Unless otherwise decided by the lead TLPT authority, where several financial entities, identified in accordance with Article 16(2) or (4), are involved in a pooled or joint TLPT, each financial entity shall follow each of the steps set out in Articles 9 to 15” | Article 8, Delegated Reg (EU) 2025/1190 | in force |
| EU | EU_ESA | cybersecurity | Preparation phase — A financial entity identified pursuant to Article 26, paragraph 8, third subparagraph of Regulation (EU) 2022/2554 shall initiate a TLPT following a notification from the TLPT authority that a TLPT is to be carried out (Art. 9) [adjacent] “A financial entity identified pursuant to Article 26, paragraph 8, third subparagraph of Regulation (EU) 2022/2554 shall initiate a TLPT following a notification from the TLPT authority that a TLPT is to be carried out” | Article 9, Delegated Reg (EU) 2025/1190 | in force |
| EU | EU_ESA | cybersecurity | Following the approval of the scope specification document by the TLPT authority, the threat intelligence provider shall analyse generic and sector-specific threat intelligence relevant for the financial entity (Art. 10) [adjacent] “Following the approval of the scope specification document by the TLPT authority, the threat intelligence provider shall analyse generic and sector-specific threat intelligence relevant for the financial entity” | Article 10, Delegated Reg (EU) 2025/1190 | in force |
| EU | EU_ESA | cybersecurity | Following approval of the targeted threat intelligence report by the TLPT authority, the testers shall prepare the red team test plan that shall contain the information set out in Annex IV (Art. 11) [adjacent] “Following approval of the targeted threat intelligence report by the TLPT authority, the testers shall prepare the red team test plan that shall contain the information set out in Annex IV” | Article 11, Delegated Reg (EU) 2025/1190 | in force |
| EU | EU_ESA | cybersecurity | Closure phase — Following the end of the active red team testing phase, the control team lead shall inform the blue team that a TLPT took place (Art. 12) [adjacent] “Following the end of the active red team testing phase, the control team lead shall inform the blue team that a TLPT took place” | Article 12, Delegated Reg (EU) 2025/1190 | in force |
| EU | EU_ESA | cybersecurity | Remediation plan — Within 8 weeks from the notification referred to in Article 12(7) of this Regulation, the financial entity shall provide the remediation plans and the documentation referred to in Article 26(6) of Regulation (EU)… (Art. 13) “Within 8 weeks from the notification referred to in Article 12(7) of this Regulation, the financial entity shall provide the remediation plans and the documentation referred to in Article 26(6) of Regulation (EU) 2022/2554 to the TLPT authority and, where different, to the…” | Article 13, Delegated Reg (EU) 2025/1190 | in force |
| EU | EU_ESA | cybersecurity | Attestation — The attestation referred to in Article 26(7) of Regulation (EU) 2022/2554 shall contain the information set out in Annex VIII (Art. 14) [adjacent] “The attestation referred to in Article 26(7) of Regulation (EU) 2022/2554 shall contain the information set out in Annex VIII” | Article 14, Delegated Reg (EU) 2025/1190 | in force |
| EU | EU_ESA | cybersecurity | Use of internal testers — Financial entities shall establish all of the following arrangements for the use of internal testers: (a) the establishment and implementation of a policy for the management of internal testers in a TLPT (Art. 15) “Financial entities shall establish all of the following arrangements for the use of internal testers: (a) the establishment and implementation of a policy for the management of internal testers in a TLPT” | Article 15, Delegated Reg (EU) 2025/1190 | in force |
| EU | EU_ESA | cybersecurity | Cooperation and mutual recognition — For the purposes of conducting a TLPT in relation to a financial entity providing services in more than one Member State, including through a branch, its TLPT authority shall: (a) determine which TLPT authorities in… (Art. 16) “For the purposes of conducting a TLPT in relation to a financial entity providing services in more than one Member State, including through a branch, its TLPT authority shall: (a) determine which TLPT authorities in host Member States shall be involved, taking into account…” | Article 16, Delegated Reg (EU) 2025/1190 | in force |
| EU | EU_ESA | crisis management | Clients, financial counterparts and transactions — The number of clients affected by the incident as referred to in Article 18(1), point (a), of Regulation (EU) 2022/2554, shall reflect the number of all affected clients, whether natural or legal persons, that are or… (Art. 1) “The number of clients affected by the incident as referred to in Article 18(1), point (a), of Regulation (EU) 2022/2554, shall reflect the number of all affected clients, whether natural or legal persons, that are or were unable to make use of the service provided by the…” | Article 1, Delegated Reg (EU) 2024/1772 | in force |
| EU | EU_ESA | crisis management | Reputational impact — For the purposes of determining the reputational impact of the incident as referred to in Article 18(1), point (a), of Regulation (EU) 2022/2554, financial entities shall consider that a reputational impact has occurred… (Art. 2) “For the purposes of determining the reputational impact of the incident as referred to in Article 18(1), point (a), of Regulation (EU) 2022/2554, financial entities shall consider that a reputational impact has occurred where at least one of the following criteria is met: (a)…” | Article 2, Delegated Reg (EU) 2024/1772 | in force |
| EU | EU_ESA | crisis management | Duration and service downtime — Financial entities shall measure the duration of an incident as referred to in Article 18(1), point (b), of Regulation (EU) 2022/2554, from the moment the incident occurs until the moment when it is resolved (Art. 3) “Financial entities shall measure the duration of an incident as referred to in Article 18(1), point (b), of Regulation (EU) 2022/2554, from the moment the incident occurs until the moment when it is resolved” | Article 3, Delegated Reg (EU) 2024/1772 | in force |
| EU | EU_ESA | crisis management | Geographical spread — For the purpose of determining the geographical spread with regard to the areas affected by the incident as referred to in Article 18(1), point (c), of Regulation (EU) 2022/2554, financial entities shall assess whether… (Art. 4) “For the purpose of determining the geographical spread with regard to the areas affected by the incident as referred to in Article 18(1), point (c), of Regulation (EU) 2022/2554, financial entities shall assess whether the incident has or had an impact in other Member States…” | Article 4, Delegated Reg (EU) 2024/1772 | in force |
| EU | EU_ESA | crisis management | Data losses — For the purpose of determining the data losses that the incident entails as referred to in Article 18(1), point (d), of Regulation (EU) 2022/2554, financial entities shall take into account the following: (a) in… (Art. 5) “For the purpose of determining the data losses that the incident entails as referred to in Article 18(1), point (d), of Regulation (EU) 2022/2554, financial entities shall take into account the following: (a) in relation to the availability of data, whether the incident has…” | Article 5, Delegated Reg (EU) 2024/1772 | in force |
| EU | EU_ESA | crisis management | Criticality of services affected — For the purpose of determining the criticality of the services affected as referred to in Article 18(1), point (e), of Regulation (EU) 2022/2554, financial entities shall assess whether the incident: (a) affects or has… (Art. 6) “For the purpose of determining the criticality of the services affected as referred to in Article 18(1), point (e), of Regulation (EU) 2022/2554, financial entities shall assess whether the incident: (a) affects or has affected ICT services or network and information systems…” | Article 6, Delegated Reg (EU) 2024/1772 | in force |
| EU | EU_ESA | crisis management | Economic impact — For the purpose of determining the economic impact of the incident as referred to in Article 18(1), point (f), of Regulation (EU) 2022/2554, financial entities shall, without accounting for financial recoveries, take… (Art. 7) “For the purpose of determining the economic impact of the incident as referred to in Article 18(1), point (f), of Regulation (EU) 2022/2554, financial entities shall, without accounting for financial recoveries, take into account the following types of direct and indirect costs…” | Article 7, Delegated Reg (EU) 2024/1772 | in force |
| EU | EU_ESA | crisis management | Major incidents — An incident shall be considered a major incident for the purposes of Article 19(1) of Regulation (EU) 2022/2554 where it has affected critical services as referred to in Article 6 and where either of the following… (Art. 8) “An incident shall be considered a major incident for the purposes of Article 19(1) of Regulation (EU) 2022/2554 where it has affected critical services as referred to in Article 6 and where either of the following conditions is fulfilled: (a) the materiality threshold referred…” | Article 8, Delegated Reg (EU) 2024/1772 | in force |
| EU | EU_ESA | crisis management | Recurring incidents that individually are not considered a major incident in accordance with paragraph 1 shall be considered as one major incident where they meet all of the following conditions: (a) they have occurred… (Art. 9) “Recurring incidents that individually are not considered a major incident in accordance with paragraph 1 shall be considered as one major incident where they meet all of the following conditions: (a) they have occurred at least twice within 6 months” | Article 9, Delegated Reg (EU) 2024/1772 | in force |
| EU | EU_ESA | crisis management | High materiality thresholds for determining significant cyber threats — For the purposes of Article 18(2) of Regulation (EU) 2022/2554, a cyber threat shall be considered significant where all of the following conditions are fulfilled: (a) the cyber threat, if materialised, could affect or… (Art. 10) “For the purposes of Article 18(2) of Regulation (EU) 2022/2554, a cyber threat shall be considered significant where all of the following conditions are fulfilled: (a) the cyber threat, if materialised, could affect or could have affected critical or important functions of the…” | Article 10, Delegated Reg (EU) 2024/1772 | in force |
| EU | EU_ESA | crisis management | Relevance of major incidents to competent authorities in other Member States — The assessment of whether the major incident is relevant for competent authorities in other Member States as referred to in Article 19(7) of Regulation (EU) 2022/2554 shall be based on whether the incident has a root… (Art. 11) “The assessment of whether the major incident is relevant for competent authorities in other Member States as referred to in Article 19(7) of Regulation (EU) 2022/2554 shall be based on whether the incident has a root cause originating from another Member State or whether the…” | Article 11, Delegated Reg (EU) 2024/1772 | in force |
| EU | EU_ESA | crisis management | Details of major incidents to be shared with other competent authorities — The details of major incidents to be submitted by competent authorities to other competent authorities in accordance with Article 19(6) of Regulation (EU) 2022/2554 and the notifications to be submitted by EBA, ESMA or… (Art. 12) “The details of major incidents to be submitted by competent authorities to other competent authorities in accordance with Article 19(6) of Regulation (EU) 2022/2554 and the notifications to be submitted by EBA, ESMA or EIOPA and the ECB to the relevant competent authorities in…” | Article 12, Delegated Reg (EU) 2024/1772 | in force |
| EU | EU_ESA | business continuity | Overall risk profile and complexity — The policy on the use of ICT services supporting critical or important functions provided by ICT third-party service providers (the ‘policy’) shall take into account the size and the overall risk profile of the… (Art. 1) “The policy on the use of ICT services supporting critical or important functions provided by ICT third-party service providers (the ‘policy’) shall take into account the size and the overall risk profile of the financial entity, and the nature, scale and elements of increased or…” | Article 1, Delegated Reg (EU) 2024/1773 | in force |
| EU | EU_ESA | business continuity | Group application — Where this Regulation applies on a sub-consolidated or consolidated basis, the parent undertaking that is responsible for providing the consolidated or sub-consolidated financial statements for the group shall ensure… (Art. 2) [adjacent] “Where this Regulation applies on a sub-consolidated or consolidated basis, the parent undertaking that is responsible for providing the consolidated or sub-consolidated financial statements for the group shall ensure that the policy is implemented consistently in all financial…” | Article 2, Delegated Reg (EU) 2024/1773 | in force |
| EU | EU_ESA | business continuity | Governance arrangements — The management body shall review the policy at least once a year and update it where necessary (Art. 3) [adjacent] “The management body shall review the policy at least once a year and update it where necessary” | Article 3, Delegated Reg (EU) 2024/1773 | in force |
| EU | EU_ESA | business continuity | Main phases of the life cycle for the adoption and use of contractual arrangements — The policy shall specify the requirements, including the rules, the responsibilities and the processes, for each main phase of the lifecycle of the contractual arrangement, covering at least the following: (a) the… (Art. 4) “The policy shall specify the requirements, including the rules, the responsibilities and the processes, for each main phase of the lifecycle of the contractual arrangement, covering at least the following: (a) the responsibilities of the management body, including its…” | Article 4, Delegated Reg (EU) 2024/1773 | in force |
| EU | EU_ESA | business continuity | Ex-ante risk assessment — The policy shall require that the business needs of the financial entity are defined before a contractual arrangement is concluded (Art. 5) [adjacent] “The policy shall require that the business needs of the financial entity are defined before a contractual arrangement is concluded” | Article 5, Delegated Reg (EU) 2024/1773 | in force |
| EU | EU_ESA | business continuity | Due diligence — The policy shall set out an appropriate and proportionate process for selecting and assessing the prospective ICT third-party service providers taking into account whether or not the ICT third party service provider is… (Art. 6) “The policy shall set out an appropriate and proportionate process for selecting and assessing the prospective ICT third-party service providers taking into account whether or not the ICT third party service provider is an intragroup ICT service provider, and shall require that…” | Article 6, Delegated Reg (EU) 2024/1773 | in force |
| EU | EU_ESA | business continuity | Contractual clauses — The policy shall specify that the relevant contractual arrangement are to be in written form and are to include all the elements referred to in Article 30(2) and (3) of Regulation (EU) 2022/2554 (Art. 8) “The policy shall specify that the relevant contractual arrangement are to be in written form and are to include all the elements referred to in Article 30(2) and (3) of Regulation (EU) 2022/2554” | Article 8, Delegated Reg (EU) 2024/1773 | in force |
| EU | EU_ESA | business continuity | Monitoring of the contractual arrangements — The policy shall require that the contractual arrangements specify the measures and key indicators to monitor, on an ongoing basis, the performance of ICT third party service providers, including measures to monitor… (Art. 9) “The policy shall require that the contractual arrangements specify the measures and key indicators to monitor, on an ongoing basis, the performance of ICT third party service providers, including measures to monitor compliance with requirements regarding the confidentiality…” | Article 9, Delegated Reg (EU) 2024/1773 | in force |
| EU | EU_ESA | business continuity | Exit from and termination of the contractual arrangements — The policy shall contain requirements for a documented exit plan for each contractual arrangement and for the periodic review and testing of the documented exit plan (Art. 10) “The policy shall contain requirements for a documented exit plan for each contractual arrangement and for the periodic review and testing of the documented exit plan” | Article 10, Delegated Reg (EU) 2024/1773 | in force |
| US | NYDFS | business continuity | Maintain a cybersecurity program that includes the ability to recover from Cybersecurity Events and restore normal operations and services. “recover from Cybersecurity Events and restore normal operations and services” | 23 NYCRR 500.2(b)(5) | in force |
| US | NYDFS | business continuity | Include systems availability concerns in the written cybersecurity policy. “systems operations and availability concerns” | 23 NYCRR 500.3(f) | in force |
| US | NYDFS | business continuity | Include incident response procedures in the written cybersecurity policy. “incident response” | 23 NYCRR 500.3(n) | in force |
| US | NYDFS | business continuity | Establish and maintain audit trail systems designed to reconstruct material financial transactions sufficient to support normal operations, retained for at least five years. [adjacent] “designed to reconstruct material financial transactions sufficient to support normal operations and obligations of the Covered Entity” | 23 NYCRR 500.6(a)(1), 500.6(b) | in force |
| US | NYDFS | business continuity | Maintain audit trails designed to detect and respond to Cybersecurity Events that could materially harm normal operations, retained for at least three years. “audit trails designed to detect and respond to Cybersecurity Events that have a reasonable likelihood of materially harming any material part of the normal operations” | 23 NYCRR 500.6(a)(2), 500.6(b) | in force |
| US | NYDFS | business continuity | Conduct a periodic Risk Assessment that considers availability and effectiveness of controls to protect Information Systems, updated as necessary to address changes in operations. “the availability and effectiveness of controls to protect Nonpublic Information and Information Systems” | 23 NYCRR 500.9(a) | in force |
| US | NYDFS | business continuity | Ensure qualified cybersecurity personnel are sufficient to perform or oversee recovery from Cybersecurity Events (core cybersecurity function 500.2(b)(5)). “qualified cybersecurity personnel...sufficient to manage the Covered Entity's cybersecurity risks and to perform or oversee the performance of the core cybersecurity functions specified in section 500.2(b)(1)-(6)” | 23 NYCRR 500.10(a)(1) | in force |
| US | NYDFS | business continuity | Implement written policies and procedures governing Third Party Service Providers' cybersecurity practices, including periodic assessment based on risk they present. “periodic assessment of such Third Party Service Providers based on the risk they present and the continued adequacy of their cybersecurity practices” | 23 NYCRR 500.11(a)(4) | in force |
| US | NYDFS | business continuity | Require Third Party Service Providers to provide notice to the Covered Entity upon any Cybersecurity Event directly impacting the Covered Entity's Information Systems or its Nonpublic Information. [adjacent] “notice to be provided to the Covered Entity in the event of a Cybersecurity Event directly impacting the Covered Entity's Information Systems or the Covered Entity's Nonpublic Information being held by the Third Party Service Provider” | 23 NYCRR 500.11(b)(3) | in force |
| US | NYDFS | business continuity | Establish a written incident response plan designed to promptly respond to and recover from Cybersecurity Events affecting availability or continuing functionality of business operations. “written incident response plan designed to promptly respond to, and recover from, any Cybersecurity Event materially affecting...the continuing functionality of any aspect of the Covered Entity's business or operations” | 23 NYCRR 500.16(a) | in force |
| US | NYDFS | business continuity | Ensure the incident response plan defines clear roles, responsibilities, and decision-making authority for responding to and recovering from Cybersecurity Events. “the definition of clear roles, responsibilities and levels of decision-making authority” | 23 NYCRR 500.16(b)(3) | in force |
| US | NYDFS | business continuity | Ensure the incident response plan addresses external and internal communications and information sharing during a Cybersecurity Event. “external and internal communications and information sharing” | 23 NYCRR 500.16(b)(4) | in force |
| US | NYDFS | business continuity | Ensure the incident response plan addresses identification and remediation of weaknesses in Information Systems and controls following a Cybersecurity Event. “identification of requirements for the remediation of any identified weaknesses in Information Systems and associated controls” | 23 NYCRR 500.16(b)(5) | in force |
| US | NYDFS | business continuity | Ensure the incident response plan requires documentation and reporting regarding Cybersecurity Events and incident response activities. “documentation and reporting regarding Cybersecurity Events and related incident response activities” | 23 NYCRR 500.16(b)(6) | in force |
| US | NYDFS | business continuity | Evaluate and revise the incident response plan as necessary following a Cybersecurity Event. “the evaluation and revision as necessary of the incident response plan following a Cybersecurity Event” | 23 NYCRR 500.16(b)(7) | in force |
| US | NYDFS | business continuity | Notify the Superintendent within 72 hours of determining a Cybersecurity Event with reasonable likelihood of materially harming normal operations has occurred. “no event later than 72 hours from a determination that a Cybersecurity Event has occurred...Cybersecurity Events that have a reasonable likelihood of materially harming any material part of the normal operation(s) of the Covered Entity” | 23 NYCRR 500.17(a)(2) | in force |
| US | NYDFS | business continuity | Notify the Superintendent within 72 hours of determining a Cybersecurity Event requiring notice to any government body or regulatory/self-regulatory agency has occurred. [adjacent] “no event later than 72 hours from a determination that a Cybersecurity Event has occurred...Cybersecurity Events impacting the Covered Entity of which notice is required to be provided to any government body, self-regulatory agency or any other supervisory body” | 23 NYCRR 500.17(a)(1) | in force |
| US | NYDFS | business continuity | Include in the cybersecurity program monitoring and testing—including penetration testing and vulnerability assessments—to assess program effectiveness, supporting detection and response to threats that could disrupt operations. [adjacent] “monitoring and testing, developed in accordance with the Covered Entity's Risk Assessment, designed to assess the effectiveness of the Covered Entity's cybersecurity program...annual Penetration Testing...bi-annual vulnerability assessments” | 23 NYCRR 500.5 | in force |
| US | NYDFS | business continuity | Maintain a cybersecurity program designed to protect the availability of the Covered Entity's Information Systems. “maintain a cybersecurity program designed to protect the confidentiality, integrity and availability of the Covered Entity's Information Systems” | 23 NYCRR 500.2(a) | in force |
| US | NYDFS | business continuity | Include in the cybersecurity program the ability to detect and respond to Cybersecurity Events to mitigate negative effects on operations. “respond to identified or detected Cybersecurity Events to mitigate any negative effects” | 23 NYCRR 500.2(b)(4) | in force |
| US | NYDFS | business continuity | Implement written TPSP policies that include minimum cybersecurity practices required of third parties, supporting resilience of systems accessible to or held by those providers. “minimum cybersecurity practices required to be met by such Third Party Service Providers in order for them to do business with the Covered Entity” | 23 NYCRR 500.11(a)(2) | in force |
| US | NYDFS | business continuity | Make available to the Superintendent upon request all documentation relevant to the cybersecurity program, including BCDR and incident response components. [adjacent] “All documentation and information relevant to the Covered Entity's cybersecurity program shall be made available to the superintendent upon request” | 23 NYCRR 500.2(d) | in force |
| US | NYDFS | business continuity | Maintain records supporting the annual compliance certification for five years, including documentation of remedial efforts for identified areas requiring improvement. [adjacent] “maintain for examination by the Department all records, schedules and data supporting this certificate for a period of five years...document the identification and the remedial efforts planned and underway” | 23 NYCRR 500.17(b) | in force |
| US | NYDFS | business continuity | Include vendor and Third Party Service Provider management in the written cybersecurity policy to address resilience risks from third-party dependencies. “vendor and Third Party Service Provider management” | 23 NYCRR 500.3(l) | in force |
| US | NYDFS | crisis management | The institution should maintain cybersecurity programs, policies, and procedures based on Risk Assessments that account for AI-related risks including deepfakes, threats from TPSPs' AI use, and AI vulnerabilities affecting availability of Information Systems. “Covered Entities should address AI-related risks in the following areas: the organization's own use of AI, the AI technologies utilized by TPSPs and vendors, and any potential vulnerabilities stemming from AI applications that could pose a risk to the confidentiality, integrity…” | 23 NYCRR §§ 500.2 and 500.3 | in force |
| US | NYDFS | crisis management | Update Risk Assessments at least annually and whenever a material change in business or technology affects cybersecurity risk, ensuring new AI-related risks are assessed and reflected in updated policies and procedures. [adjacent] “The Cybersecurity Regulation requires Risk Assessments to be updated at least annually and whenever a change in the business or technology causes a material change to a Covered Entity's cybersecurity risk to ensure new risks, including those posed by AI, are assessed.” | 23 NYCRR §§ 500.2, 500.3, and 500.9 | in force |
| US | NYDFS | crisis management | Maintain TPSP policies and procedures including due diligence guidelines addressing AI-related cybersecurity risks posed by third-party service providers, including how TPSPs protect against AI-enabled threats that could impact the Covered Entity. [adjacent] “One of the most important requirements for combatting AI-related risks is to maintain TPSP policies and procedures that include guidelines for conducting due diligence before a Covered Entity uses a TPSP that will access its Information Systems and/or NPI.” | 23 NYCRR § 500.11(a) | in force |
| US | NYDFS | crisis management | The institution should require TPSPs to provide timely notification of any Cybersecurity Event that directly impacts the Covered Entity's Information Systems or NPI held by the TPSP, including AI-related threats. “Covered Entities should require TPSPs to provide timely notification of any Cybersecurity Event that directly impacts the Covered Entity's Information Systems or NPI held by the TPSP, including threats related to AI.” | 23 NYCRR § 500.11(a) | in force |
| US | NYDFS | crisis management | Maintain a monitoring process to promptly identify new security vulnerabilities in Information Systems (especially those holding NPI) to enable rapid remediation, including monitoring relevant to AI-enabled attacks. [adjacent] “Covered Entities must have a monitoring process in place that can identify new security vulnerabilities promptly so remediation can occur quickly.” | 23 NYCRR § 500.5(b) | in force |
| US | NYDFS | crisis management | Monitor Authorized User activity and email/web traffic to block malicious content and protect against installation of malicious code, including monitoring for unusual AI-related query behaviors that may indicate NPI exfiltration. [adjacent] “Covered Entities must monitor the activity of Authorized Users as well as email and web traffic to block malicious content and protect against the installation of malicious code on their Information Systems.” | 23 NYCRR §§ 500.5(b) and 500.14(a)(1)-(2) | in force |
| US | NYDFS | crisis management | Implement MFA for all Authorized Users attempting to access Covered Entities' Information Systems or NPI, including customers, employees, contractors, and TPSPs, using factors resilient to AI-enabled deepfake attacks. [adjacent] “As of November 2025, the Cybersecurity Regulation will require MFA to be in place for all Authorized Users attempting to access Covered Entities' Information Systems or NPI, including customers, employees, contractors, and TPSPs.” | 23 NYCRR § 500.12 | in force |
| US | NYDFS | crisis management | Implement access controls limiting each Authorized User's access privileges to only those necessary for their job functions, limiting elevated permissions, and periodically (at minimum annually) reviewing and removing unnecessary access privileges. [adjacent] “The controls must limit an Authorized User's access privileges to only those necessary for that Authorized User's job functions, and limit the number of Authorized Users with elevated permissions and access to NPI.” | 23 NYCRR § 500.7(a)(1),(2),(4),(5),(6) | in force |
| US | NYDFS | crisis management | Maintain and update a data inventory of all Information Systems, with priority on AI-related systems critical to ongoing business operations, to support breach response and continuity. “Covered Entities should maintain and update data inventories as they are crucial for assessing potential risks and ensuring compliance with data protection regulations. Data inventories further help entities track NPI so that if there is a breach, they know what NPI may have…” | 23 NYCRR § 500.13(a) | in force |
| US | NYDFS | crisis management | The institution should identify all Information Systems that use or rely on AI (including AI-enabled products/services), maintain an inventory of such systems, and prioritize implementing mitigations for systems critical to ongoing business operations. [adjacent] “Entities should identify all Information Systems that use or rely on AI, including, if applicable, the Information Systems that maintain, or rely on, AI-enabled products and services... and prioritize implementing mitigations for those systems that are critical for ongoing…” | 23 NYCRR § 500.13 | in force |
| US | NYDFS | crisis management | The institution should implement data governance procedures covering collection, storage, processing, and disposal of data, including controls to prevent threat actors from accessing data maintained for AI functioning. [adjacent] “Entities should implement data governance procedures that include data collection, storage, processing, and disposal. Moreover, if an entity uses AI or relies on a product that uses AI, controls should be in place to prevent threat actors from accessing the vast amounts of data…” | 23 NYCRR § 500.3(b) | in force |
| US | NYDFS | crisis management | Provide at least annual cybersecurity awareness training for all personnel that includes social engineering (including deepfake attacks), procedures for responding to unusual requests, and AI-related threats. [adjacent] “Covered Entities must now provide at least annual cybersecurity awareness training that includes social engineering. Training on social engineering, including on deepfake attacks, can be effectively delivered through simulated phishing, and voice and video impersonation…” | 23 NYCRR § 500.14(a)(3) | in force |
| US | NYDFS | crisis management | The institution should train relevant personnel on how to secure and defend AI systems from cybersecurity attacks and how to design/develop AI systems securely, where the entity deploys or relies on TPSP-deployed AI. [adjacent] “If deploying AI directly, or working with a TPSP that deploys AI, relevant personnel should be trained on how to secure and defend AI systems from cybersecurity attacks, and how to design and develop AI systems securely.” | 23 NYCRR § 500.14(a)(3) | in force |
| US | NYDFS | crisis management | Ensure the Senior Governing Body has sufficient understanding of AI-related cybersecurity risks, exercises oversight of cybersecurity risk management including AI risks, and regularly receives management reports on AI-related cybersecurity matters. [adjacent] “The Cybersecurity Regulation requires the Senior Governing Body to have sufficient understanding of cybersecurity-related matters (including AI-related risks), exercise oversight of cybersecurity risk management, and regularly receive and review management reports about…” | 23 NYCRR § 500.4(d) | in force |
| US | NYDFS | crisis management | The institution is encouraged to conduct due diligence on TPSPs that will access Information Systems or NPI, specifically assessing AI-related threats facing those TPSPs and how TPSP compromise could impact the Covered Entity's continuity and security. “DFS strongly recommends Covered Entities consider, among other factors, the threats facing TPSPs from the use of AI and AI-enabled products and services; how those threats, if exploited, could impact the Covered Entity; and how the TPSPs protect themselves from such exploitation.” | 23 NYCRR § 500.11(a) | in force |
| UK | UK_FCA | business continuity | Identify important business services (IBS) — those whose disruption could cause intolerable harm to clients or risk to market integrity. “our rules only require firms to identify their important business services for the purposes of operational resilience” | SYSC 15A.2.1R–2R | in force |
| UK | UK_FCA | business continuity | Review IBS at least annually or upon any material change to the business or market. “firms will need to review their important business services at least once per year, or whenever there is a material change to their business or the market in which they operate” | SYSC 15A.2.1R–2R | in force |
| UK | UK_FCA | business continuity | The institution should set an impact tolerance for each IBS at the first point at which disruption would cause intolerable harm to clients or risk to market integrity. “firms should set their impact tolerances at the first point at which a disruption to an important business service would cause intolerable levels of harm to consumers or risk to market integrity” | SYSC 15A.2.1R–2R; SYSC 15A.2.7G | in force |
| UK | UK_FCA | business continuity | Use time/duration as a mandatory metric when measuring impact tolerances, supplemented by additional metrics as appropriate. “we are proceeding as consulted to require that firms use time/duration as a mandatory metric to measure their impact tolerances” | SYSC 15A.2.1R–2R | in force |
| UK | UK_FCA | business continuity | The institution should review impact tolerances at least annually or upon material change to the business or market. “firms should set and review their impact tolerances at least once per year or if there is a relevant change to the firm's business or the market in which it operates” | SYSC 15A.2.1R–2R | in force |
| UK | UK_FCA | business continuity | Remain within impact tolerances as soon as reasonably practicable, and no later than 31 March 2025. “Firms must be able to remain within their impact tolerances as soon as reasonably practicable, but no later than 3 years after the rules come into effect on 31 March 2022” | PS21/3 Chapter 1 para 1.32 | in force |
| UK | UK_FCA | business continuity | Map each IBS by identifying and documenting the people, processes, technology, facilities and information that support it. “firms have a clear picture of the resources that enable an important business service to function... by identifying and documenting the people, processes, technology, facilities and information that support them” | SYSC 15A | in force |
| UK | UK_FCA | business continuity | The institution should capture internal processes (e.g. payroll, IT services) that support IBS delivery within mapping exercises. “internal processes... which are necessary to the provision of important business services and should be captured by firms as part of their mapping exercises” | SYSC 15A | in force |
| UK | UK_FCA | business continuity | Conduct scenario testing of each IBS against severe but plausible scenarios to assess ability to remain within impact tolerances. “firms need to test their impact tolerances in a range of severe but plausible scenarios. This approach will give firms a clear idea when they initially test their impact tolerances of where such unexpected events may mean they cannot remain within tolerance” | SYSC 15A | in force |
| UK | UK_FCA | business continuity | Include cyber-attacks as a scenario category in scenario testing plans for IBS. “multiple important business services could be disrupted simultaneously due to an external factor directly affecting the service. For example, this could be due to a cyber-attack which hits a wide range of operational assets” | SYSC 15A; PS21/3 Chapter 3 para 3.12 | in force |
| UK | UK_FCA | business continuity | Consider the simultaneous disruption of multiple IBS in testing plans, including shared underlying systems, processes or people. “for substitute services which rely on the same systems, processes or people, firms should not assume, as part of their testing plans, that these services won't be affected in the event of disruption” | SYSC 15A; PS21/3 Chapter 3 para 3.12 | in force |
| UK | UK_FCA | business continuity | Identify key staff pivotal to delivering each IBS and maintain contingency plans for their incapacitation. “firms need to understand which staff are pivotal to delivering an important business service, with contingency plans if those staff become incapacitated” | SYSC 15A; PS21/3 Chapter 1 para 1.21 | in force |
| UK | UK_FCA | business continuity | The institution should report to the FCA any failure to remain within impact tolerances in line with SYSC 15A.2.11G. “if despite extensive scenario testing a firm finds itself not able to remain within impact tolerance for any reason, it should report the issue to the FCA in line with SYSC 15A.2.11G” | SYSC 15A.2.11G | in force |
| UK | UK_FCA | business continuity | The institution should also report to the FCA where resuming a compromised service would cause further detriment (e.g. spreading a computer virus). “firms should consider such circumstances in their testing plans and report any issue with remaining in tolerance to the FCA in line with SYSC 15A.2.11G” | SYSC 15A.2.11G; PS21/3 Chapter 3 | in force |
| UK | UK_FCA | business continuity | When outsourcing IBS to third parties, the institution should work effectively with those providers to set and remain within impact tolerances; responsibility remains with the firm. “When a firm is using a third-party provider in the provision of important business services, it should work effectively with that provider to set and remain within impact tolerances. Ultimately, the requirements... remain the responsibility of the firm” | SYSC 15A; PS21/3 Chapter 3 para 3.14 | in force |
| UK | UK_FCA | business continuity | Identify and manage third-party dependencies (including cloud providers and technology vendors) within IBS mapping to address concentration and continuity risk. “the pandemic highlighted increasing dependence on third parties and outsourcing arrangements... some firms experienced challenges with offshore third-party providers... which affected continuity of service to UK consumers” | SYSC 15A; PS21/3 Chapter 1 para 1.19(b) | in force |
| UK | UK_FCA | business continuity | Ensure scenario testing incorporates third-party/outsourced service disruptions, including offshore provider lockdowns. “some firms experienced challenges with offshore third-party providers, particularly where providers were under lockdown in another geographical location, which affected continuity of service” | SYSC 15A; PS21/3 Chapter 1 para 1.19(b) | in force |
| UK | UK_FCA | business continuity | The institution should identify the users of each IBS so that impacts of disruption are clear and communications/alternative mechanisms can be targeted. “users of the service should be identifiable so that the impacts of disruption (through process, cyber security or technology failures) are clear” | SYSC 15A.2.4G(1); PS21/3 Chapter 2 para 2.21 | in force |
| UK | UK_FCA | business continuity | Consider the needs of vulnerable consumers when setting impact tolerances and design communications/alternative mechanisms to minimise their harm during disruptions. “Consideration of the needs of vulnerable consumers is central to a firm's setting of an impact tolerance, and firms should consider these groups when considering how much disruption could be tolerated. Firms should also construct communications and alternative mechanisms to…” | SYSC 15A.2.7G | in force |
| UK | UK_FCA | business continuity | Dual-regulated firms should set up to 2 impact tolerances per IBS — one aligned to FCA objectives and one aligned to PRA objectives. “For dual-regulated firms, we maintain the position that these firms should set up to 2 impact tolerances. This is to ensure that firms consider their impact tolerances in line with the statutory objectives of each authority” | SYSC 15A; PS21/3 Chapter 3 para 3.18–3.20 | in force |
| UK | UK_FCA | business continuity | Dual-regulated firms' recovery and response arrangements must be viable for both shorter and longer impact tolerance periods. “its recovery and response arrangements are also appropriate for the longer tolerance (ie recovery and response arrangements must be viable for both shorter and longer time periods)” | SYSC 15A; PS21/3 Chapter 3 para 3.20 | in force |
| UK | UK_FCA | business continuity | Where group-level impact tolerances differ from entity-level tolerances, the group Board should consider, approve and resource the entity's tolerance. “In situations where an entity sets an impact tolerance at a lower level than that set by the group, the group's Board should consider and approve... and ensure that the entity has appropriate resources to meet its identified tolerance” | PS21/3 Chapter 3 para 3.10 | in force |
| UK | UK_FCA | business continuity | The institution should assess, before resuming a degraded service, whether (a) it can safely resume without causing further detriment and (b) resumption benefits outweigh keeping the service unavailable. “firms should consider whether (a) the degraded service can safely resume without causing further detriment and (b) the benefits of resuming a degraded service outweigh the negatives of keeping the service unavailable until the issues have been remediated” | SYSC 15A.2.11G; PS21/3 Chapter 3 | in force |
| UK | UK_FCA | business continuity | Payments/e-money firms must apply operational resilience requirements only to their payments and/or e-money activities where other FSMA activities are not in scope. “payments firms only have to apply our operational resilience proposals to their payments and/or e-money activities. To clarify this, we have amended SYSC 15A.1 (Application)” | SYSC 15A.1 | in force |
| UK | UK_FCA | business continuity | Establish sound, effective and comprehensive strategies, controls, processes and systems to enable compliance with all CTPS operational resilience rules. “A critical third party must have in place sound, effective and comprehensive strategies, controls, processes and systems that enable it to comply with the rules in CTPS.” | CTPS 4.1.1R | in force |
| UK | UK_FCA | business continuity | Establish governance arrangements that include a named regulator liaison, clear escalation channels, and an approach covering prevention, response, adaptation and recovery from CTP operational incidents. “A critical third party must ensure that its governance arrangements promote the resilience of any systemic third party service it provides, including by... establishing, overseeing and implementing an approach that covers... prevent, respond and adapt to, as well as recover…” | CTPS 4.2.1R | in force |
| UK | UK_FCA | business continuity | Implement lessons learned from CTP operational incidents and from testing and exercising into governance and operational arrangements. “implementing lessons learned from CTP operational incidents and any testing and exercising undertaken, including but not limited to that undertaken in accordance with CTPS 5.” | CTPS 4.2.1R(4) | in force |
| UK | UK_FCA | business continuity | Identify, monitor and manage risks to ability to deliver systemic third party services, and regularly update risk management processes using lessons from incidents, regulator engagement and testing. “A critical third party must manage effectively risks to its ability to deliver a systemic third party service including by: (1) identifying and monitoring relevant external and internal risks; (2) ensuring that it has in place risk management processes... (3) regularly updating…” | CTPS 4.3.1R | in force |
| UK | UK_FCA | business continuity | Identify and manage supply chain risks that could affect delivery of systemic third party services, including risks from key nth-party providers. “A critical third party must... identify and manage any risks to its supply chain that could affect its ability to deliver a systemic third party service.” | CTPS 4.4.1R | in force |
| UK | UK_FCA | business continuity | Take reasonable steps to ensure key nth-party providers and connected persons in the supply chain are informed of CTP duties, cooperate in meeting them, and grant regulators access to relevant information. “A critical third party must take reasonable steps to ensure that its key nth-party providers and persons connected with a critical third party that are part of its supply chain: (1) are informed of the CTP duties... (2) cooperate... (3) provide the regulators with access to any…” | CTPS 4.4.2R | in force |
| UK | UK_FCA | business continuity | Take reasonable steps to ensure the technology resilience of systemic third party services, including sound cyber resilience strategies and regular testing and exercising of those strategies. “A critical third party must... take reasonable steps to ensure the resilience of any technology that delivers, maintains or supports a systemic third party service, including by having: (1) sound, effective and comprehensive strategies... to adequately manage risks to its…” | CTPS 4.5.1R | in force |
| UK | UK_FCA | business continuity | Implement systematic change management for systemic third party services, including risk assessment, testing, verification and approval of all changes before implementation to minimise disruption risk. “A critical third party must ensure that it has a systematic and effective approach to dealing with changes to a systemic third party service... implementing any change... in a way that minimises appropriately the risk of any CTP operational incident occurring; and ensuring that…” | CTPS 4.6.1R | in force |
| UK | UK_FCA | business continuity | Within 12 months of Treasury designation, map and document all resources, persons, assets, supporting services, technology, and interdependencies used to deliver each systemic third party service; update regularly thereafter. “A critical third party must: (1) within 12 months of being designated by the Treasury, identify and document: (a) the resources... used to deliver, support and maintain each systemic third party service... and (b) any internal and external interconnections and…” | CTPS 4.7.1R | in force |
| UK | UK_FCA | business continuity | Implement measures to respond to and recover from CTP operational incidents, set a maximum tolerable level of disruption for each systemic service, and maintain an incident management playbook within 12 months of designation. “A critical third party must manage effectively CTP operational incidents including by: (1) implementing appropriate measures to respond to and recover from CTP operational incidents... (2) setting an appropriate maximum tolerable level of disruption... (3) maintaining and…” | CTPS 4.8.1R | in force |
| UK | UK_FCA | business continuity | The incident management playbook must set out plans and procedures to respond to and recover from CTP operational incidents and facilitate effective communication with regulators and affected firms. “maintaining and operating an incident management playbook... which sets out the plans and procedures to be followed by the critical third party in the event of a CTP operational incident in order to: (a) respond to and recover from the CTP operational incident; and (b)…” | CTPS 4.8.1R(3) | in force |
| UK | UK_FCA | business continuity | Cooperate and coordinate with regulators and affected firms in response to CTP operational incidents, including through collective incident response frameworks. “cooperating and coordinating with the regulators and affected firms in response to CTP operational incidents, including through collective incident response frameworks.” | CTPS 4.8.1R(4) | in force |
| UK | UK_FCA | business continuity | Put in place measures for effective, orderly and timely termination of any systemic third party service, including transfer support and recovery/return of firm assets in an accessible format. “A critical third party must have in place appropriate measures to respond to a termination of any of its systemic third party services... including by putting in place: (1) arrangements to support the effective, orderly and timely termination of that service... (2) provision for…” | CTPS 4.9.1R | in force |
| UK | UK_FCA | business continuity | Be able to demonstrate to regulators the ability to comply with all CTPS requirements. [adjacent] “A critical third party must be able to demonstrate to the regulators its ability to comply with CTPS.” | CTPS 5.1.1R | in force |
| UK | UK_FCA | business continuity | Carry out regular scenario testing of ability to continue providing each systemic third party service within its maximum tolerable disruption level under severe but plausible disruption scenarios covering varying nature, severity and duration. “a critical third party must carry out regular scenario testing of its ability to continue providing each systemic third party service within its appropriate maximum tolerable level of disruption... in the event of a severe but plausible disruption... identify an appropriate…” | CTPS 5.2.1R, CTPS 5.2.2R | in force |
| UK | UK_FCA | business continuity | Regularly assess effectiveness of the incident management playbook; conduct an incident management playbook exercise with a representative sample of firms within 12 months of designation and at least biennially thereafter. “a critical third party must assess the effectiveness of its incident management playbook regularly, including undertaking an appropriate incident management playbook exercise with a representative sample of the firms... within 12 months of the critical third party being…” | CTPS 5.3.1R | in force |
| UK | UK_FCA | business continuity | Prepare and submit to regulators a report of each incident management playbook exercise, including actions taken in light of results, as soon as practicable after the exercise. “A critical third party must, as soon as is practicable, prepare and submit to the regulators a report of the incident management playbook exercise undertaken under CTPS 5.3.1R (including any actions taken in the light of the results of that exercise).” | CTPS 5.3.2R | in force |
| UK | UK_FCA | business continuity | Provide regulators with an interim self-assessment within 3 months of designation and annual self-assessments thereafter on compliance with CTPS; retain copies for at least 3 years. [adjacent] “A critical third party must provide to the regulators: (1) within 3 months... an interim self-assessment; and (2) annually thereafter, an annual self-assessment, of the critical third party's compliance with CTPS... must keep a copy... for a period of at least 3 years.” | CTPS 6.1.1R, CTPS 6.1.2R | in force |
| UK | UK_FCA | business continuity | Maintain effective and secure processes to provide firms with sufficient and timely information—including test results, self-assessments and maximum tolerable disruption levels—to enable them to manage risks from using the CTP's systemic third party services. “A critical third party must have in place effective and secure processes and procedures to ensure sufficient and timely information is given to a firm... including... results of testing and exercising... the annual self-assessment... the appropriate maximum tolerable level of…” | CTPS 7.1.1R, CTPS 7.1.2R | in force |
| UK | UK_FCA | business continuity | Submit an initial incident report to regulators and affected firms as soon as practicable after a CTP operational incident, covering nature/extent of disruption, detection time, affected services, geography, cause, recovery timeline and initial actions. “A critical third party must, as soon as is practicable after the occurrence of a CTP operational incident... submit the following information... (a) a description of the CTP operational incident... (d) the anticipated amount of time it will take to resolve the CTP operational…” | CTPS 8.1.1R | in force |
| UK | UK_FCA | business continuity | Submit intermediate incident reports to regulators and affected firms as soon as practicable after any significant change in circumstances, including when the incident is resolved. “A critical third party must, as soon as is practicable after any significant change in circumstances... provide the regulators and the affected firms with information further to that already disclosed in relation to the CTP operational incident, including... any steps taken to…” | CTPS 8.2.1R | in force |
| UK | UK_FCA | business continuity | Submit a final incident report to regulators and affected firms within a reasonable time of resolution, covering root causes, remedial actions, recurrence likelihood, long-term implications and improvement areas. “A critical third party must, within a reasonable time of the CTP operational incident being resolved, provide the regulators and the affected firms with the following information... (2) a description of the root causes... (3) a description of any remedial actions... (4) a…” | CTPS 8.3.1R | in force |
| UK | UK_FCA | business continuity | Notify regulators immediately of any actual or potential circumstance that seriously and adversely impacts, or could impact, the CTP's ability to deliver systemic third party services or meet CTPS obligations. “A critical third party must notify the regulators immediately where there is an actual or potential circumstance or event that seriously and adversely impacts, or could seriously and adversely impact, the critical third party's ability to deliver any of its systemic third party…” | CTPS 9.1.1R | in force |
| UK | UK_FCA | business continuity | Ensure all information provided to regulators and firms under CTP duties (including incident reports and notifications) is factually accurate, complete and fairly based; correct any inaccurate information immediately upon discovery. [adjacent] “A critical third party must take reasonable steps to ensure that all information it gives to the regulators and firms... is: (1) factually accurate or, in the case of estimates and judgements, fairly and properly based... (2) complete... If a critical third party becomes…” | CTPS 10.1.1R, CTPS 10.1.3R | in force |
| UK | UK_FCA | business continuity | When appointing a skilled person, contractually require and permit them to cooperate with regulators, report matters of material significance, comply with regulator instructions on reporting, and assist the skilled person with information and access. [adjacent] “When a critical third party appoints a skilled person, the critical third party must, in a contract with that person: (1) require and permit the skilled person during and after the course of their appointment: (a) to cooperate with the regulators in connection with the discharge…” | CTPS 13.5.1R | in force |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): All firms must submit a report to the FCA as soon as practicable (within 24 hours) after an operational incident meets any notification threshold (risk of intolerable consumer harm, safety/soundness, or market stability). “A firm must submit a report to the FCA in accordance with (2) or (3), as applicable, as soon as is practicable after the occurrence of an operational incident which the firm reasonably believes meets one or more of the notification thresholds” | SUP 15.18.6R(1) and SUP 15.18.7G | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Enhanced reporting firms must submit an initial phase report containing mandatory fields (Annex 15.1R cols 1 & 2) to the FCA as soon as practicable after an operational incident threshold is met. “For this initial phase of the report, an enhanced reporting firm must submit to the FCA, so far as it is aware, the information in accordance with columns (1) and (2) of the table in SUP 15 Annex 15.1R.” | SUP 15.18.6R(2) | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Enhanced reporting firms must submit an intermediate phase report to the FCA as soon as practicable after any significant change in circumstances from those in the initial report, including resolution of the incident. “For the intermediate phase of the report, an enhanced reporting firm must, so far as it is aware, submit to the FCA the additional information in accordance with columns (1) and (3) of the table in SUP 15 Annex 15.1R, as soon as is practicable after any significant change in…” | SUP 15.18.8R | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Enhanced reporting firms must submit a final phase report within 30 working days (or 60 working days if impracticable) of an operational incident being resolved. “For the final phase of the report, an enhanced reporting firm must submit to the FCA the additional information in accordance with columns (1) and (4) of the table in SUP 15 Annex 15.1R: (1) within 30 working days; or (2) where this is impracticable, as soon as is practicable…” | SUP 15.18.9R | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Non-enhanced reporting firms must submit a standard report (Annex 15.2R) to the FCA as soon as practicable after an operational incident meets any notification threshold. “A firm other than an enhanced reporting firm must submit to the FCA, so far as it is aware, information in accordance with the table in SUP 15 Annex 15.2R.” | SUP 15.18.6R(3) | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): All firms required to report operational incidents must submit reports exclusively online through the appropriate systems accessible from the FCA's website. “A firm must submit the information required under this section to the FCA online through the appropriate systems accessible from the FCA's website.” | SUP 15.18.10R | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Payment service providers must submit the initial operational incident report to the FCA within 4 hours of first detecting a major operational or security incident. “A payment service provider must submit the report in SUP 15.18.6R to the FCA within 4 hours of first detecting a major operational or security incident.” | SUP 15.14.18DD | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Enhanced reporting firms must include in the final phase report the proportion of impact tolerance used, service downtime, number/percentage of affected customers, and transactions affected. “What proportion of an impact tolerance has been used?... Service downtime... Number of affected customers... Percentage of service users affected... Percentage of transactions affected... Value of transactions affected... Number of transactions affected” | SUP 15 Annex 15.1R (col 4, fields 24-30) | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Enhanced reporting firms must include in the final phase report lessons identified and remedial actions being taken following an operational incident. “Describe the lesson identified... Not applicable... Not applicable... Mandatory... Describe the remedial action being taken... Not applicable... Not applicable... Mandatory” | SUP 15 Annex 15.1R (col 4, fields 41-42) | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Where an operational incident originates from a third party, enhanced reporting firms must identify the third party provider name and LEI in both initial and intermediate phase reports. “Third party provider name (note 7)... Mandatory... Mandatory... -... Third party provider legal entity identifier (note 7)... Mandatory... Mandatory... -” | SUP 15 Annex 15.1R (fields 36-37) | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): In-scope firms must notify the FCA before entering into, or making significant changes to, a material third party arrangement, at an early stage before internal or external commitments are made. [adjacent] “A firm must give the FCA notice when entering into, or significantly changing, a material third party arrangement.” | SUP 15.19.6R and SUP 15.19.9G | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): In-scope firms must submit material third party arrangement notifications to the FCA using the data fields in Annex 16.1R (cols 1 & 2), online via the FCA's website. [adjacent] “A firm must submit the notice required in SUP 15.19.6R to the FCA: (1) by providing the information in accordance with columns (1) and (2) of the table in SUP 15 Annex 16.1R; and (2) online through the appropriate systems accessible from the FCA's website.” | SUP 15.19.8R | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): In-scope firms must maintain a register of information relating to all their material third party arrangements and submit it annually to the FCA. [adjacent] “A firm must: (1) maintain a register of information relating to its material third party arrangements; and (2) submit the register of material third party arrangements annually to the FCA.” | SUP 16.33.6R | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): In-scope firms must submit the annual material third party arrangements register to the FCA using Annex 16.1R (cols 1 & 3) fields, online via the FCA's website. [adjacent] “The firm must submit the register of material third party arrangements specified in SUP 16.33.6R(2) to the FCA: (1) by providing the information in accordance with columns (1) and (3) of the table in SUP 15 Annex 16.1R; and (2) online through the appropriate systems accessible…” | SUP 16.33.8R | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Firms must record in the material third party register the substitutability of the service provider, ability to reintegrate the service, and impact of discontinuing the arrangement. “Substitutability of the service provider... Mandatory... Mandatory... Ability of reintegration of the service... Mandatory... Mandatory... The impact of discontinuing the contractual arrangement... Mandatory... Mandatory” | SUP 15 Annex 16.1R (fields 5.01-5.03) | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Firms must record in the material third party register whether each arrangement supports an important business service and, if so, which service and whether the provider supports a core element of it. “Does the contractual arrangement support an important business service?... Mandatory... Mandatory... If yes, which important business service does the contractual arrangement support... Does the service provider support a core element of the important business service?” | SUP 15 Annex 16.1R (fields 3.04-3.06) | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Firms must record FCA impact tolerances (client harm and market integrity) for each material third party arrangement in both the notification and the annual register. [adjacent] “Impact tolerance - FCA - client harm... Mandatory... Mandatory... Impact tolerance - FCA - market integrity... Mandatory... Mandatory” | SUP 15 Annex 16.1R (fields 3.10-3.11) | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Firms must record the date and outcome of the most recent risk assessment and audit for each material third party arrangement in both the notification and annual register. [adjacent] “Date of the most recent risk assessment... Mandatory... Mandatory... Outcome of the most recent risk assessment... Mandatory... Mandatory... Date of the most recent audit... Mandatory... Mandatory... Outcome of the most recent audit... Mandatory... Mandatory” | SUP 15 Annex 16.1R (fields 4.01-4.05) | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Firms must record the date and outcome of cyber risk due diligence for each material third party arrangement in both the notification and annual register. “Date of cyber risk due diligence... Mandatory... Mandatory... Outcome of cyber risk due diligence... Mandatory... Mandatory” | SUP 15 Annex 16.1R (fields 4.08-4.09) | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Firms must record governance approval details (SMF/accountable-person sign-off or committee review) and the date of approval for each material third party arrangement. [adjacent] “Has this contractual arrangement been reviewed and signed off by an SMF holder or an accountable person of an FMI?... Mandatory... Mandatory... If not, which governance committee reviewed it?... Date of governance approval... Mandatory... Mandatory” | SUP 15 Annex 16.1R (fields 4.12-4.14) | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Firms must record where data is stored and where the service is delivered from for each material third party arrangement in both the notification and annual register. “Country where the data is stored... Mandatory... Mandatory... Country where the service is delivered from... Mandatory... Mandatory” | SUP 15 Annex 16.1R (fields 3.13-3.14) | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Firms must maintain a permanent record of their material third party arrangements register (SUP 16.33.6R(1)) with no specified minimum retention period. “SUP 16.33.6R(1) Material third party arrangements Register of information relating to material third party arrangements Not specified Not specified” | SUP 16.33.6R(1) and Sch 1.2G (SUP 16.33.6R(1) entry) | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Enhanced reporting firms must report in the initial phase whether an affected service is classified as an important business service and, in the intermediate phase, must confirm this mandatorily. “Is the affected service classified as an important business service?... Optional (note 2)... Mandatory... -” | SUP 15 Annex 15.1R (field 23) | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Firms subject to both SUP 15.3.8G(1)(e) and SUP 15.19 notification requirements for material outsourcing must comply with SUP 15.19; a single notification satisfying SUP 15.19 discharges both obligations. [adjacent] “Any notification required under both SUP 15.3.8G(1)(e) and SUP 15.19 (Notification of material third party arrangements) must be made in accordance with SUP 15.19.” | SUP 15.3.10AR | final · applies from 2027-03-18 |
| UK | UK_FCA | other | NOT YET IN FORCE (effective 2027-03-18): Firms must record in the material third party register the supply chain ranking and notice periods (for both firm and service provider) for each material third party arrangement. “Supply chain ranking... Mandatory... Mandatory... Notice period for the service provider... Mandatory... Mandatory... Notice period for the firm... Mandatory... Mandatory” | SUP 15 Annex 16.1R (fields 2.08, 2.12-2.13) | final · applies from 2027-03-18 |
| UK | UK_PRA | business continuity | Identify and document important business services (IBS) — those whose disruption could pose risk to safety and soundness, financial stability, or policyholder protection. “firms must identify their important business services...defined as the services a firm provides which, if disrupted, could pose a risk to a firm's safety and soundness or...the financial stability of the UK.” | Operational Resilience 2.1; SS1/21 §2.2 | in force |
| UK | UK_PRA | business continuity | Set an impact tolerance (including a mandatory time-based metric) for each identified important business service. “firms to set an impact tolerance for each of their important business services...An impact tolerance must, in all cases, include a time-based metric to measure the tolerable level of disruption.” | Operational Resilience 2.2, 2.4; SS1/21 §3.1, §3.6 | in force |
| UK | UK_PRA | business continuity | Set impact tolerances at the point beyond which further disruption would pose a risk to safety and soundness, financial stability, or policyholder protection. “require firms to set their impact tolerances at the point at which any further disruption to the important business service would pose a risk to the firm's safety and soundness...policyholder protection...financial stability of the UK.” | Operational Resilience 2.3; SS1/21 §3.2 | in force |
| UK | UK_PRA | business continuity | Ensure ability to deliver each IBS within its impact tolerance in severe but plausible scenarios by 31 March 2025. “firms to ensure they are able to deliver their important business services within impact tolerances in severe but plausible scenarios...no later than Monday 31 March 2025.” | Operational Resilience 2.5, 2.6; SS1/21 §4.1, §4.14 | in force |
| UK | UK_PRA | business continuity | Develop and implement effective remediation plans for IBS that cannot remain within impact tolerances, with timing proportionate to disruption impact. “firms to develop and implement effective remediation plans for the important business services that would not be able to remain within their impact tolerance...speed at which vulnerabilities are remediated should be commensurate with the potential impact.” | SS1/21 §4.3, §4.15 | in force |
| UK | UK_PRA | business continuity | Map the people, processes, technology, facilities, and information resources required to deliver each IBS, including resources provided by third parties. “require firms to identify and document the necessary people, processes, technology, facilities, and information...required to deliver each of their important business services...irrespective of whether the resources are being provided wholly or in part by a third party.” | Operational Resilience 4.1; SS1/21 §5.1, §5.5 | in force |
| UK | UK_PRA | business continuity | The institution should update IBS mapping at least annually, or sooner following a significant change. “The PRA expects firms to update their mapping annually at a minimum, or following significant change if sooner.” | SS1/21 §5.9 | in force |
| UK | UK_PRA | business continuity | Regularly test ability to remain within impact tolerances using severe but plausible disruption scenarios, with testing focused on recovery and response. “require firms to test regularly their ability to remain within impact tolerances in severe but plausible disruption scenarios...The PRA expects firms to focus on recovery and response arrangements.” | Operational Resilience 5.1; SS1/21 §6.1 | in force |
| UK | UK_PRA | business continuity | Develop a written testing plan specifying scenario types, frequency, IBS coverage, and availability/integrity testing, proportionate to potential disruption impact. “firms to develop a testing plan that details how they will gain assurance that they can remain within impact tolerances...nature and frequency of a firm's testing should be proportionate to the potential impact that disruption could cause.” | SS1/21 §6.6 | in force |
| UK | UK_PRA | business continuity | Ensure ability to remain within impact tolerances irrespective of third-party use; effectively manage third parties so they do not cause tolerance breaches. “firms to be able to remain within impact tolerances for important business services, irrespective of whether or not they use third parties in the delivery of these services...effectively manage their use of third parties to ensure they can meet the required standard.” | SS1/21 §4.5 | in force |
| UK | UK_PRA | business continuity | Understand and manage sub-outsourcing dependencies that may threaten operational resilience and IBS delivery. “Firms should understand the reliance placed on sub-outsourcing arrangements and if these arrangements pose a threat to their operational resilience.” | SS1/21 §5.6 | in force |
| UK | UK_PRA | business continuity | The institution may include third-party failure/disruption scenarios (including supply chain) as severe but plausible scenarios in operational resilience testing. “one of the severe but plausible scenarios that firms may select for this testing could involve a failure or disruption at a third party, or their supply chain, based on previous incidents or near misses.” | SS1/21 §6.13 | in force |
| UK | UK_PRA | business continuity | Require contractual agreements for material outsourcing to include obligations for both parties to implement and test business contingency plans aligned to impact tolerances. “contractual agreements for material outsourcing arrangements to include 'requirements for both parties to implement and test business contingency plans. For the firm, these should take account of firms' impact tolerances for important business services.'” | SS1/21 §6.13 | in force |
| UK | UK_PRA | business continuity | Develop communication strategies for internal and external stakeholders as part of operational disruption response planning, including escalation paths and decision-maker identification. “firms to develop communication strategies for both internal and external stakeholders as part of their planning for responding to operational disruptions...plans should include the escalation paths they would use to manage communications during an incident.” | SS1/21 §4.7 | in force |
| UK | UK_PRA | business continuity | Review IBS list at least annually, or sooner on significant change, to determine whether additions or removals are required. “The PRA expects firms to review their important business services annually at a minimum, or sooner if a significant change occurs, and to determine whether any changes are required to their list of important business services.” | SS1/21 §2.10 | in force |
| UK | UK_PRA | business continuity | Board must approve and regularly review: IBS list, impact tolerances, and written self-assessment, including scenario analyses of ability to remain within tolerances. “a firm's board must approve and regularly review the firm's important business services, impact tolerances, and written self-assessment...boards must regularly review assessments...and the scenario analyses of its ability to remain within the impact tolerance.” | Operational Resilience 7; SS1/21 §7.1 | in force |
| UK | UK_PRA | business continuity | Assign overall responsibility for implementing operational resilience policies to the Chief Operations SMF24 (where it exists) with reporting to the board. “the Chief Operations Senior Management Function (SMF) 24 should hold overall responsibility for implementing operational resilience policies and reporting to the board.” | SS1/21 §7.4 | in force |
| UK | UK_PRA | business continuity | Produce and maintain a written self-assessment documenting compliance with the Operational Resilience Parts, approved by the board. “require firms to document a self-assessment of their compliance with the Operational Resilience Part...Firms' boards are accountable for and should approve the information provided in these documents.” | Operational Resilience 6; SS1/21 §8.1 | in force |
| UK | UK_PRA | business continuity | Self-assessment must document IBS list with rationale, impact tolerances with rationale, mapping methodology, testing strategy and scenarios, lessons learned, identified vulnerabilities with remediation plans, and group-related risks. “list their important business services...specify the impact tolerances...detail their approach to mapping...describe their strategy for testing...identify any lessons learned...identify the vulnerabilities that threaten their ability...identify any additional risks...from…” | Operational Resilience 6; SS1/21 §8.3 | in force |
| UK | UK_PRA | business continuity | The institution should set recovery time objectives and recovery point objectives for resources underpinning IBS so that the IBS can be delivered within its impact tolerance. “requirements might include capacity specifications, recovery time objectives, and recovery point objectives. These requirements should be set to enable the firm to deliver the important business service within its impact tolerance.” | SS1/21 §3.14 | in force |
| UK | UK_PRA | business continuity | CRR consolidation entities and insurers must identify important group business services and set impact tolerances at group level to capture risks from non-individually-regulated group members. “CRR consolidation entities...or an insurer...to identify a proportionate number of important group business services and respective impact tolerances at the level of the group.” | Operational Resilience 8.6–8.13; SS1/21 §9.1 | in force |
| UK | UK_PRA | business continuity | CRR consolidation entities must maintain regular dialogue with group members so CRR firms can account for additional risks to safety and soundness when assessing ability to remain within impact tolerances. [adjacent] “the CRR consolidation entity would have regular dialogue with other members of its group so the CRR firm (or CRR firms) can take account of any additional risks to their safety and soundness when assessing their ability to remain within impact tolerance.” | Operational Resilience 8.8; SS1/21 §9.4 | in force |
| UK | UK_PRA | business continuity | Manage risks from intragroup third-party arrangements with the same rigour as external third parties to ensure ability to remain within impact tolerances. “firms to manage risk and make appropriate arrangements to be able to remain within impact tolerance, whether using third parties that are other entities within their group or external providers.” | SS1/21 §4.6 | in force |
| UK | UK_PRA | business continuity | Have a prioritised plan in place by 31 March 2022 setting out how the firm will achieve full within-tolerance capability, with the plan already being executed by that date. “Firms are expected to have a prioritised plan which sets out how they will comply with the requirement to be able to remain within their impact tolerances within a reasonable time...firms must have started putting the plan into effect by Thursday 31 March 2022.” | SS1/21 §4.14 | in force |
| UK | UK_PRA | business continuity | Firms should ensure their business continuity plans take into account the possibility that quality of provision of material outsourced services deteriorates to unacceptable levels, potential insolvency or failure of the service provider, and where relevant, political/jurisdictional risks. “firms' business continuity plans under General Organisational Requirements 2.5 and 2.6 (banks) and Conditions Governing Business 2.6 (insurers) should take into account: the possibility that the quality of the provision of material outsourced services deteriorates” | SS2/21 paragraph 4.12 | in force |
| UK | UK_PRA | business continuity | Firms' outsourcing policies must include documented exit strategies and termination processes, including a documented exit plan for material outsourcing arrangements covering unexpected/stressed termination and possible service interruptions, taking into account impact tolerances for important business services. “Exit strategies and termination processes, including a requirement for a documented exit plan for material outsourcing arrangements...explicitly catering for the unexpected termination of an outsourcing agreement (a stressed or unplanned exit), and taking into account possible…” | SS2/21 paragraph 4.14 (Table 4, Termination section) | in force |
| UK | UK_PRA | business continuity | Firms' outsourcing policies must include business continuity planning (BCP) as a mandatory minimum content area. “Business continuity planning (BCP) (see paragraph 4.10)” | SS2/21 paragraph 4.14 (Table 4, General section) | in force |
| UK | UK_PRA | business continuity | Firms should assess whether a non-material outsourcing or third party arrangement becomes material under a severe but plausible scenario (e.g. pandemic) and consider additional measures to safeguard operational resilience, such as revisions to contractual provisions. “If a non-material outsourcing or third party arrangement becomes material due to a severe but plausible scenario, such as a pandemic, firms should consider whether additional measures to safeguard their operational resilience are warranted, such as revisions to contractual…” | SS2/21 paragraph 5.9 | in force |
| UK | UK_PRA | business continuity | Firms must assess the materiality of all outsourcing and third party arrangements (including non-outsourcing third party arrangements) using all relevant criteria, and re-assess materiality prior to signing, at appropriate intervals, on planned scale-up, and on significant service provider changes. [adjacent] “Firms should determine the materiality of all third party arrangements using all relevant criteria in this chapter...Materiality may vary throughout the duration of an arrangement and should therefore be (re)assessed: prior to signing the written agreement; at appropriate…” | SS2/21 paragraphs 5.1, 5.6, 5.8 | in force |
| UK | UK_PRA | business continuity | Firms should classify an outsourcing or third party arrangement as material where failure could materially impair their operational resilience, i.e. their ability to continue providing important business services. “a firm should generally consider an outsourcing or third party arrangement as material where a defect or failure in its performance could materially impair the...operational resilience, ie its ability to continue providing important business services” | SS2/21 paragraph 5.11 | in force |
| UK | UK_PRA | business continuity | Firms must apply all requirements and expectations on operational resilience in the Operational Resilience and Insurance – Operational Resilience Parts of the PRA Rulebook to all third party arrangements, regardless of whether they fall under the definition of outsourcing. “all relevant requirements in the Operational Resilience and Insurance – Operational Resilience Parts of the PRA Rulebook” | SS2/21 paragraph 2.7 | in force |
| UK | UK_PRA | business continuity | Firms must apply PRA Fundamental Rules 2, 3, 5, 6, and 7, and the requirements on business continuity, contingency planning, and data protection under General Organisational Requirements Rule 2 to all third party arrangements. “PRA Fundamental Rules 2, 3, 5 and 6, and 7...Rule 2 in the General Organisational Requirements Part of the PRA Rulebook...In particular, the requirements on business continuity, contingency planning, and data protection” | SS2/21 paragraph 2.7 | in force |
| UK | UK_PRA | business continuity | Firms must apply standards in EBA ICT Guidelines (including Sections 3.2.3, 3.3.2, 3.4.5, and 3.7/para 86) to all third party ICT arrangements, interpreted consistently with operational resilience requirements and SS1/21. “EBA ICT GL, including but not limited to Sections 3.2.3, 3.3.2, 3.4.5, and 3.7 (in particular, paragraph 86). These GL should be interpreted consistently with: the Operational Resilience/Insurance – Operational Resilience Parts, the expectations in this SS, and SS1/21” | SS2/21 paragraph 2.9 | in force |
| UK | UK_PRA | business continuity | Firms are encouraged to take into account FSB Effective Practices for Cyber Incident Response and Recovery (including paragraphs 13, 18, 19, 20, 33, and 36) and G7 Third Party Elements when managing ICT and third-party risk. “the PRA also encourages firms to take into account global standards on ICT risk management, including but not necessarily limited to the toolkit in the FSB Effective Practices (in particular, paragraphs 13, 18, 19 and 20, 33 and 36), and the G7 Third party Elements.” | SS2/21 paragraph 2.10 | in force |
| UK | UK_PRA | business continuity | Firms should assess the materiality and risks of all third party arrangements irrespective of whether they fall within the definition of outsourcing, and where deemed material or high risk, implement proportionate, risk-based controls as robust as those applied to equivalent outsourcing arrangements. “the PRA expects firms to assess the materiality and risks of all third party arrangements irrespective of whether they fall within the definition of outsourcing...Where a firm deems a non-outsourcing third party arrangement 'material' or 'high risk', it should implement…” | SS2/21 paragraphs 2.5, 2.6 | in force |
| UK | UK_PRA | business continuity | Boards must set control environment including appetite and tolerance levels for outsourcing and third-party risk, and ensure appropriate risk management systems to deal with outsourced service providers, including identifying and understanding the firm's reliance on critical service providers. [adjacent] “Firms' boards should: set 'the control environment throughout the firm, including the appetite and tolerance levels in respect of outsourcing'...appropriately 'identifying and [having an] understanding of the firm's reliance on critical service providers'” | SS2/21 paragraph 4.4 | in force |
| UK | UK_PRA | business continuity | Boards should approve, regularly review, and implement a written outsourcing policy that aligns with and draws upon the firm's business continuity, ICT, information and cyber security, and operational resilience policies. “Firms' boards should approve, regularly review, and implement a written outsourcing policy...This policy should align to and draw upon other relevant firm policies and strategies. For instance: business continuity...ICT...information and cyber security...operational resilience” | SS2/21 paragraph 4.10 | in force |
| UK | UK_PRA | business continuity | Third-country branches must maintain firm or group-wide business continuity plans and exit strategies; systemic wholesale branches must take reasonable steps to develop local business continuity, contingency planning, and exit strategies for activities that could impact UK financial stability. “firm or group-wide business continuity plans and exit strategies. Systemic wholesale branches should, however, take reasonable steps to develop local business continuity, contingency planning, and exit strategies (if available) covering any activities or services which they…” | SS2/21 paragraph 3.19 | in force |
| UK | UK_PRA | business continuity | Firms may rely on business continuity, contingency, and exit plans developed at group level for intragroup outsourcing, provided they adequately safeguard the firm's own operational resilience. “rely on business continuity, contingency, and exit plans developed at group level, provided that they adequately safeguard their operational resilience.” | SS2/21 paragraph 3.6 | in force |
| UK | UK_PRA | business continuity | Firms that arrange material outsourcing should maintain an Outsourcing Register covering all outsourcing arrangements, distinguishing material from non-material, effective from 31 December 2021 for banks. [adjacent] “the EBA Outsourcing GL expect banks to maintain an up-to-date register of information on all their outsourcing arrangements, distinguishing between those which are material and those which are not ('Outsourcing Register').” | SS2/21 paragraph 4.16 | in force |
| UK | UK_PRA | business continuity | Firms should keep appropriate records of their outsourcing arrangements sufficient to enable fulfilment of concentration risk expectations, and make relevant information on third-party arrangements available to the PRA in accordance with Fundamental Rule 7. [adjacent] “The PRA expects all firms to keep appropriate records of their outsourcing arrangements...The records should also be sufficient to enable the firm to fulfil the expectations concerning concentration risk set out in 5.24.” | SS2/21 paragraph 4.15 | in force |
| UK | UK_PRA | business continuity | Firms must define, document, and understand respective responsibilities of the firm and service provider (shared responsibility model) as part of effective governance of outsourcing arrangements, including for cloud computing. “the PRA expects firms to define, document, and understand their and the service provider's respective responsibilities. In the case of cloud computing, the term commonly used to help firms and cloud providers understand their respective obligations is the 'shared responsibility…” | SS2/21 paragraph 4.5 | in force |
| UK | UK_PRA | business continuity | Firms should consider concentration risk in their outsourcing and third-party arrangements (including ICT/cloud) and maintain records sufficient to enable assessment of such risks. “The records should also be sufficient to enable the firm to fulfil the expectations concerning concentration risk set out in 5.24.” | SS2/21 paragraph 4.15 | in force |
| UK | UK_PRA | business continuity | Firms must ensure their outsourcing policies include day-to-day oversight procedures including incident reporting, and processes for being notified of and responding to changes to an outsourcing arrangement or service provider. “Procedures for the ongoing assessment of service providers' performance, including where appropriate: day-to-day oversight, including incident reporting, periodic performance assessment against service level agreements...being notified and responding to changes to an outsourcing…” | SS2/21 paragraph 4.14 (Table 4, Oversight section) | in force |
| UK | UK_PRA | business continuity | Firms that expect an outsourcing or third party arrangement to become material should take reasonable steps to ensure compliance with all material outsourcing expectations (Chapters 6-10, including business continuity and exit plans) on or before the materiality threshold is crossed. “Where a firm expects an outsourcing or third party arrangement to become material in the future, it should take reasonable steps to ensure that it can comply with all applicable expectations for material outsourcing arrangements in Chapters 6 to 10 on or before the materiality…” | SS2/21 paragraph 5.9 | in force |
| UK | UK_PRA | business continuity | Firms should make outsourced and third party providers aware of relevant internal policies including those on operational resilience and ICT/information security, to the extent needed for performance of the service. “Firms should make outsourced and third party providers aware of relevant internal policies, including those on outsourcing, ICT, information security, or operational resilience.” | SS2/21 paragraph 4.11 | in force |
| UK | UK_PRA | business continuity | Third-country branches must maintain effective processes and mechanisms for escalating concerns, issues, and regulatory feedback relating to intragroup outsourcing arrangements to the whole firm or group. [adjacent] “effective processes and mechanisms for escalating concerns, issues, and regulatory feedback relating to their intragroup outsourcing arrangements to the whole firm or group.” | SS2/21 paragraph 3.18 | in force |
| UK | UK_PRA | business continuity | Firms should re-assess materiality of outsourcing arrangements where there is a significant organisational change at the service provider or material sub-outsourced service provider that could materially change the nature, scale, or complexity of risks, including changes to ownership or financial position. “if a significant organisational change at the service provider or a material sub-outsourced service provider takes place that could materially change the nature, scale, and complexity of the risks inherent in the outsourcing arrangement, including a significant change to the…” | SS2/21 paragraph 5.8 | in force |
| UK | UK_PRA | business continuity | Firms must consider and document how the potential impact of disruption, failure, or insolvency of a service provider affects business continuity, operational resilience, and operational risk as a materiality criterion. “The potential impact of a disruption, failure, or...business continuity, operational resilience, and operational risk, including: conduct risk” | SS2/21 paragraph 5.13 (Table 5) | in force |
| UK | UK_PRA | business continuity | Firms may leverage their end-to-end mapping of important business services under the Operational Resilience PRA Rulebook to document and map intragroup and other third-party dependencies. “Firms may also leverage their end-to-end mapping of important business services under Chapter 4 of the Operational Resilience – CRR Firms and Operational Resilience – Solvency II Parts of the PRA Rulebook to document and map their intragroup and other dependencies.” | SS2/21 paragraph 3.8 | in force |
| UK | UK_PRA | business continuity | Firms with arrangements involving regulated financial institutions (clearing, settlement, custody) should implement appropriate monitoring and risk-based controls to manage risks to resilience from these arrangements, leveraging applicable existing regulatory requirements. “they are third party arrangements that can give rise to significant risks to the PRA's objectives and should be subject to appropriate monitoring and risk-based controls...to manage relevant risks and promote an appropriate level of resilience.” | SS2/21 paragraph 2.12 | in force |
| US | CFPB | cybersecurity | Maintain adequate password management policies and practices, including monitoring for credential breaches at other entities where employees reuse passwords, notifying users when password resets are required, and prohibiting default enterprise logins/passwords. [adjacent] “If a covered person or service provider does not have adequate password management policies and practices, it is unlikely they would succeed in showing countervailing benefits to consumers or competition that outweigh the potential harms, thus triggering liability.” | 12 U.S.C. 5536(a)(1)(B); CFPB Circular 2022-04, Password Management section | in force |
| US | CFPB | cybersecurity | Routinely update systems, software, and code (including contractor-used software), and apply patches promptly upon notification of critical vulnerabilities; maintain asset inventories tracking software dependencies to ensure timely patching. “If covered persons or service providers do not routinely update systems, software, and code (including those utilized by contractors) or fail to update them when notified of a critical vulnerability, it is unlikely they would succeed in showing countervailing benefits” | 12 U.S.C. 5536(a)(1)(B); CFPB Circular 2022-04, Timely Software Updates section | in force |
| US | CFPB | cybersecurity | Avoid use of software versions no longer actively maintained by their vendors, as running end-of-life software that cannot receive security updates constitutes inadequate data security likely to cause substantial consumer injury. [adjacent] “It also includes the use of versions of software that are no longer actively maintained by their vendors.” | 12 U.S.C. 5536(a)(1)(B); CFPB Circular 2022-04, Timely Software Updates section | in force |
| US | CFPB | cybersecurity | Implement reasonable security measures to protect sensitive consumer information collected, processed, maintained, or stored, to avoid engaging in unfair acts or practices under the CFPA; inadequate security alone (without a breach) can constitute a violation. [adjacent] “Inadequate security for the sensitive consumer information collected, processed, maintained, or stored by the company can constitute an unfair practice in violation of 12 U.S.C. 5536(a)(1)(B).” | 12 U.S.C. 5536(a)(1)(B); CFPB Circular 2022-04, Response section | in force |
| US | FDIC | cybersecurity | Implement a comprehensive written information security program with administrative, technical, and physical safeguards appropriate to the institution's size, complexity, and activities. [adjacent] “Each insured depository institution shall implement a comprehensive written information security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the institution” | 12 CFR 364 App. B, II.A | in force |
| US | FDIC | cybersecurity | Design the information security program to protect against anticipated threats or hazards to the security or integrity of customer information and against technological failures. “Protect against any anticipated threats or hazards to the security or integrity of such information” | 12 CFR 364 App. B, II.B.2 | in force |
| US | FDIC | cybersecurity | Identify reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer information systems. [adjacent] “Identify reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer information systems.” | 12 CFR 364 App. B, III.B.1 | in force |
| US | FDIC | cybersecurity | Assess the likelihood and potential damage of identified threats, taking into consideration the sensitivity of customer information. “Assess the likelihood and potential damage of these threats, taking into consideration the sensitivity of customer information.” | 12 CFR 364 App. B, III.B.2 | in force |
| US | FDIC | cybersecurity | Implement response programs specifying actions to be taken when unauthorized access to customer information systems is suspected or detected, including reports to regulatory and law enforcement agencies. “Response programs that specify actions to be taken when the institution suspects or detects that unauthorized individuals have gained access to customer information systems, including appropriate reports to regulatory and law enforcement agencies” | 12 CFR 364 App. B, III.C.1.g | in force |
| US | FDIC | cybersecurity | Implement measures to protect against destruction, loss, or damage of customer information due to environmental hazards such as fire, water damage, or technological failures. “Measures to protect against destruction, loss, or damage of customer information due to potential environmental hazards, such as fire and water damage or technological failures.” | 12 CFR 364 App. B, III.C.1.h | in force |
| US | FDIC | cybersecurity | Regularly test key controls, systems, and procedures of the information security program, with frequency determined by risk assessment, conducted or reviewed by independent parties. [adjacent] “Regularly test the key controls, systems and procedures of the information security program. The frequency and nature of such tests should be determined by the institution's risk assessment. Tests should be conducted or reviewed by independent third parties or staff independent” | 12 CFR 364 App. B, III.C.3 | in force |
| US | FDIC | cybersecurity | Monitor, evaluate, and adjust the information security program in light of changes in technology, threats, customer information sensitivity, and changing business arrangements. [adjacent] “Each institution shall monitor, evaluate, and adjust, as appropriate, the information security program in light of any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and the institution's own changing…” | 12 CFR 364 App. B, III.E | in force |
| US | FDIC | cybersecurity | Implement monitoring systems and procedures to detect actual and attempted attacks on or intrusions into customer information systems. [adjacent] “Monitoring systems and procedures to detect actual and attempted attacks on or intrusions into customer information systems” | 12 CFR 364 App. B, III.C.1.f | in force |
| US | FDIC | cybersecurity | Exercise appropriate due diligence in selecting service providers that access customer information. [adjacent] “Exercise appropriate due diligence in selecting its service providers” | 12 CFR 364 App. B, III.D.1 | in force |
| US | FDIC | cybersecurity | Require service providers by contract to implement appropriate measures designed to meet the information security objectives of the Guidelines. “Require its service providers by contract to implement appropriate measures designed to meet the objectives of these Guidelines” | 12 CFR 364 App. B, III.D.2 | in force |
| US | FDIC | cybersecurity | Where indicated by risk assessment, monitor service providers to confirm they have satisfied contractual security obligations, including reviewing audits, test summaries, or equivalent evaluations. “Where indicated by the institution's risk assessment, monitor its service providers to confirm that they have satisfied their obligations...an institution should review audits, summaries of test results, or other equivalent evaluations of its service providers.” | 12 CFR 364 App. B, III.D.3 | in force |
| US | FDIC | cybersecurity | Report to the board or board committee at least annually on the status of the information security program, including risk assessment, risk management decisions, service provider arrangements, testing results, and security breaches. [adjacent] “Each institution shall report to its board or an appropriate committee of the board at least annually...addressing issues such as: Risk assessment; risk management and control decisions; service provider arrangements; results of testing; security breaches or violations” | 12 CFR 364 App. B, III.F | in force |
| US | FDIC | cybersecurity | The institution should develop and implement a risk-based response program to address incidents of unauthorized access to customer information in customer information systems, including those maintained by service providers. “every financial institution should also develop and implement a risk-based response program to address incidents of unauthorized access to customer information in customer information systems that occur nonetheless.” | 12 CFR 364 App. B, Supplement A, II (opening paragraph) | in force |
| US | FDIC | cybersecurity | Include in the response program procedures to assess the nature and scope of an incident and identify which customer information systems and types of customer information have been accessed or misused. “Assessing the nature and scope of an incident, and identifying what customer information systems and types of customer information have been accessed or misused” | 12 CFR 364 App. B, Supplement A, II.A.1.a | in force |
| US | FDIC | cybersecurity | Notify the primary Federal regulator as soon as possible when the institution becomes aware of an incident involving unauthorized access to or use of sensitive customer information. [adjacent] “Notifying its primary Federal regulator as soon as possible when the institution becomes aware of an incident involving unauthorized access to or use of sensitive customer information” | 12 CFR 364 App. B, Supplement A, II.A.1.b | in force |
| US | FDIC | cybersecurity | Take appropriate steps to contain and control an incident to prevent further unauthorized access to customer information, while preserving records and evidence. “Taking appropriate steps to contain and control the incident to prevent further unauthorized access to or use of customer information, for example, by monitoring, freezing, or closing affected accounts, while preserving records and other evidence” | 12 CFR 364 App. B, Supplement A, II.A.1.d | in force |
| US | FDIC | cybersecurity | The institution should require service providers by contract to notify the institution as soon as possible of unauthorized access incidents to the institution's customer information, enabling the institution to implement its response program. “an institution's contract with its service provider should require the service provider to take appropriate actions to address incidents of unauthorized access to the financial institution's customer information, including notification to the institution as soon as possible of…” | 12 CFR 364 App. B, Supplement A, II (opening paragraph) | in force |
| US | FDIC | cybersecurity | Ensure the board of directors approves the written information security program and oversees its development, implementation, and maintenance, including assigning specific implementation responsibility. [adjacent] “The board of directors or an appropriate committee of the board of each insured depository institution shall: 1. Approve the institution's written information security program; and 2. Oversee the development, implementation, and maintenance of the institution's information…” | 12 CFR 364 App. B, III.A | in force |
| US | FDIC | cybersecurity | Train staff to implement the institution's information security program. [adjacent] “Train staff to implement the institution's information security program.” | 12 CFR 364 App. B, III.C.2 | in force |
| US | FDIC | cybersecurity | Assess the sufficiency of existing policies, procedures, customer information systems, and other arrangements in place to control identified risks. “Assess the sufficiency of policies, procedures, customer information systems, and other arrangements in place to control risks.” | 12 CFR 364 App. B, III.B.3 | in force |
| US | FDIC | cybersecurity | Where a service provider maintains systems involved in an unauthorized access incident, the financial institution remains responsible for customer and regulator notification, though it may authorize the service provider to notify on its behalf. [adjacent] “Where an incident of unauthorized access to customer information involves customer information systems maintained by an institution's service providers, it is the responsibility of the financial institution to notify the institution's customers and regulator.” | 12 CFR 364 App. B, Supplement A, II.A.2 | in force |
| US | FFIEC | business continuity | Establish and maintain an enterprise-wide BCM program that aligns with strategic goals and includes resilience, continuity, and response capabilities to safeguard employees, customers, products and services. “BCM is the process for management to oversee and implement resilience, continuity, and response capabilities to safeguard employees, customers, and products and services.” | FFIEC BCM Booklet, Section I | in force |
| US | FFIEC | business continuity | The institution should establish BCM governance including aligning BCM with risk appetite, identifying continuity levels per criticality, establishing BCM policies and plans, allocating resources, and monitoring BCM performance. “BCM governance should include: Aligning BCM practices with the risk appetite. Identifying the continuity level needed, consistent with the operation's criticality. Establishing business continuity policy and plans. Allocating resources to BCM activities.” | FFIEC BCM Booklet, Section II | in force |
| US | FFIEC | business continuity | Board should assign BCM responsibility and accountability, allocate resources, align BCM with business strategy and risk appetite, and review BCM performance through reporting, testing, and auditing. “Board oversight should include: Assigning BCM responsibility and accountability. Allocating resources to BCM. Aligning BCM with the entity's business strategy and risk appetite. Understanding business continuity risks and adopting policies and plans to manage events.” | FFIEC BCM Booklet, Section II.A | in force |
| US | FFIEC | business continuity | Management should define BCM roles, responsibilities, and succession plans; allocate personnel and financial resources; validate staff understand their BCM roles; and establish measurable resilience targets. “Management oversight should include: Defining BCM roles, responsibilities, and succession plans. Allocating knowledgeable personnel and sufficient financial resources. Validating that personnel understand their business continuity roles and responsibilities. Establishing…” | FFIEC BCM Booklet, Section II.A | in force |
| US | FFIEC | business continuity | Management must design and implement a business continuity exercise strategy and confirm exercises, tests, and training are comprehensive and consistent with the BCM strategy. “Designing and implementing a business continuity exercise strategy. Confirming that exercises, tests, and training are comprehensive and consistent with the BCM strategy.” | FFIEC BCM Booklet, Section II.A | in force |
| US | FFIEC | business continuity | Management must resolve BCM weaknesses identified in exercises, tests, and training that exceed the entity's risk appetite. “Resolving weaknesses identified in exercises, tests, and training that exceed the entity's risk appetite.” | FFIEC BCM Booklet, Section II.A | in force |
| US | FFIEC | business continuity | Management must assess and update business continuity strategies and plans to reflect current business conditions and operating environment for continuous improvement. “Assessing and updating business continuity strategies and plans to reflect the current business conditions and operating environment for continuous improvement.” | FFIEC BCM Booklet, Section II.A | in force |
| US | FFIEC | business continuity | Management must coordinate BCM plans and responses with external groups as part of communications planning. “Coordinating plans and responses with external groups (as described in IV.B, 'Communications').” | FFIEC BCM Booklet, Section II.A | in force |
| US | FFIEC | business continuity | Board and senior management should engage internal audit or independent personnel to assess BCM design and operating effectiveness, including policies, procedures, and controls related to continuity and resilience. “The board and senior management should engage internal audit (or an independent review) to assess the BCM design effectiveness, including policies and procedures, and the effectiveness of controls.” | FFIEC BCM Booklet, Section II.B | in force |
| US | FFIEC | business continuity | Internal audit must evaluate the BIA and risk assessment for reasonableness, identification of critical functions, and likelihood and impact of events on operations. “Evaluate the business impact analysis (BIA) and risk assessment for reasonableness, identification of critical functions, and the likelihood of different events and the potential impact on operations.” | FFIEC BCM Booklet, Section II.B | in force |
| US | FFIEC | business continuity | Internal audit must evaluate controls for reliability, adequacy, and effectiveness regarding continuity and resilience, and leverage SOC reports and other external artifacts from third-party service providers. “Evaluate controls for reliability, adequacy, and effectiveness regarding continuity and resilience. Leverage SOC reports and other external artifacts from third-party service providers, as appropriate.” | FFIEC BCM Booklet, Section II.B | in force |
| US | FFIEC | business continuity | Examined on whether internal audit verifies whether BCM test plans achieve stated objectives and monitors BCM testing to verify issues such as deviations and failed objectives are appropriately identified and escalated. “Verify whether test plans achieve the stated objectives. Monitor BCM testing to verify that issues (e.g., deviation from test plans and failed objectives) are appropriately identified and escalated.” | FFIEC BCM Booklet, Section II.B | in force |
| US | FFIEC | business continuity | Management should develop a BIA that identifies all business functions, prioritizes them by criticality, analyzes interdependencies among processes and systems, and assesses disruption impact through established metrics including RPO, RTO, and MTD. “Management should develop a BIA that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies among business processes and systems, and assesses a disruption's impact through established metrics.” | FFIEC BCM Booklet, Section III.A | in force |
| US | FFIEC | business continuity | Management should inventory critical assets (people, hardware, software, data, cash) and infrastructure (network, communications, facilities, utilities), including those provided by third-party service providers. “Management should inventory the entity's critical assets (e.g., people, hardware, software, data, information, and cash) and infrastructure (e.g., network connectivity, communication lines, facilities, and utilities), including those provided by third-party service providers.” | FFIEC BCM Booklet, Section III.A | in force |
| US | FFIEC | business continuity | Management should inventory third-party service providers, including specific services they provide, as part of the BIA process. “Management should also inventory third-party service providers, including specific services they provide. The methodology used should be repeatable, allowing management to reevaluate information after significant changes.” | FFIEC BCM Booklet, Section III.A | in force |
| US | FFIEC | business continuity | Management should identify single points of failure in the BIA interdependency analysis, including telecom lines, network connections, backups, power sources, data center proximity, and key personnel. “During its analysis, management should identify single points of failure, which may include telecommunication lines, network connections between branches, backups that become corrupted, reliance on one power source, or data center locations in close geographic proximity.” | FFIEC BCM Booklet, Section III.A | in force |
| US | FFIEC | business continuity | Management must identify and analyze interdependencies with third-party service providers, key suppliers, and business partners, including their roles and responsibilities for resilience and recovery. “Third-party service providers (e.g., core processing, online and mobile banking, settlement activities, and disaster recovery services), key suppliers (e.g., hardware, software, and utility providers), and business partners and their roles and responsibilities for resilience and…” | FFIEC BCM Booklet, Section III.A | in force |
| US | FFIEC | business continuity | Management should establish contract and SLA requirements for availability and reliability of each third-party service, and confirm pre-existing contracts align with management's and customers' continuity and resilience expectations. “The BIA will assist management in forming contract and service-level agreement (SLA) requirements for availability and reliability of each service. For pre-existing contracts and SLAs, management should confirm that the contract and SLA requirements align with management's and…” | FFIEC BCM Booklet, Section III.A | in force |
| US | FFIEC | business continuity | Management should establish recovery objectives (RPO, RTO, MTD) for critical business functions after determining disruption impact, and evaluate them for alignment with third-party service providers' contracted recovery expectations. “Management should establish recovery objectives after determining a disruption's impact. Common measurements include recovery point objective (RPO), recovery time objective (RTO), and maximum tolerable downtime (MTD). Where applicable, these measurements should be evaluated for…” | FFIEC BCM Booklet, Section III.A | in force |
| US | FFIEC | business continuity | When it is not feasible to meet an RTO, management should verify whether the RTO is realistic, initiate an action plan with milestones to document the situation, and plan for its mitigation. “When it is not feasible to meet an RTO, management should verify whether the RTO is realistic, initiate an action plan and milestone(s) to document the situation, and, when appropriate, plan for its mitigation.” | FFIEC BCM Booklet, Section III.A | in force |
| US | FFIEC | business continuity | Management at large and systemically important entities (core and significant firms) should assess likelihood and impact of disruptions to both the entity and the broader financial sector, and incorporate sector-wide disruption scenarios into BCM processes. “Management at large and systemically important entities whose failure could trigger a broader financial disruption should assess the likelihood and impact of a disruption, both to the entity and the entire financial sector. These entities...should incorporate scenarios of…” | FFIEC BCM Booklet, Section III | in force |
| US | FFIEC | business continuity | Management should integrate BCM with the entity's enterprise risk management (ERM) framework to enable identification and management of continuity risk across the entire entity. [adjacent] “BCM should integrate with an entity's enterprise risk management (ERM), which allows for the identification and management of risk across the entire entity.” | FFIEC BCM Booklet, Section III | in force |
| US | FFIEC | business continuity | Management must establish realistic RTOs for each business function to determine total downtime from disruption and identify critical path and hierarchy for recovery, including analyzing gaps where dependent processes have mismatched RTOs. “Establishing realistic RTOs assists management in determining a critical path and hierarchy for recovery. For example, a process with a shorter RTO that is dependent upon on a process with a longer RTO may indicate a gap that should be analyzed further.” | FFIEC BCM Booklet, Section III.B | in force |
| US | FFIEC | business continuity | Management must reevaluate currently acceptable RTOs where customer expectations or technological advancement require near real-time recovery, updating RTOs to reflect current operational requirements. “previously established RTOs that were a few hours in duration may now require near real-time recovery. Therefore, it may be appropriate for management to reevaluate currently acceptable RTOs.” | FFIEC BCM Booklet, Section III.B | in force |
| US | FFIEC | business continuity | Management must establish Maximum Tolerable Downtime (MTD) for each business process, reflecting total acceptable disruption time including all impact considerations, to guide recovery method selection and scope of recovery procedures. “The MTD represents the total amount of time the system owner or authorizing official is willing to accept for a business process disruption and includes all impact considerations. The MTD is important for contingency planners when selecting an appropriate recovery method.” | FFIEC BCM Booklet, Section III.B | in force |
| US | FFIEC | business continuity | Management should evaluate the likelihood and impact of potential disruptions, including consideration of the entity's geographic area and risks/threats affecting third-party service providers, as part of the BCM risk assessment. “Management should evaluate the likelihood and impact of potential disruptions and events. As part of this evaluation, management should consider the geographical area where the entity operates. Additionally, management should consider the risks and threats that could affect the…” | FFIEC BCM Booklet, Section III.B (Risk Assessment Action Summary) | in force |
| US | FFIEC | business continuity | Management should develop risk treatment strategies (including risk acceptance or transfer) based on risk appetite after identifying scenarios, evaluating threats to controls/strategies/plans, and understanding risk exposure. “management should develop risk treatment strategies (including risk acceptance or risk transfer) based on the entity's risk appetite.” | FFIEC BCM Booklet, Section III.B (Risk Assessment Action Summary) | in force |
| US | FFIEC | business continuity | Examined on whether management includes natural, technical, malicious, international, and low-likelihood/high-impact events in the BCM risk assessment. “examiners should review whether the following types of events are included in the risk assessment: Natural events...Technical events...Malicious activity, including fraud, theft, blackmail, sabotage, cyber attacks, and terrorism. International events...Low likelihood and high…” | FFIEC BCM Booklet, Section III.B | in force |
| US | FFIEC | business continuity | Management should address common operational functions in the BCP rather than creating unique plans for every hazard type, planning for all threats to identify common recovery tasks and responsible personnel. “Management should address common operational functions in the business continuity plan (BCP) instead of having unique plans for every type of hazard or threat. Planning for all threats and hazards ensures that, when addressing emergency functions, planners identify common tasks…” | FFIEC BCM Booklet, Section III.B (Risk Identification) | in force |
| US | FFIEC | business continuity | Management should evaluate potential risks in the entity's geographic area, including flood zones, earthquake zones, terrorist targets, tornado/hurricane areas, and assess geopolitical risk and potential for retaliatory cyber attacks. “Management should evaluate potential risks that are in the entity's geographic area...management should also assess geopolitical risk and the potential for retaliatory cyber attacks. For example, U.S. sanctions against a nation-state could increase the risk of cyber attacks…” | FFIEC BCM Booklet, Section III.B (Risk Identification) | in force |
| US | FFIEC | business continuity | Management should coordinate BCM risk identification efforts across business units, and larger entities should coordinate at the unit level to identify systemic threats to the overall entity. “Management should coordinate business continuity risk identification efforts throughout the entity. Individual business units within larger entities should coordinate risk identification activities to identify systemic threats to the overall entity.” | FFIEC BCM Booklet, Section III.B (Risk Identification) | in force |
| US | FFIEC | business continuity | Management should identify and inventory internal and external assets, types of threats and hazards, and existing controls as part of effective risk identification. “Management should identify and inventory the entity's internal and external assets, types of threats and hazards, and existing controls as an important part of effective risk identification.” | FFIEC BCM Booklet, Section III.B (Risk Identification) | in force |
| US | FFIEC | business continuity | Management should identify cyber security risks as part of the BCM risk assessment process and incorporate them into BCM planning. “management should identify cyber security risks...which should be gathered as part of the risk assessment process.” | FFIEC BCM Booklet, Section III.B (Risk Identification) | in force |
| US | FFIEC | business continuity | Management should coordinate with external sources (e.g., FS-ISAC, local/state/federal authorities) to obtain timely and actionable information about hazards and threats, and integrate this information into BIA, risk assessment, and BCM processes. “Management should coordinate with external sources to obtain information about hazards and threats. External sources include industry information-sharing groups (e.g., FS-ISAC), and local, state, and federal authorities...Information about hazards and threats should be…” | FFIEC BCM Booklet, Section III.B (Risk Identification) | in force |
| US | FFIEC | business continuity | Management should integrate its threat-intelligence process with the BCM function. “Management should integrate its threat-intelligence process with the BCM function.” | FFIEC BCM Booklet, Section III.B (Risk Identification) | in force |
| US | FFIEC | business continuity | Management should identify interconnectivity points between the entity and its third-party service providers (and between other entities and third-party providers), including documenting transaction flows and process diagrams to identify interdependencies and end-to-end processes. “Management should identify interconnectivity points between the entity and its third-party service providers, as well as between other entities and third-party service providers. Documenting the flow of transactions, such as developing formal process diagrams, may help…” | FFIEC BCM Booklet, Section III.B (Risk Identification) | in force |
| US | FFIEC | business continuity | Management should assess the likelihood and impact of disruptive events, quantify impacts, define loss criteria (quantitative and qualitative), address worst-case scenarios, and prioritize risks based on scored results. “management should quantify the impacts and define loss criteria as either quantitative (financial) or qualitative (e.g., impact to customers)...Worst-case scenarios, such as destruction of the facilities and loss of life, should be addressed.” | FFIEC BCM Booklet, Section III.B (Likelihood and Impact) | in force |
| US | FFIEC | business continuity | Management should assess whether third-party service providers consider the likelihood of disruption based on geographic location of facilities, susceptibility to threats, and proximity to critical infrastructure. “Management should also assess whether its third-party service providers consider the likelihood of a disruption based on the geographic location of facilities, their susceptibility to threats (e.g., location in a flood plain), and the proximity to critical infrastructure.” | FFIEC BCM Booklet, Section III.B (Likelihood and Impact) | in force |
| US | FFIEC | business continuity | Management should determine potential severity of threats and estimate disruption impact under various threat scenarios, scoring and prioritizing results to manage risk exposure versus current controls. “Management should determine the potential severity of threats and estimate the disruption's impact under various threat scenarios...The results may be scored quantitatively...or qualitatively...and then prioritized.” | FFIEC BCM Booklet, Section III.B (Likelihood and Impact) | in force |
| US | FFIEC | business continuity | Management should develop risk management strategies (mitigation, avoidance, acceptance, or transfer) based on the gap between foreseeable threat risks and current control mitigations, aligned to the entity's risk appetite. [adjacent] “Management should develop strategies to manage risk, which could include risk mitigation, avoidance, acceptance, or risk transfer, based on the entity's risk appetite.” | FFIEC BCM Booklet, Section III.B (Likelihood and Impact) | in force |
| US | FFIEC | business continuity | The board and senior management should develop effective business continuity strategies to meet resilience and recovery objectives, including guidelines to achieve defined business continuity objectives. “The board and senior management should develop effective strategies to meet resilience and recovery objectives. Effective oversight generally includes guidelines to achieve defined business continuity objectives.” | FFIEC BCM Booklet, Section IV (Business Continuity Strategies Action Summary) | in force |
| US | FFIEC | business continuity | Examined on whether BCM strategies address personnel, processes, technology, and facility issues; critical business risks including cyber threats and loss of critical third-party service providers; backup/replication/storage for data protection; telecommunications redundancy; change management; proprietary system alternatives; and… “Examiners should review BCM strategies and determine whether the strategies: Address personnel, processes, technology, and facility issues...Address critical business risks...Outline a combination of backup, replication, and storage methods...Provide for high redundancy levels…” | FFIEC BCM Booklet, Section IV (Business Continuity Strategies Action Summary) | in force |
| US | FFIEC | business continuity | Business continuity strategies should be risk-based, address all foreseeable risks including non-technology risks (e.g., transaction and liquidity), include resource allocation to meet resilience and recovery objectives, and be validated to confirm viability at peak work volumes. “These strategies should be risk-based and address all foreseeable risks, including non-technology risks (e.g., transaction and liquidity). Strategies should include allocation of resources to meet resilience and recovery objectives. Strategies should be validated to confirm that…” | FFIEC BCM Booklet, Section IV | in force |
| US | FFIEC | business continuity | Strategies should include potential impact considerations for personnel, processes, technology, facilities, and data, including logistical arrangements for staff, alternate communication methods, redundant work sites, backup data centers or cloud providers, and geographic diversity to reduce single points of failure. “Strategies should include the potential impact to personnel, processes, technology, facilities, and data. Personnel-related strategies may include logistical arrangements to transport or house staff...Process-related strategies may include redundant work…” | FFIEC BCM Booklet, Section IV | in force |
| US | FFIEC | business continuity | Management should develop comprehensive data protection strategies that integrate operational, continuity, and resilience strategies; include a process to preserve data integrity and availability; and monitor the effectiveness and efficiency of data protection solutions using a combination of backup, replication, and storage. “Management should develop comprehensive strategies to protect data, such as: Integrating operational, continuity, and resilience strategies to protect data based on recovery objectives. Designing a process to preserve the integrity and availability of data from threats.…” | FFIEC BCM Booklet, Section IV | in force |
| US | FFIEC | business continuity | Management must develop strategies to mitigate specific threats such as cyber threats or loss of critical third-party service providers, and must determine alternatives for proprietary systems critical to business activities. “Management should consider strategies to mitigate specific or unique threats, such as cyber threats or loss of critical third-party service providers...Management should determine what alternatives exist for proprietary systems given the significant, unique risks to an entity's…” | FFIEC BCM Booklet, Section IV | in force |
| US | FFIEC | business continuity | Management must assess voice/data access capabilities, map technology infrastructure to employee needs, and evaluate internal and external capacity (including remote capacity) to determine whether telecommuting strategies are sufficient for continuity. “management should also consider access capabilities for voice and data, mapping technology infrastructure to employee needs, and internal and external capacity (including remote capacity) to determine whether telecommuting strategies are sufficient.” | FFIEC BCM Booklet, Section IV | in force |
| US | FFIEC | business continuity | Management should remain responsible for data integrity and overall resilience even when using cloud architectures, virtualization, or cloud-based disaster recovery services, and should ensure independent resilience oversight regardless of strategy selected. “Independent of the strategies selected for architecture and data protection, management should still be responsible for data integrity and overall resilience. Cloud-based disaster recovery services may be considered as part of resilience programs.” | FFIEC BCM Booklet, Section IV | in force |
| US | FFIEC | business continuity | Management should evaluate whether appropriate resources exist for resilience, including an accessible off-site repository of software, configuration settings, and related documentation, appropriate data backups, and off-site infrastructure to operate recovery systems. “management should evaluate whether there are appropriate resources to ensure resilience, including an accessible, off-site repository of software, configuration settings, and related documentation, appropriate backups of data, and off-site infrastructure” | FFIEC BCM Booklet, Section IV.A (Resilience Action Summary) | in force |
| US | FFIEC | business continuity | Management should discuss potential disaster scenarios with third-party service providers to prepare for a disruptive event. “management should discuss potential disaster scenarios with the entity's third-party service providers to prepare for an event.” | FFIEC BCM Booklet, Section IV.A (Resilience Action Summary) | in force |
| US | FFIEC | business continuity | Management should assess immediate or short-term space requirements, systems, and personnel capacity to assume or transfer failed operations following a disruption. “management should assess the entity's immediate or short-term space requirements, systems, and personnel capacity to assume or transfer failed operations.” | FFIEC BCM Booklet, Section IV.A (Resilience Action Summary) | in force |
| US | FFIEC | business continuity | Management should assess critical third-party service providers' susceptibility to simultaneous attacks and verify their resilience capabilities. “management should assess critical third-party service providers' susceptibility to simultaneous attacks and verify their resilience capabilities.” | FFIEC BCM Booklet, Section IV.A (Resilience Action Summary) | in force |
| US | FFIEC | business continuity | Management should ensure resilience strategies, including maintaining security standards, extend across the entire business including outsourced activities. “Resilience strategies, including maintaining security standards, should extend across the entire business, including outsourced activities.” | FFIEC BCM Booklet, Section IV.A (Resilience — general) | in force |
| US | FFIEC | business continuity | Management should evaluate whether the entity has appropriate human, financial, and time resources for resilience. “Management should evaluate whether the entity has appropriate resources (e.g., human, financial, time) for resilience.” | FFIEC BCM Booklet, Section IV.A (Resilience — general) | in force |
| US | FFIEC | business continuity | Management must incorporate lessons learned from previous disruptive events when developing resilience strategies. “When developing the entity's resilience strategies, management should consider lessons learned from previous events.” | FFIEC BCM Booklet, Section IV.A (Resilience — general) | in force |
| US | FFIEC | business continuity | Management should diversify telecommunication lines, establish redundant connections between branches and data centers, create backups, identify multiple power sources, and verify geographic diversity of key entity locations to support physical resilience. “management, when possible, should diversify telecommunication lines, establish redundant connections between branches and data centers, create backups, identify multiple power sources, and verify geographic diversity of key entity locations.” | FFIEC BCM Booklet, Section IV.A (Physical resilience) | in force |
| US | FFIEC | business continuity | Management should ensure cyber resilience measures are flexible enough to adapt to a diverse range of events, including simultaneous attacks on production and backup facilities. “Given the broad and increasing spectrum of cyber threats, resilience measures should be flexible enough to adapt to a diverse range of events. For example, a cyber attack could impact both production and backup facilities simultaneously.” | FFIEC BCM Booklet, Section IV.A (Cyber Resilience) | in force |
| US | FFIEC | business continuity | Management should adhere to established security and privacy policies and processes to comply with applicable regulations even during disruptive events. [adjacent] “management should adhere to established security and privacy policies and processes to comply with applicable regulations, even during disruptive events.” | FFIEC BCM Booklet, Section IV.A (Cyber Resilience) | in force |
| US | FFIEC | business continuity | Management should maintain data confidentiality, integrity, and availability for all iterations of data including backups and replicated data, not just the production environment. “Management should maintain data confidentiality, integrity, and availability for all iterations of data, including data backup and replication, not just focused on the production environment.” | FFIEC BCM Booklet, Section IV.A (Data Backup and Replication) | in force |
| US | FFIEC | business continuity | Management should reassess backup and recovery strategies as technology and threat environments evolve. “Management should reassess backup and recovery strategies as the technology and threat environments evolve.” | FFIEC BCM Booklet, Section IV.A (Data Backup and Replication) | in force |
| US | FFIEC | business continuity | Management should maintain an accessible off-site repository of software, configuration settings, and related documentation. “Management should maintain an accessible, off-site repository of software, configuration settings, and related documentation.” | FFIEC BCM Booklet, Section IV.A (Data Backup and Replication) | in force |
| US | FFIEC | business continuity | Management must perform comprehensive backup of critical software including operating systems, applications, utility programs, databases, and other critical software identified in the BIA. “a comprehensive backup of critical software is important. Software backups generally consist of the following components: Operating systems. Applications. Utility programs. Databases. Other critical software identified in the BIA.” | FFIEC BCM Booklet, Section IV.A (Data Backup and Replication) | in force |
| US | FFIEC | business continuity | Management should establish effective procedures to recover critical networks and systems, addressing backup types, backup levels, update/retention frequencies, hardware/software compatibility, data transmission controls, and repository maintenance. “Management should establish effective procedures to recover critical networks and systems. Procedures may address the following: Backup types...Backup levels...Updates and retention cycle frequencies...Software and hardware compatibility reviews...Data transmission…” | FFIEC BCM Booklet, Section IV.A (Data Backup and Replication) | in force |
| US | FFIEC | business continuity | Management is encouraged to consider integrity controls during data replication so that data changes in production, development, and QA environments are applied consistently throughout the network. [adjacent] “management should consider integrity controls during replication so that data changes in production, development, and quality assurance environments are applied throughout the network.” | FFIEC BCM Booklet, Section IV.A (Data Backup and Replication — replication) | in force |
| US | FFIEC | business continuity | Management should determine appropriate retention periods for each iteration of data backup. “Management should determine the appropriate retention periods for each iteration of data backup.” | FFIEC BCM Booklet, Section IV.A (Data Backup and Replication — retention) | in force |
| US | FFIEC | business continuity | Management should safeguard against replicating malware and data corruption, including considering longer retention periods for critical data files to ensure ability to recover a backup prior to a corruption event. “Entities should safeguard against replicating malware and data corruption...management could be unaware of an event...management may determine that the backup of critical data files should be subject to longer retention periods to ensure the ability to recover a backup prior to…” | FFIEC BCM Booklet, Section IV.A (Data Backup and Replication — malware replication risk) | in force |
| US | FFIEC | business continuity | Entities should develop appropriate cyber resilience processes — including recovery of data and business operations, rebuilding network capabilities, and restoring data — to enable restoration of critical services if the institution or its critical service providers suffer a destructive cyber attack. “Entities should develop appropriate cyber resilience processes (e.g., recovery of data and business operations, rebuilding network capabilities and restoring data) that enable restoration of critical services if the institution or its critical service providers fall victim to a…” | FFIEC BCM Booklet, Section IV.A (Cyber Resilience — critical service restoration) | in force |
| US | FFIEC | business continuity | BCM should include the ability to protect offline data backups from destructive malware or other threats that may corrupt production and online backup versions of data. “BCM should include the ability to protect offline data backups from destructive malware or other threats that may corrupt production and online backup versions of data.” | FFIEC BCM Booklet, Section IV.A (Cyber Resilience — offline backups) | in force |
| US | FFIEC | business continuity | Management should plan for mass absenteeism during a disruptive event, including events such as natural disasters, severe weather, and pandemics, and designate emergency personnel including critical business process-level employees. “management should plan for mass absenteeism during an event or disruption...management should consider: Staffing and skills needed to operate critical functions...Designated emergency personnel, including critical business process-level employees.” | FFIEC BCM Booklet, Section IV.A (Personnel) | in force |
| US | FFIEC | business continuity | Management should plan for events where personnel cannot access facilities and critical personnel are not immediately available, considering secure telecom options for alternate-location workers and basic necessities for displaced employees. “Management should plan for events during which personnel may not be able to access facilities and critical personnel may not be available immediately after the disruption...Secure telecommunication options if employees work from an alternate location.” | FFIEC BCM Booklet, Section IV.A (Personnel) | in force |
| US | FFIEC | business continuity | Management should assess critical third-party service providers' susceptibility to multiple event scenarios and verify their resilience capabilities. “Management should assess critical third-party service providers' susceptibility to multiple event scenarios and verify such third parties' resilience capabilities.” | FFIEC BCM Booklet, Section IV.A (Third-Party Service Providers) | in force |
| US | FFIEC | business continuity | Management is encouraged to consider alternative providers or other contingency plans to avoid third-party service providers becoming a single point of failure, and periodically reevaluate resilience options if alternatives are not readily available. “An entity's third-party service provider can be a single point of failure if management has not considered alternative providers or other contingency plans...management should consider options to continue business operations and reevaluate resilience options periodically” | FFIEC BCM Booklet, Section IV.A (Third-Party Service Providers) | in force |
| US | FFIEC | business continuity | Resilience planning should be closely coordinated with third-party service providers. “Resilience planning should be closely coordinated with third-party service providers.” | FFIEC BCM Booklet, Section IV.A (Third-Party Service Providers) | in force |
| US | FFIEC | business continuity | Contracts and SLAs with third-party service providers should detail roles and responsibilities of each party to promote resilience. “Contracts and SLAs with third-party service providers should detail roles and responsibilities of each party to promote resilience.” | FFIEC BCM Booklet, Section IV.A (Third-Party Service Providers) | in force |
| US | FFIEC | business continuity | Management must conduct ongoing monitoring of critical third-party service providers to identify potential weaknesses in their resilience that could affect the entity's operations. “Ongoing monitoring of the entity's third-party service providers helps management identify potential weaknesses in the third-party service provider's resilience that could affect the entity's operations.” | FFIEC BCM Booklet, Section IV.A (Third-Party Service Providers) | in force |
| US | FFIEC | business continuity | Management's review of a critical third-party service provider's BCM program may include obtaining and reviewing independent audit reports or SOC reports. “Management's review of an entity's third-party service provider's BCM program may include independent audit reports or SOC reports. SOC reports can contain valuable information about the third-party service provider's products and processes.” | FFIEC BCM Booklet, Section IV.A (Third-Party Service Providers) | in force |
| US | FFIEC | business continuity | Management is encouraged to consider strategies to mitigate specific or unique threats such as cyber threats or loss of critical third-party service providers when developing BCM resilience strategies. “management should consider strategies to mitigate specific or unique threats, such as cyber threats or loss of critical third-party service providers.” | FFIEC BCM Booklet, Section IV.A (introductory — threat-specific strategies) | in force |
| US | FFIEC | business continuity | Management should determine alternatives for proprietary and internally developed systems (e.g., spreadsheets) that are critical to business activities, including how and where they are stored, as part of resilience and BIA processes. “management should determine what alternatives exist for proprietary systems...some entities use internally developed assets (e.g., spreadsheets or other tools) that are critical for certain calculations within a business unit, which are often overlooked, including where and how…” | FFIEC BCM Booklet, Section IV.A (introductory — proprietary systems) | in force |
| US | FFIEC | business continuity | Management is encouraged to consider access capabilities for voice and data, mapping technology infrastructure to employee needs, and internal and external capacity (including remote capacity) to determine whether telecommuting strategies are sufficient. “management should also consider access capabilities for voice and data, mapping technology infrastructure to employee needs, and internal and external capacity (including remote capacity) to determine whether telecommuting strategies are sufficient.” | FFIEC BCM Booklet, Section IV.A (introductory — telecommuting) | in force |
| US | FFIEC | business continuity | Management must assess alternate data communications infrastructure between the entity and critical third-party service providers as part of resilience planning. “Assessment of alternate data communications infrastructure between the entity and critical third-party service providers.” | FFIEC BCM Booklet, Section IV.A (Resilience Action Summary — examiner review items) | in force |
| US | FFIEC | business continuity | Management must evaluate the entity's susceptibility to multiple threat scenarios in resilience planning, testing, and recovery strategies. “Evaluation of the entity's susceptibility to multiple threat scenarios in resilience planning, testing, and recovery strategies.” | FFIEC BCM Booklet, Section IV.A (Resilience Action Summary — examiner review items) | in force |
| US | FFIEC | business continuity | Management should assess critical third-party service providers' susceptibility to multiple event scenarios and verify their resilience capabilities. “Management should assess critical third-party service providers' susceptibility to multiple event scenarios and verify such third parties' resilience capabilities.” | FFIEC BCM Booklet, Section III (Third-Party Service Providers) | in force |
| US | FFIEC | business continuity | Consider alternative providers or contingency plans to ensure no third-party service provider is a single point of failure, and periodically reevaluate resilience options. “An entity's third-party service provider can be a single point of failure if management has not considered alternative providers or other contingency plans... reevaluate resilience options periodically as conditions may change.” | FFIEC BCM Booklet, Section III (Third-Party Service Providers) | in force |
| US | FFIEC | business continuity | Management should closely coordinate resilience planning with third-party service providers and establish well-defined expectations, including roles and responsibilities in contracts and SLAs. “Resilience planning should be closely coordinated with third-party service providers... Contracts and SLAs with third-party service providers should detail roles and responsibilities of each party to promote resilience.” | FFIEC BCM Booklet, Section III (Third-Party Service Providers) | in force |
| US | FFIEC | business continuity | Conduct ongoing monitoring of third-party service providers to identify potential weaknesses in their resilience that could affect the entity's operations. “Ongoing monitoring of the entity's third-party service providers helps management identify potential weaknesses in the third-party service provider's resilience that could affect the entity's operations.” | FFIEC BCM Booklet, Section III (Third-Party Service Providers) | in force |
| US | FFIEC | business continuity | Management should review third-party service providers' BCM programs, including independent audit or SOC reports, and verify whether business continuity activities are adequately audited. “Management's review of an entity's third-party service provider's BCM program may include independent audit reports or SOC reports... it should verify whether business continuity activities are audited, including whether the scope and depth of review are sufficient.” | FFIEC BCM Booklet, Section III (Third-Party Service Providers) | in force |
| US | FFIEC | business continuity | Assess third-party service provider capacity to meet client recovery objectives relative to other clients' needs, and ability to participate in recovery testing. “Capacity of third-party service provider to meet client recovery objectives in the agreements, relative to other clients' needs. Ability to participate in recovery testing with third-party service providers and access to testing results.” | FFIEC BCM Booklet, Section III (Third-Party Service Providers) | in force |
| US | FFIEC | business continuity | Assess ability to move outsourced processes in-house or to another provider, and identify alternative resources when primary services cannot be delivered. “Ability to move outsourced processes either in-house or to another third-party service provider. Alternative resource options (e.g., personnel and systems) for when primary services cannot be delivered.” | FFIEC BCM Booklet, Section III (Third-Party Service Providers) | in force |
| US | FFIEC | business continuity | Assess data confidentiality, integrity, and availability including transportability and interoperability with third-party service providers. “Data confidentiality, integrity, and availability (e.g., transportability and interoperability).” | FFIEC BCM Booklet, Section III (Third-Party Service Providers) | in force |
| US | FFIEC | business continuity | Assess third-party service providers' financial capacity to continue meeting contractual obligations and evaluate concentration risk from services concentrated in limited providers. “Financial capacity to continue meeting contractual obligations. Services concentrated in a limited number of third-party service providers.” | FFIEC BCM Booklet, Section III (Third-Party Service Providers) | in force |
| US | FFIEC | business continuity | Include in contracts and SLAs time parameters for services, baseline resilience/recovery metrics, incident response metrics, and periodic service review provisions. “Time parameter(s) for contracted service(s). Appropriate baseline metrics describing management's resilience and recovery expectations (e.g., an incident response metric)... Periodic service reviews to ensure up-to-date agreements.” | FFIEC BCM Booklet, Section III (Third-Party Service Providers) | in force |
| US | FFIEC | business continuity | Establish plans for the resilience of third-party service providers supporting critical operations, accounting for RTO exceedance risk if a provider ceases operations. “If operations at a third-party service provider cease, the length of time required to convert to an alternate system would, for most applications, exceed a reasonable RTO. To the extent possible, management should establish plans for the resilience of third-party service…” | FFIEC BCM Booklet, Section III (Third-Party Service Providers) | in force |
| US | FFIEC | business continuity | Management should ensure appropriate redundancy levels in telecommunications infrastructure, identifying and mitigating single points of failure. “Management should ensure appropriate redundancy levels in the entity's telecommunications infrastructure... Identifying and mitigating single points of failure across the entity's infrastructure.” | FFIEC BCM Booklet, Section III (Telecommunications) | in force |
| US | FFIEC | business continuity | Develop and maintain a plan to address outages in telecommunications lines with primary third-party service providers. “Developing and maintaining a plan to address an outage in the telecommunications lines with the entity's primary third-party service providers.” | FFIEC BCM Booklet, Section III (Telecommunications) | in force |
| US | FFIEC | business continuity | Establish redundant telecommunications links with third-party service providers through contractual arrangements allowing switch to alternate communication paths. “Establishing redundant telecommunications links with each of the entity's third-party service providers through a contractual arrangement, which allows either party to switch its connection to an alternate communication path.” | FFIEC BCM Booklet, Section III (Telecommunications) | in force |
| US | FFIEC | business continuity | Management should review third-party service providers' telecommunications plans to verify critical services can be restored within acceptable time frames. “Reviewing the entity's third-party service providers' plans and determining whether critical services can be restored within acceptable time frames.” | FFIEC BCM Booklet, Section III (Telecommunications) | in force |
| US | FFIEC | business continuity | Develop guidelines to diversify telecommunications connections to mitigate failure risk, commensurate with the entity's size, complexity, and risk profile. “Developing guidelines, commensurate with the entity's size, complexity, and risk profile, to diversify connections to mitigate the risk of a telecommunications failure.” | FFIEC BCM Booklet, Section III (Telecommunications) | in force |
| US | FFIEC | business continuity | Assess 'last mile' communications technology for single points of failure. “Assessing the communications technology that bridges the transmission distance between the telecommunications service provider and the entity, sometimes referred to as the 'last mile,' for single points of failure.” | FFIEC BCM Booklet, Section III (Telecommunications) | in force |
| US | FFIEC | business continuity | Monitor relationships with telecommunications providers to manage risks and verify proper implementation of system redundancies. “Monitoring relationships with telecommunications providers to manage risks. Inquiring about the physical paths used by telecommunications providers and verifying that system redundancies have been properly implemented.” | FFIEC BCM Booklet, Section III (Telecommunications) | in force |
| US | FFIEC | business continuity | Consider enrolling in TSP, GETS, and WPS federal priority telecommunications programs and integrate TSP into the BCP if qualified. “If the entity qualifies, management should integrate the TSP program into the entity's BCP... Government Emergency Telecommunications Service (GETS)... Wireless Priority Service (WPS).” | FFIEC BCM Booklet, Section III (Telecommunications) | in force |
| US | FFIEC | business continuity | Management should implement measures to provide electricity during short-term power disruptions and develop plans for long-term power disruptions, including alternate energy sources, fuel management, generator load capacity, maintenance, and testing. “Management should implement measures to provide electricity in the event of a short-term power disruption. Furthermore, management should develop plans to provide electricity in the event of a long-term power disruption.” | FFIEC BCM Booklet, Section III (Power) | in force |
| US | FFIEC | business continuity | Management should implement and align a consistent change management process that includes BCM, ensuring recovery systems and alternate-site documentation are updated to reflect production changes. “Management should implement and align a consistent change management process throughout the entity, making sure to include BCM. As changes are made to production systems... recovery systems and documentation at alternate locations should similarly be updated.” | FFIEC BCM Booklet, Section III (Change Management) | in force |
| US | FFIEC | business continuity | Allow for expedient implementation of emergency changes during an event; ensure such changes are properly authorized, monitored, and documented even during events; and update systems documentation after the event. “The change management process should allow for expedient implementation of emergency changes during an event... Even during events, changes should still be properly authorized, monitored, and documented... After an emergency event, systems documentation should be updated for any…” | FFIEC BCM Booklet, Section III (Change Management) | in force |
| US | FFIEC | business continuity | The institution is encouraged to plan for and prepare multiple communication mechanisms for use when traditional communications are impaired, including alternative channels, with controls to safeguard sensitive information. “Management should consider, plan for, and prepare multiple mechanisms to communicate with others... Regardless of the communication device used, appropriate controls to safeguard customer and other sensitive information should be maintained.” | FFIEC BCM Booklet, Section IV.B (Communications) | in force |
| US | FFIEC | business continuity | The institution should include communication protocols and contact lists in BCM to notify stakeholders, including regulatory agencies, emergency responders, customers, third parties, and information-sharing entities. “BCM should include communication protocols and contact lists to notify stakeholders... External groups could include: Regulatory agencies... Emergency responders... Law enforcement... Customers, third-party service providers... Information-sharing entities (e.g., FS-ISAC).” | FFIEC BCM Booklet, Section IV.B (Communications) | in force |
| US | FFIEC | business continuity | The institution should incorporate strategic communications and crisis management approaches in communication protocols, including prepared public/press statements, media response plans, and social media management. “Communication protocols should incorporate strategic communications and crisis management approaches in concert with public affairs or external communications (e.g., prepared public/press statements, media response plans, managing social media, etc.).” | FFIEC BCM Booklet, Section IV.B (Communications) | in force |
| US | FFIEC | business continuity | Management should develop a BCP with sufficient detail addressing authorities, responsibilities, relocation strategies, communications protocols, event management, disaster recovery, payment system alternatives, and facilities/data center contingencies. “Management should develop business continuity plan(s) (BCP) with sufficient detail in relation to the entity's size and complexity. The BCP should address key business needs and incorporate inputs from all business units.” | FFIEC BCM Booklet, Section V (Business Continuity Plan Action Summary) | in force |
| US | FFIEC | business continuity | The institution should maintain the BCP as a living document, regularly updated to reflect system enhancements, organizational changes, and post-event lessons. “Furthermore, the BCP should be a living document, regularly updated so that it remains current with system enhancements and organizational changes.” | FFIEC BCM Booklet, Section V (Business Continuity Plan Action Summary) | in force |
| US | FFIEC | business continuity | Include in the BCP: roles/responsibilities, solutions to foreseeable disruptions including cyber threats, escalation thresholds, personnel/customer protection steps, recovery prioritization, critical information protection, logistical arrangements, network/communication needs, alternate site personnel arrangements, testing… “Solutions to various types of foreseeable disruptions, including those emanating from cyber threats. Escalation thresholds. Immediate steps to protect personnel and customers... Prioritization and procedures to recover functions, services, and processes.” | FFIEC BCM Booklet, Section V (Business Continuity Plan Action Summary) | in force |
| US | FFIEC | business continuity | The institution should store the BCP and supporting documentation so it is readily accessible by personnel during adverse events. “Regardless of its development process, the BCP and supporting documentation should be stored so that it is readily accessible by personnel during adverse events.” | FFIEC BCM Booklet, Section V (Business Continuity Plan Action Summary) | in force |
| US | FFIEC | business continuity | The institution should include event management procedures in the BCP with predefined escalation thresholds, event reporting procedures, and response actions for reasonably foreseeable event types. “The BCP should include event management procedures that detail reasonably foreseeable event types and provide thresholds and responses. Procedures should describe how to report an event to management and the situations that warrant notification.” | FFIEC BCM Booklet, Section V.A (Event Management) | in force |
| US | FFIEC | business continuity | The institution is encouraged to establish an event response team(s) with defined roles; ensure event monitoring is an entity-wide responsibility including board and senior management. “Management should consider establishing a team(s) to address events... While the team should manage the event and communicate with stakeholders, event monitoring is an entity-wide responsibility (e.g., board, senior management, and other personnel).” | FFIEC BCM Booklet, Section V.A (Event Management) | in force |
| US | FFIEC | business continuity | The BCP should include event management procedures detailing reasonably foreseeable event types with predefined threshold escalation triggers and responses, including reporting protocols and team notification. “The BCP should include event management procedures that detail reasonably foreseeable event types and provide thresholds and responses. Procedures should describe how to report an event to management” | FFIEC BCM Booklet, Section V (Event Management) | in force |
| US | FFIEC | business continuity | Management should establish protocols for operations continuity and system recovery, including manual procedures for critical functions such as back-office operations, loan operations, and customer support. “Management should establish protocols for operations continuity and system recovery... procedures should address manual steps for critical functions, such as back-office operations, loan operations, and customer support.” | FFIEC BCM Booklet, Section V.B (Continuity and Recovery) | in force |
| US | FFIEC | business continuity | The BCP must include procedures for tracking daily transactions, reconciling general ledger accounts, documenting operational tasks, posting entries after system recovery, and maintaining backup records for customer account information. “Tracking daily transactions. Reconciling general ledger accounts. Documenting operational tasks. Posting entries after system recovery. Maintaining backup records to provide customer account information” | FFIEC BCM Booklet, Section V.B (Continuity and Recovery) | in force |
| US | FFIEC | business continuity | Business continuity plans and procedures should be clear, concise, and easy to implement in an emergency, such as using checklists and step-by-step procedures. “Business continuity plans and procedures should be clear, concise, and easy to implement in an emergency, such as checklists and step-by-step procedures.” | FFIEC BCM Booklet, Section V.B (Continuity and Recovery) | in force |
| US | FFIEC | business continuity | The BCP should include alternate identity verification methods for displaced customers and address fraud identification and suspicious activity reporting during recovery. “The BCP should include alternate identity verification methods, and management should be alert for fraud or other suspicious activities. Procedures should address fraud identification and suspicious activity reporting according to protocols and legal requirements.” | FFIEC BCM Booklet, Section V.B (Continuity and Recovery) | in force |
| US | FFIEC | business continuity | During recovery, management should coordinate access and availability of power and telecommunications systems with police, fire, local/state government agencies, and federal agencies such as FEMA as appropriate. “Management should coordinate access and availability of power and telecommunications systems with various entities. Management should coordinate with the police and fire departments and local and state government agencies to facilitate timely, secure resilience strategies.” | FFIEC BCM Booklet, Section V.B (Continuity and Recovery) | in force |
| US | FFIEC | business continuity | The BCP should identify alternatives for core operations, facilities, infrastructure systems, suppliers, utilities, interdependent business partners, and key personnel, with planning for short-, medium-, and long-term site relocation scenarios. “The BCP should identify alternatives for core operations, facilities, infrastructure systems, suppliers, utilities, interdependent business partners, and key personnel... management should plan for scalability because an event may last for an extended period of time.” | FFIEC BCM Booklet, Section V.C (Facilities and Infrastructure) | in force |
| US | FFIEC | business continuity | Management should verify that recovery alternatives can accommodate the services and processing capabilities affecting critical operations, including core processing, check processing, payments, and customer identification. “Management should verify that recovery alternatives can accommodate the services and processing capabilities affecting critical operations, including: Core processing. Check processing and imaging. Commercial cash management. Payments. Mailing, faxing, and printing. Customer…” | FFIEF BCM Booklet, Section V.C (Facilities and Infrastructure) | in force |
| US | FFIEC | business continuity | Management should document the reasons for choosing a data center recovery alternative and why it is appropriate based on the entity's risk profile and complexity. “Management should document the reasons (e.g., cost and service level) for choosing an alternative and why it is appropriate based on the entity's risk profile and complexity.” | FFIEC BCM Booklet, Section V.C — Data Center Recovery Alternatives | in force |
| US | FFIEC | business continuity | Management must maintain appropriate controls over data center recovery solutions regardless of which recovery alternative (e.g., cloud, third-party, colocation) is used. “The primary objectives are for data to be available and remotely accessible. Management should maintain appropriate controls, regardless of solution.” | FFIEC BCM Booklet, Section V.C — Data Center Recovery Alternatives | in force |
| US | FFIEC | business continuity | When using a colocation facility, management must account for the risk that colocation provider capacity may be insufficient during a regional or large-scale event. “If management relies on a colocation facility to deliver resources, there is a risk that the capacity at the colocation service provider may not be able to support the entity's operations during a regional or large-scale event.” | FFIEC BCM Booklet, Section V.C — Data Center Recovery Alternatives (Colocation facility) | in force |
| US | FFIEC | business continuity | Management should not rely on reciprocal agreements as a long-term recovery solution and should assess capacity adequacy and software version compatibility before using them. “While these arrangements may be acceptable as a short-term solution, management should not rely on them as a long-term recovery solution... they are viable only if there is adequate excess capacity at the reciprocal financial institution and both operate on the same version and…” | FFIEC BCM Booklet, Section V.C — Data Center Recovery Alternatives (Reciprocal agreement) | in force |
| US | FFIEC | business continuity | The BCP should address alternate payment arrangements if payment systems fail (e.g., ATMs, funds transfers, electronic banking, remote deposit capture, mobile), including manual procedures and redundant electronic payment systems at recovery sites. “The BCP should address alternate arrangements if payment systems fail... Management should verify that redundant electronic payment systems and equipment (e.g., tokens and routers) are included at recovery sites for activation” | FFIEC BCM Booklet, Section V.D (Payment Systems) | in force |
| US | FFIEC | business continuity | The BCP should address increased cash demands during adverse events, including pre-established withdrawal limits, increased branch traffic procedures, and pre-established agreements with cash delivery services. “The BCP should also address increased cash demands and moving funds through electronic systems... management should prepare for a potential increase in branch traffic when ATMs are unavailable. Pre-established agreements with various cash delivery services... should also be…” | FFIEC BCM Booklet, Section V.D (Payment Systems) | in force |
| US | FFIEC | business continuity | The BCP should detail processes to address potential cash and liquidity needs during adverse events, including emergency borrowing access, alternative cash delivery, and cash security/distribution procedures. “The BCP should detail processes to address potential cash and liquidity needs during adverse events... Arrangements to help meet liquidity needs may include: Emergency borrowing access. Alternative cash delivery. Procedures to secure, deliver, and distribute cash.” | FFIEC BCM Booklet, Section V.E (Liquidity Considerations) | in force |
| US | FFIEC | business continuity | The BCP should incorporate incident response components that minimize disruption and loss of information, with procedures aligned to cybersecurity, network operations, physical security, and outsourced service obligations. “Management should align incident response procedures with other related processes (e.g., cybersecurity, network operations, and physical security), outsourced services (e.g., contracted incident response obligations), and verify that the procedures are considered during planning…” | FFIEC BCM Booklet, Section V.F — Incident Response | in force |
| US | FFIEC | business continuity | Management should designate a spokesperson(s) for media communication, develop pre-planned response scenarios approved by the board and senior management, and monitor social media during events to resolve conflicting messages. “Management should designate a spokesperson(s) to communicate with the news media. Management should consider various, pre-planned response scenarios approved by the board and senior management. Social media monitoring during an event can help management resolve conflicting…” | FFIEC BCM Booklet, Section V.F — Incident Response | in force |
| US | FFIEC | business continuity | Management should train personnel to adhere to the incident response plan when approached by news media or communicating via social media during an event. “Management should train personnel to adhere to the plan when approached by the news media or communicating via social media.” | FFIEC BCM Booklet, Section V.F — Incident Response | in force |
| US | FFIEC | business continuity | Management should leverage routine processes (e.g., vulnerability management and network monitoring) to anticipate potential incidents including cyber incidents, and coordinate incident response planning with third-party service provider plans. “management should leverage routine processes (e.g., vulnerability management and network monitoring) to anticipate potential incidents, including cyber incidents, and coordinate incident response planning with any third-party service provider plans.” | FFIEC BCM Booklet, Section V.F — Incident Response | in force |
| US | FFIEC | business continuity | Management is encouraged to consider prearranging third-party forensic and incident response services prior to an event occurring. “management should consider prearranging third-party forensic and incident response services.” | FFIEC BCM Booklet, Section V.F — Incident Response | in force |
| US | FFIEC | business continuity | Management should periodically update and test the entity's incident response program to verify it functions as intended given rapidly changing threats. “Management should periodically update and test the entity's incident response program to verify that it functions as intended, given rapidly changing threats.” | FFIEC BCM Booklet, Section V.F — Incident Response | in force |
| US | FFIEC | business continuity | The BCP must incorporate disaster recovery procedures for restoring IT infrastructure, data, and systems, and must include invoking disaster recovery procedures in response to significant cyber attacks. “Disaster recovery is the restoring of IT infrastructure, data, and systems... Invoking disaster recovery procedures once management has identified a significant cyber attack.” | FFIEC BCM Booklet, Section V.F — Disaster Recovery | in force |
| US | FFIEC | business continuity | Coordinate incident response planning with third-party service provider plans and consider prearranging third-party forensic and incident response services. “management should leverage routine processes...to anticipate potential incidents, including cyber incidents, and coordinate incident response planning with any third-party service provider plans. Furthermore, management should consider prearranging third-party forensic and…” | FFIEC BCM Booklet, Section V (Disaster Recovery / Incident Response) | in force |
| US | FFIEC | business continuity | Management should periodically update and test the entity's incident response program to verify it functions as intended given rapidly changing threats. “Management should periodically update and test the entity's incident response program to verify that it functions as intended, given rapidly changing threats.” | FFIEC BCM Booklet, Section V (Incident Response) | in force |
| US | FFIEC | business continuity | Management should identify key business processes to maintain while IT systems are unavailable and prioritize the order in which systems are restored, reflected in the BIA. “Management should identify key business processes and activities to be maintained while IT systems and applications are unavailable and prioritize the order in which these systems are restored, which should be reflected in the BIA.” | FFIEC BCM Booklet, Section V (Disaster Recovery) | in force |
| US | FFIEC | business continuity | Management should develop a coordinated disaster recovery strategy for data centers, networks, servers, storage, service monitoring, user support, and related software. “management should develop a coordinated strategy for the recovery of data centers, networks, servers, storage, service monitoring, user support, and related software.” | FFIEC BCM Booklet, Section V (Disaster Recovery) | in force |
| US | FFIEC | business continuity | Include procedures for restoring backlogged activity or lost transactions to bring transaction records current within expected recovery time frames. “Procedures for restoring backlogged activity or lost transactions to identify how transaction records will be brought current within expected recovery time frames.” | FFIEC BCM Booklet, Section V (Disaster Recovery) | in force |
| US | FFIEC | business continuity | Include instructions to access critical information repositories and other resources when the primary facility is unavailable. “Instructions to access critical information repositories and other resources when the primary facility is unavailable.” | FFIEC BCM Booklet, Section V (Disaster Recovery) | in force |
| US | FFIEC | business continuity | Exercise caution when classifying critical vs. non-critical systems, recognizing that systems like telephone banking, internet banking, ATMs, and email may be critical during disruptions. “telephone banking, internet banking, or ATMs may not seem critical when systems are operating normally; however, these systems play a critical role in delivering services to customers during a disruption. Similarly, an email system may not appear critical but may be the primary…” | FFIEC BCM Booklet, Section V (Disaster Recovery) | in force |
| US | FFIEC | business continuity | The institution should develop crisis/emergency management BCP components that address coordination with regulatory agencies, local/state officials, law enforcement, and first responders. “The crisis or emergency management portion of the BCP should address coordination with regulatory agencies, local and state officials, law enforcement, and first responders.” | FFIEC BCM Booklet, Section V (Crisis or Emergency Management) | in force |
| US | FFIEC | business continuity | The institution should ensure crisis/emergency management scenarios address multi-event disruptions not confined to a single event, facility, or geographic area. “Scenarios should detail disruptions, and not be confined to a single event, facility, or geographic area.” | FFIEC BCM Booklet, Section V (Crisis or Emergency Management) | in force |
| US | FFIEC | business continuity | The institution should address simultaneous disruptions of telecommunications and electronic messaging, including between the entity and third-party service providers, in crisis management plans. “crisis or emergency management plans should address simultaneous disruptions of telecommunications and electronic messaging, including between the entity and third-party service providers.” | FFIEC BCM Booklet, Section V (Crisis or Emergency Management) | in force |
| US | FFIEC | business continuity | Management should designate key personnel authorized to make timely decisions during a crisis or emergency, covering senior management, facilities, HR, media, finance, legal/compliance, and IT/security. “Management should designate key personnel from applicable departments to act during a crisis or emergency situation, commensurate with the entity's size and complexity. Designated personnel should be authorized to make decisions in a timely manner.” | FFIEC BCM Booklet, Section V (Crisis or Emergency Management) | in force |
| US | FFIEC | business continuity | The institution should maintain verified, distributed contact lists and communication protocols enabling contact with personnel across isolated/dispersed locations, including when normal channels are inoperable. “The contact list should be distributed and accessible to key personnel and should be verified and updated regularly...Crisis or emergency management communication protocols should include provisions to contact the entity when normal communication channels are inoperable.” | FFIEC BCM Booklet, Section V (Crisis or Emergency Management) | in force |
| US | FFIEC | business continuity | Enable employees to report their status in a centralized manner and obtain current information during a crisis or emergency. “Procedures should enable employees to report their status in a centralized manner and obtain current information.” | FFIEC BCM Booklet, Section V (Crisis or Emergency Management) | in force |
| US | FFIEC | business continuity | Management should designate a spokesperson(s) for media communications and train personnel to adhere to the plan when approached by news or social media during an incident. “Management should designate a spokesperson(s) to communicate with the news media...Management should train personnel to adhere to the plan when approached by the news media or communicating via social media.” | FFIEC BCM Booklet, Section V (Incident Response / Crisis Management) | in force |
| US | FFIEC | business continuity | Consider pre-planned response scenarios approved by the board and senior management for crisis communications. “Management should consider various, pre-planned response scenarios approved by the board and senior management.” | FFIEC BCM Booklet, Section V (Crisis or Emergency Management) | in force |
| US | FFIEC | business continuity | Management should implement a business continuity training program for all stakeholders covering resilience goals, policies, and individual roles and responsibilities. “Management should include training as part of an effective business continuity program to educate stakeholders on resilience, business continuity goals, corporate-wide objectives, policies, and individual personnel roles and responsibilities.” | FFIEC BCM Booklet, Section VI (Training) | in force |
| US | FFIEC | business continuity | The BCM training program should align with the entity's strategy using a comprehensive, risk-based, multi-year approach including disaster recovery and third-party risk management. “The training program should align with the entity's strategy and use a comprehensive, risk-based, multi-year approach, including interrelated programs (e.g., disaster recovery and third-party risk management).” | FFIEC BCM Booklet, Section VI (Training) | in force |
| US | FFIEC | business continuity | Management should inventory current BCM skill sets, identify gaps, and address them; incorporate BCM goals into performance management where appropriate. “Management should take inventory of the current skill sets for business continuity and identify and address any gaps. When appropriate, management should establish goals and objectives for supporting the entity's business continuity program as part of the performance management…” | FFIEC BCM Booklet, Section VI (Training) | in force |
| US | FFIEC | business continuity | The institution should train personnel on BCP activation conditions and actions when key personnel are unavailable, including cross-training to compensate for significant absenteeism. “The training program should include conditions for activating the BCP and what to do when key personnel are unavailable...Role-based training includes cross-training personnel to compensate for significant absenteeism or operational disruptions.” | FFIEC BCM Booklet, Section VI (Training) | in force |
| US | FFIEC | business continuity | The institution should provide regular board-level BCM training, including on testing initiatives and key BCM reports, with increased frequency following significant changes, BIA updates, or incident lessons learned. “The board should understand the business continuity program, testing initiatives, and key business continuity-related reports. Board training should occur regularly, or more frequently, based on significant changes to business processes, risks, BIA results, or lessons learned…” | FFIEC BCM Booklet, Section VI (Training) | in force |
| US | FFIEC | business continuity | Contractors involved with the BCM program should receive appropriate business continuity training. “When applicable, contractors involved with the business continuity program should also receive appropriate training.” | FFIEC BCM Booklet, Section VI (Training) | in force |
| US | FFIEC | business continuity | Management should develop a comprehensive exercise and testing program with objectives and plans to validate the entity's ability to restore critical business functions. “Management should develop a comprehensive exercise and testing program including objectives, and plans to validate the entity's ability to restore critical business functions.” | FFIEC BCM Booklet, Section VII.A (Exercise and Test Program) | in force |
| US | FFIEC | business continuity | The institution should maintain a consolidated exercise and test schedule reflective of the entity's exercise universe, risk profile, and objectives, with exercises at appropriate intervals and when significant changes occur. “Exercises and tests should occur either at appropriate intervals, when new risks are identified, or when significant changes affect the entity's operating environment. Significant changes can render existing test plans obsolete, so BCP(s) should be retested soon after the change.” | FFIEC BCM Booklet, Section VII.A (Exercise and Test Program) | in force |
| US | FFIEC | business continuity | Management should designate personnel with authority to control exercises/tests, confirm milestones, and provide for emergency stops if a real-life event occurs during an exercise. “Management should designate personnel with the authority to control the exercise or test and confirm milestones are met...Provisions for emergency stops (i.e., management's authority to stop an exercise if a real-life event occurs).” | FFIEC BCM Booklet, Section VII.A (Exercise and Test Program) | in force |
| US | FFIEC | business continuity | Business line management should assign ownership and accountability for testing resilience of business operations, applications, and processes, coordinating with enterprise-wide BCM and support functions. “Business line management should retain ownership and accountability for testing resilience of business operations, including applications and processes (both internal and external).” | FFIEC BCM Booklet, Section VII.A (Exercise and Test Program) | in force |
| US | FFIEC | business continuity | Exercise and test results should be reported to the board and senior management for inclusion in the enterprise-wide BCM process. “Results should be reported to the board and senior management for inclusion in the enterprise-wide business continuity process.” | FFIEC BCM Booklet, Section VII.A (Exercise and Test Program) | in force |
| US | FFIEC | business continuity | The exercise and test program should include a policy with strategies and expectations, roles/responsibilities, sufficient personnel, data safeguards, and verification of continuity assumptions under adverse conditions. “the exercise and test program should incorporate the following: A policy that includes strategies and expectations for exercise and test planning. Roles and responsibilities for implementation. Sufficient personnel to perform the exercise or test, provide oversight, and document…” | FFIEC BCM Booklet, Section VII.A (Exercise and Test Program) | in force |
| US | FFIEC | business continuity | Include exercises and tests related to interaction with third parties, industry-wide testing, and core and significant firms. “Exercises and tests related to interaction with third parties, industry-wide testing, and core and significant firms.” | FFIEC BCM Booklet, Section VII (Exercises and Tests - Action Summary) | in force |
| US | FFIEC | business continuity | Document issues identified through exercises and tests, including action plans and target dates for resolution. “Documentation of issues identified through exercises and tests, and action plans and target dates for resolution.” | FFIEC BCM Booklet, Section VII (Exercises and Tests - Action Summary) | in force |
| US | FFIEC | business continuity | Management should develop a testing process that validates the effectiveness of the entity's business continuity program and identifies deficiencies. “A key objective for management should be to develop a testing process that validates the effectiveness of the entity's business continuity program, and identifies any deficiencies that may exist.” | FFIEC BCM Booklet, Section VII (Exercise and Test Program) | in force |
| US | FFIEC | business continuity | The institution should establish an exercise and test policy that includes strategies and expectations for exercise and test planning, roles and responsibilities, and minimum frequency, scope, and reporting requirements. “The entity's policies should define exercise and testing expectations and strategies. The policies should: Identify key roles and responsibilities. Establish minimum frequency, scope, and reporting requirements.” | FFIEC BCM Booklet, Section VII.B | in force |
| US | FFIEC | business continuity | Include in the exercise and test policy a process for correcting deficiencies identified during exercises or tests. “Include a process for correcting deficiencies identified during exercises or tests.” | FFIEC BCM Booklet, Section VII.B | in force |
| US | FFIEC | business continuity | Address testing of communication and connectivity between the entity and third-party service providers in the exercise and test policy. “Address testing of communication and connectivity between the entity and third-party service providers. Detail participation with critical third-party service providers to confirm that entity personnel understand integration with recovery processes.” | FFIEC BCM Booklet, Section VII.B | in force |
| US | FFIEC | business continuity | Management should develop exercise and testing strategies that demonstrate the entity's ability to support connectivity, functionality, volume, and capacity using alternate facilities, encompassing internal and external dependencies including outsourced activities. “Management should develop exercise and testing strategies that demonstrate the entity's ability to support connectivity, functionality, volume, and capacity using alternate facilities... Testing strategies should encompass internal and external dependencies, including activities…” | FFIEC BCM Booklet, Section VII.C | in force |
| US | FFIEC | business continuity | Management should test all aspects of the entity's BCP, including transaction processing and functional testing for critical business functions to assess recoverability of infrastructure, capacity, and data integrity. “Management should test all aspects of the entity's BCP... for critical business functions, testing strategies should include transaction processing and functional testing to assess the recoverability of infrastructure, capacity, and data integrity.” | FFIEC BCM Booklet, Section VII.C | in force |
| US | FFIEC | business continuity | Management should regularly test recovery provisions commensurate with the risk to the entity and, where applicable, the overall financial service sector. “management should regularly test recovery provisions commensurate with the risk to the entity and, where applicable, the overall financial service sector.” | FFIEC BCM Booklet, Section VII.C | in force |
| US | FFIEC | business continuity | Ensure exercise and test objectives include demonstrating that critical services can be recovered within agreed-upon RTOs, RPOs, customer SLAs, and within MTDs. “Demonstrate that critical services can be recovered within agreed upon recovery objectives (RTOs and RPOs), including customer SLAs, and within MTDs.” | FFIEC BCM Booklet, Section VII.D | in force |
| US | FFIEC | business continuity | Establish that critical services can be restored in the event of an incident at the recovery location, and build confidence that resilience and recovery strategies meet business requirements. “Establish that critical services can be restored in the event of an incident at the recovery location. Build confidence that resilience and recovery strategies meet business requirements.” | FFIEC BCM Booklet, Section VII.D | in force |
| US | FFIEC | business continuity | Confirm exercise and test plans remain compatible with the BCP and the entity's infrastructure, and identify gaps and deficiencies through testing. “Confirm exercise and test plans remain compatible with the BCP and the entity's infrastructure. Identify gaps and deficiencies.” | FFIEC BCM Booklet, Section VII.D | in force |
| US | FFIEC | business continuity | Exercise and test plans should be developed commensurate with nature, scale, and complexity of recovery objectives, including metrics to assess whether objectives are met, and roles/responsibilities for participants. “Exercise and test plans should be commensurate with the nature, scale, and complexity of the recovery objectives. Exercises and test plans should include metrics to assess whether objectives are met. Plans should identify roles and responsibilities for participants, support…” | FFIEC BCM Booklet, Section VII.E | in force |
| US | FFIEC | business continuity | Management should receive and review third-party service provider exercise results, evaluate their resilience and ability to recover critical services, and incorporate findings into the entity's BCP. “Management should receive and review third-party service provider exercise results, regardless of the entity's extent of participation. Management should consider the scope and results of these exercises in the entity's BCP. Management should evaluate third-party service…” | FFIEC BCM Booklet, Section VII.E | in force |
| US | FFIEC | business continuity | Test plans must include a consolidated exercise and test schedule, specific objectives and methods, identification of decision makers and succession plans, escalation procedures, and metrics to measure success or failure. “A consolidated exercise and test schedule that encompasses all objectives. A specific description of objectives and methods. Identification of decision makers and succession plans... Exercise and test escalation procedures... Metrics to measure the success or failure of the…” | FFIEC BCM Booklet, Section VII.E | in force |
| US | FFIEC | business continuity | Management should review exercise and test results, update the BCP where appropriate, and report results to the board or board-designated committee. “Management should review the exercise and test results, update the BCP where appropriate, and report the results to the board or board-designated committee.” | FFIEC BCM Booklet, Section VII.E | in force |
| US | FFIEC | business continuity | Suggestions for improving test scenarios, plans, or scripts from participants should be incorporated into the testing cycle where appropriate. “Suggestions for improving test scenarios, plans, or scripts provided by test participants should be incorporated into the testing cycle, where appropriate.” | FFIEC BCM Booklet, Section VII.E | in force |
| US | FFIEC | business continuity | Management should develop realistic exercise and test scenarios based on risks that simulate disruptions, including threats affecting third-party service providers, and identify and document assumptions used in each scenario. “Management should develop realistic exercise and test scenarios, based on risks... Management should identify and document assumptions used in developing each scenario. The scenarios should include threats that could affect third-party service providers and others.” | FFIEC BCM Booklet, Section VII.F | in force |
| US | FFIEC | business continuity | Include cyber-related event scenarios in exercises and tests, such as isolated malware attacks, DDoS attacks, data corruption, and full-scale data center outages. “Cyber-related events (e.g., isolated malware attack, DDoS attack, data corruption, or a full-scale data center outage).” | FFIEC BCM Booklet, Section VII.F | in force |
| US | FFIEC | business continuity | Include scenarios involving simultaneous attacks affecting both the entity and a third-party service provider. “Simultaneous attacks affecting both the entity and a third-party service provider.” | FFIEC BCM Booklet, Section VII.F | in force |
| US | FFIEC | business continuity | Consider all reasonably foreseeable risks to connectivity and SLAs between the entity's facilities, third-party service provider facilities, and applicable counterparties in scenario development. “Management should consider all reasonably foreseeable risks to connectivity and service-level agreements between the entity's facility(ies), third-party service provider facilities, and with any applicable counterparties.” | FFIEC BCM Booklet, Section VII.F | in force |
| US | FFIEC | business continuity | Include exercises that use mirrored sites to demonstrate that alternate sites can effectively support customer-specific requirements, work volumes, and site-specific business processes. “Use of mirrored sites to demonstrate that alternate sites can effectively support customer-specific requirements, work volumes, and site-specific business processes.” | FFIEC BCM Booklet, Section VII.F | in force |
| US | FFIEC | business continuity | Scenarios must include processing a full day's work at peak volumes to verify capacity at alternate sites. “Processing a full day's work at peak volumes.” | FFIEC BCM Booklet, Section VII.F | in force |
| US | FFIEC | business continuity | Scenarios should include only resources that would be available during an event, and should verify the integrity of data backups (including access to encrypted data) and adequacy of off-site systems and supplies. “scenarios should include only resources that would be available during an event... helps management verify the integrity of data backups (including access to encrypted data) and the adequacy of off-site systems and supplies.” | FFIEC BCM Booklet, Section VII.F | in force |
| US | FFIEC | business continuity | Management should develop exercise and test scripts that document procedures, sequential steps, manual work-around processes, schedules, and methods for recording results and quantifiable metrics. “Management should develop exercise and test scripts to guide participants and meet objectives. Each script should document the procedures... Sequential steps for employees or external parties to perform... Procedures to guide manual work-around processes. A detailed schedule...…” | FFIEC BCM Booklet, Section VII.F | in force |
| US | FFIEC | business continuity | Use exercises and tests to validate continuity and resilience of technology components—systems, networks, applications, and data—that support critical business functions, with method rigor determined by entity size, complexity, and business nature. “Exercises and tests help management validate continuity and resilience of technology components, including systems, networks, applications, and data, that support critical business functions. The type or combination of methods should be determined by the entity's size and…” | FFIEC BCM Booklet, Section VII.G | in force |
| US | FFIEC | business continuity | Use rigorous exercise methods with increased frequency to provide greater confidence in continuity and resilience of business functions, and use one of the more thorough testing methods to verify BCP viability for all critical functions and applications. “Rigorous exercise methods and increased frequency help provide greater confidence in the continuity and resilience of business functions... management should use one of the more thorough testing methods discussed in this section to verify the BCP's viability.” | FFIEC BCM Booklet, Section VII.G | in force |
| US | FFIEC | business continuity | Conduct full-scale exercises to validate internal and external interdependencies between critical business functions, information systems, and networks, including transaction processing and functional testing. “Full-scale exercises help management validate internal and external interdependencies between critical business functions, information systems, and networks (e.g., for critical functions, exercises should include transaction processing and functional testing).” | FFIEC BCM Booklet, Section VII.G (Full-Scale Exercise) | in force |
| US | FFIEC | business continuity | Management should periodically reassess and update exercise and test plans to reflect changes in the business and operating environment. “Management should periodically reassess and update exercise and test plans to reflect changes in the business and operating environment.” | FFIEC BCM Booklet, Section VII.G (Full-Scale Exercise) | in force |
| US | FFIEC | business continuity | Full-scale exercises must simulate complete loss of primary facilities and include recovery exercises over sufficient time to allow issues to unfold as they would in a crisis. “A full-recovery exercise might simulate the complete loss of primary facilities... Performing recovery exercises over a sufficient length of time to allow issues to unfold as they would in a crisis.” | FFIEC BCM Booklet, Section VII.G (Full-Scale Exercise) | in force |
| US | FFIEC | business continuity | Maintain an exercise and test universe composed of an inventory of all business processes and system components to identify areas for exercise and test planning. “an entity's exercise and test universe is composed of an inventory of all business processes and system components that are compiled and maintained to identify areas for the exercise and test planning process.” | FFIEC BCM Booklet, Section VII (footnote 39) | in force |
| US | FFIEC | business continuity | Include precautions in exercises and tests to safeguard production data, such as performing a backup before testing or testing during non-peak hours. “Precautions to safeguard production data, such as performing a backup before performing a test in a test environment, or testing during non-peak hours.” | FFIEC BCM Booklet, Section VII (Exercise and Test Program) | in force |
| US | FFIEC | business continuity | Establish provisions for emergency stops and conclude exercises and tests if a real-life event occurs, including management's authority to halt an exercise. “Provisions for emergency stops (i.e., management's authority to stop an exercise if a real-life event occurs) and concluding exercises and tests.” | FFIEC BCM Booklet, Section VII (Exercise and Test Program) | in force |
| US | FFIEC | business continuity | Conduct independent review (internal and external) of the business continuity program and exercises and tests. “Independent review of business continuity program and exercises and tests (internal and external).” | FFIEC BCM Booklet, Section VII (Exercise and Test Program) | in force |
| US | FFIEC | business continuity | As the exercise and test process matures, it should increase complexity up to and including full-scale recovery exercises; exercises should be sufficiently thorough to test dependencies and interrelationships among systems and third-party service providers. “As the exercise and test process matures, it should become increasingly complex up to and including full-scale recovery exercises. Exercises should be sufficiently thorough to test dependencies and interrelationships among systems and third-party service providers.” | FFIEC BCM Booklet, Section VII.D | in force |
| US | FFIEC | business continuity | Conduct exercises that validate the crisis or emergency management process, management response and decision-making capability, and communication protocols. “Validating the crisis or emergency management process is operating as designed. Validating management response and decision-making capability... Validating communication protocols.” | FFIEC BCM Booklet, Section VII.G (Full-Scale Exercise) | in force |
| US | FFIEC | business continuity | Exercise communication processes with applicable stakeholders in exercises and tests, including connectivity to third-party and counterparty facilities. “Exercises and tests should include communication processes with applicable stakeholders.” | FFIEC BCM Booklet, Section VII.F | in force |
| US | FFIEC | business continuity | Management must use tests to verify quantifiable performance and reliability of system resilience, validating RPOs, RTOs, and MTDs, and ensuring systems support critical business processes. “Management uses tests to verify the quantifiable performance and reliability of system resilience. The goal of testing is to determine whether system resilience conforms to the BCP and stated recovery objectives.” | FFIEC BCM Booklet, Section VII (Tests subsection) | in force |
| US | FFIEC | business continuity | Management should define test success criteria including validating RPOs, RTOs, and MTDs; demonstrating recoverability at peak volumes; confirming systems support critical business processes; integrating recovery technologies; testing backup data integrity; certifying facility controls; and verifying workspace restoration. “Management should clearly define the characteristics of a successful test, which may include the following: Validating RPOs, RTOs, and MTDs. Demonstrating recoverability at peak volumes. Confirming that systems can support critical business processes.” | FFIEC BCM Booklet, Section VII (Tests subsection) | in force |
| US | FFIEC | business continuity | Management should include third-party service providers in the enterprise-wide exercise and testing program based on criticality of the provider and business function. “Third-party service providers deliver critical services to many entities and should be included in the enterprise-wide exercise and testing program. The extent of inclusion in the entity's program should be based on the criticality of the third-party service provider and the…” | FFIEC BCM Booklet, Section VII.I | in force |
| US | FFIEC | business continuity | Management should obtain assurance that third-party service providers are resilient and have adequate infrastructure and personnel to restore critical services consistent with business and contractual requirements. “Management should obtain assurance that third-party service providers are resilient and have adequate infrastructure and personnel to restore critical services consistent with business and contractual requirements.” | FFIEC BCM Booklet, Section VII.I | in force |
| US | FFIEC | business continuity | Management should include the right to perform or participate in testing with third-party service providers in the governing contract. “The right to perform or participate in testing with third-party service providers should be included in the contract governing the entity's relationship with the third party.” | FFIEC BCM Booklet, Section VII.I | in force |
| US | FFIEC | business continuity | Management should actively participate in third-party service providers' testing programs and should verify that testing strategies include likely significant disruptive events. “Management should actively participate in the entity's third-party service providers' testing programs and should verify that testing strategies include likely significant disruptive events.” | FFIEC BCM Booklet, Section VII.I | in force |
| US | FFIEC | business continuity | Management should request and receive test results and reports, remediation action plans and status reports, and related analysis or modeling from third-party service providers. “Management should request and receive test results and reports, remediation action plans and status reports upon their completion, and related analysis or modeling.” | FFIEC BCM Booklet, Section VII.I | in force |
| US | FFIEC | business continuity | Management should track and resolve issues identified during third-party exercises in a timely manner according to severity, and should present any test results affecting the entity to the board. “Management should track and resolve any issues identified during the exercise in a timely manner, according to the severity of the issues. Any test results that affect the entity should be presented to its board.” | FFIEC BCM Booklet, Section VII.I | in force |
| US | FFIEC | business continuity | Management at core and significant firms should develop verification strategies and execute exercise and testing activities validating sound recovery practices consistent with the entity's industry role, including considering impact on the entire financial sector. “Management at core and significant firms should develop verification strategies and execute exercise and testing activities to validate that the entity implemented sound recovery practices consistent with the entity's role in the industry.” | FFIEC BCM Booklet, Section VII.J | in force |
| US | FFIEC | business continuity | Core and significant firms should include systems supporting critical market activities in internal testing and should confirm that critical clearing and settlement activities can be recovered within RTOs. “Internal testing activities should include systems that support critical market activities in which these firms are core or significant. Exercise and testing activities should confirm that such critical clearing and settlement activities could be recovered within RTOs.” | FFIEC BCM Booklet, Section VII.J | in force |
| US | FFIEC | business continuity | Core and significant firms must adjust RTOs to align with industry standard time frames, which are continually updated based on available technology, pertinent risks, and industry initiatives. “Industry standard time frames are continually adjusted based on available technology, pertinent risks, and industry initiatives. Management should adjust its RTOs to be in line with industry standard time frames.” | FFIEC BCM Booklet, Section VII.J | in force |
| US | FFIEC | business continuity | Core and significant firms should design testing activities to demonstrate ability to complete pending material payments/transactions, access funding, manage open risk positions, make book entries, validate communication protocols, and ensure connectivity/volume capacity during wide-scale disruption affecting key personnel. “Management should design testing activities to demonstrate the ability to perform the following activities if a wide-scale disruption affects the accessibility of key personnel: Complete pending material payments and transactions. Access funding. Manage material open risk…” | FFIEC BCM Booklet, Section VII.J | in force |
| US | FFIEC | business continuity | Core and significant firms should test connectivity with relevant core firms from their alternate sites and meet testing standards established by core firms for significant firms and general participants. “Management should test with the relevant core firms from their alternate sites and meet testing standards the core firms establish specifically for significant firms and for participants more generally.” | FFIEC BCM Booklet, Section VII.J | in force |
| US | FFIEC | business continuity | Core and significant firms are encouraged, to the extent practical, to participate in market-wide and cross-market tests validating connectivity from alternate sites including transaction, settlement, and payment processes. “Management is also encouraged, to the extent practical, to participate in pertinent market-wide and cross-market tests that validate connectivity from alternate sites and include transaction, settlement, and payment processes.” | FFIEC BCM Booklet, Section VII.J | in force |
| US | FFIEC | business continuity | Management should document issues identified during exercises and tests, create action plans with target dates for resolution, and report results to appropriate levels of management. “Management should document issues identified during exercises and tests and create action plans with target dates for resolving issues. Exercise and test results should be analyzed and compared with the objectives and success criteria in the exercise and test plans, and reported…” | FFIEC BCM Booklet, Section VII.K | in force |
| US | FFIEC | business continuity | Management should document decisions to accept risks identified during exercises for items not remediated, and should test corrective actions implemented after failed recovery objectives or major issues. “For those items not remediated, management should document decisions to accept risks identified during the exercises. Additionally, management should test corrective actions implemented as a result of a failed recovery objective or to address major issues encountered.” | FFIEC BCM Booklet, Section VII.K | in force |
| US | FFIEC | business continuity | Business line management should update the BCP based on test results and adjust the BCM process including the exercise and testing program following exercises. “Business line management should update the BCP based on test results and adjust the BCM process, including the exercise and testing program.” | FFIEC BCM Booklet, Section VII.K | in force |
| US | FFIEC | business continuity | Management should submit regular reports to the board on exercise and testing activities and whether the BCP meets the entity's recovery and resilience objectives. “Management should submit regular reports to the board on the exercise and testing activities and whether the BCP meets the entity's recovery and resilience objectives.” | FFIEC BCM Booklet, Section VII.K | in force |
| US | FFIEC | business continuity | Exercise and test documentation may include dates and locations, an executive summary comparing objectives and results, material deviations, problems and lessons learned, and assignment of responsibility for issue resolution. “Exercise and test results may include the following documentation: Dates and locations. An executive summary comparing objectives and results. Material deviations from the plans...Problems identified and lessons learned. Assignment of responsibility for timely resolution.” | FFIEC BCM Booklet, Section VII.K | in force |
| US | FFIEC | business continuity | Management should periodically analyze exercise and test results and issues to identify common root causes and implement fixes at the root cause level. “Management should periodically analyze results and issues to determine whether problems can be traced to a common source, such as inadequate change control procedures. Fixing the root cause of the problem may help resolve many underlying issues.” | FFIEC BCM Booklet, Section VII.K | in force |
| US | FFIEC | business continuity | Management should regularly review and update the business continuity program to reflect the current environment, triggered by changes in strategy, infrastructure, third-party services, legislation, threat landscape, or exercise results. “Because risks and technology often change, management should regularly review and update the business continuity program to reflect the current environment. Periodic reviews allow management to align the business continuity processes with business objectives.” | FFIEC BCM Booklet, Section VIII | in force |
| US | FFIEC | business continuity | BCM program personnel should contact business unit managers regularly to assess changes to business, structure, systems, software, hardware, personnel, or facilities to determine extent of changes needed to the BCM program. “BCM program personnel should contact business unit managers regularly to assess the nature of any changes to the business, structure, systems, software, hardware, personnel, or facilities.” | FFIEC BCM Booklet, Section VIII | in force |
| US | FFIEC | business continuity | The business continuity program should be reviewed for accuracy and completeness at periodic intervals, covering operational requirements, security requirements, technical procedures, hardware/software, contact information, facility requirements, and vital records. “The business continuity program should be reviewed for accuracy and completeness at periodic intervals. Likely areas that should be adjusted within the BCP may include: Operational requirements. Security requirements. Technical procedures. Hardware, software, and other equipment.” | FFIEC BCM Booklet, Section VIII | in force |
| US | FFIEC | business continuity | When updating the business continuity program, management should document, track, and resolve any changes, and should document, analyze, and review lessons learned from adverse events including identifying failures, causes, solutions, corrective actions, and recording outcomes. “When updating the business continuity program, management should document, track, and resolve any changes. Management should document, analyze, and review lessons learned from adverse events.” | FFIEC BCM Booklet, Section VIII | in force |
| US | FFIEC | business continuity | Management should maintain version control of key business continuity documents and ensure latest versions are readily available to appropriate personnel, including accessibility during an event. “Management should maintain version control of key business continuity documents and ensure that the latest versions are readily available to appropriate personnel...This information should be accessible during an event.” | FFIEC BCM Booklet, Section VIII | in force |
| US | FFIEC | business continuity | BCM documentation should include evidence substantiating periodic updates of the BIA, risk assessment, and BCP(s). “The BCM documentation should include evidence substantiating periodic updates of the BIA, risk assessment, and BCP(s).” | FFIEC BCM Booklet, Section VIII | in force |
| US | FFIEC | business continuity | Management should follow the entity's information security standards for confidential or sensitive information within business continuity documentation. [adjacent] “Management should follow the entity's information security standards for confidential or sensitive information contained within business continuity documentation.” | FFIEC BCM Booklet, Section VIII | in force |
| US | FFIEC | business continuity | Management should maintain backup copies of relevant business continuity documentation in the event the primary repository becomes inaccessible. “Management should maintain backup copies of relevant business continuity documentation in the event that the primary repository becomes inaccessible.” | FFIEC BCM Booklet, Section VIII | in force |
| US | FFIEC | business continuity | The board should establish expectations for management's business continuity reporting, regularly monitor business continuity and resilience activities, and provide credible challenges to management. “The board should establish expectations for management's business continuity reporting, regularly monitor business continuity and resilience activities, and provide credible challenges to management.” | FFIEC BCM Booklet, Section IX | in force |
| US | FFIEC | business continuity | Management must conduct limited-scale exercises simulating recovery of targeted business processes to determine whether systems can be recovered and personnel understand their BCP responsibilities. “A limited-scale exercise is a simulation involving applicable resources (personnel and systems) to recover targeted business processes. The goal of a limited-scale exercise is to determine whether targeted systems can be recovered and whether personnel understand their…” | FFIEC BCM Booklet, Section VII (Limited-Scale Exercise subsection) | in force |
| US | FFIEC | business continuity | Management must conduct tabletop exercises reviewing BCP-defined roles and discussing responses during adverse event simulations to validate plan reasonableness and departmental compatibility. “A tabletop exercise...is a discussion during which personnel review their BCP-defined roles and discuss their responses during an adverse event simulation. The goal of a tabletop exercise is to determine whether targeted plans and procedures are reasonable, personnel understand…” | FFIEC BCM Booklet, Section VII (Tabletop Exercise subsection) | in force |
| US | FFIEC | business continuity | Management should consider participating in industry exercises (e.g., FS-ISAC, Treasury Hamilton Series) to verify resilience across the financial industry and validate the entity's own response capabilities. “Public and private sector groups conduct exercises with their members to verify resilience across the financial industry...members are encouraged to use backup sites and test their recovery capabilities.” | FFIEC BCM Booklet, Section VII.H | in force |
| US | FFIEC | business continuity | Management should maintain backup copies of relevant business continuity documentation in the event the primary repository becomes inaccessible. “management should maintain backup copies of relevant business continuity documentation in the event that the primary repository becomes inaccessible.” | FFIEC BCM Booklet, BCM Documentation section | in force |
| US | FFIEC | business continuity | BCM documentation should be accessible during an event and maintained by BCM program management and personnel. “This information should be accessible during an event and can be maintained by BCM program management and personnel.” | FFIEC BCM Booklet, BCM Documentation section | in force |
| US | FFIEC | business continuity | BCM documentation should be maintained to include evidence substantiating periodic updates of the BIA, risk assessment, and BCP(s). “The BCM documentation should include evidence substantiating periodic updates of the BIA, risk assessment, and BCP(s).” | FFIEF BCM Booklet, BCM Documentation section | in force |
| US | FFIEC | business continuity | Management should apply information security standards to confidential or sensitive information contained within business continuity documentation. [adjacent] “Management should follow the entity's information security standards for confidential or sensitive information contained within business continuity documentation.” | FFIEC BCM Booklet, BCM Documentation section | in force |
| US | FFIEC | business continuity | The board should establish expectations for management's business continuity reporting and regularly monitor business continuity and resilience activities. “The board should establish expectations for management's business continuity reporting, regularly monitor business continuity and resilience activities, and provide credible challenges to management.” | FFIEC BCM Booklet, Section IX (Board Reporting) | in force |
| US | FFIEC | business continuity | Management should report to the board on the status of business continuity, including BIA, risk assessment, BCP, exercise and test results, and identified issues. “Reports should include a written presentation providing the BIA, risk assessment, BCP, exercise and test results, and identified issues.” | FFIEC BCM Booklet, Section IX (Board Reporting) | in force |
| US | FFIEC | business continuity | Management should provide regular strategy updates to the board based on changes in personnel, roles, responsibilities, and business operations. [adjacent] “reports should include regular strategy updates based on changes in personnel, roles and responsibilities, and business operations.” | FFIEC BCM Booklet, Section IX (Board Reporting) | in force |
| US | FFIEC | business continuity | The board should be updated in a timely manner based on lessons learned from business continuity events and exercises. “The board should be updated in a timely manner based on lessons learned.” | FFIEC BCM Booklet, Section IX (Board Reporting) | in force |
| US | FFIEC | business continuity | Board minutes should reflect business continuity discussions, including credible challenges, and approvals. “Board minutes should reflect business continuity discussion (including credible challenges) and approvals.” | FFIEC BCM Booklet, Section IX (Board Reporting) | in force |
| US | FFIEC | business continuity | Examined on whether business continuity policies and critical business procedures are up-to-date, reflective of the current business environment, communicated effectively, available during adverse events, and securely maintained. “Determine whether business continuity policies and critical business procedures are: a. Up-to-date and reflective of the current business environment. b. Communicated effectively...c. Available during adverse events. d. Securely maintained.” | FFIEC BCM Booklet, Appendix A, Objective 2(1) | in force |
| US | FFIEC | business continuity | Examined on whether board and senior management evaluate continuity risk, set short- and long-term continuity objectives, adopt appropriate policies, evaluate continuity performance, and adjust programs in response to test results and actual events. “Determine whether the board and senior management provide leadership when overseeing business continuity, including: a. Evaluating continuity risk. b. Setting short- and long-term continuity objectives...e. Adjusting programs and operations in response to test results and actual…” | FFIEC BCM Booklet, Appendix A, Objective 2(2) | in force |
| US | FFIEC | business continuity | Examined on whether management strengthens resilience by assessing continuity risk, resilience planning, testing BCPs, incorporating lessons learned, and considering resilience in business functions and design of operations and new products/services. “Determine whether management strengthens resilience through the following: a. Assessing continuity risk. b. Resilience planning. c. Testing business continuity plans. d. Incorporating lessons learned...e. Considering resilience in business functions and the design of existing…” | FFIEC BCM Booklet, Appendix A, Objective 2(3) | in force |
| US | FFIEC | business continuity | Examined on whether board oversight includes assigning BCM responsibility and accountability, allocating resources, aligning BCM with strategy and risk appetite, and establishing provision for management intervention if corrective action timeliness is not met. “Determine whether board oversight includes...g. Establishing a provision for management intervention if timeliness for corrective action is not met.” | FFIEC BCM Booklet, Appendix A, Objective 2(4) | in force |
| US | FFIEC | business continuity | Management must regularly meet to discuss policy changes, testing plans, and training, and assess/update BCM strategies and plans to reflect current conditions for continuous improvement. “h. Meeting regularly to discuss policy changes, testing plans, and training. i. Assessing and updating business continuity strategies and plans to reflect the current business conditions and operating environment for continuous improvement.” | FFIEC BCM Booklet, Appendix A, Objective 2(5)(h)(i) | in force |
| US | FFIEC | business continuity | Management must align BCM plans between business units across the enterprise and coordinate plans and responses with external entities. “j. Aligning plans between business units across the enterprise. k. Coordinating plans and responses with external entities.” | FFIEC BCM Booklet, Appendix A, Objective 2(5)(j)(k) | in force |
| US | FFIEC | business continuity | Examined on whether board and senior management engage audit or independent review to validate design and operating effectiveness of the BCM program, including coverage of BIA, risk assessment, resilience controls, and testing. “Determine whether the board and senior management have engaged audit (or an independent review) to validate the design effectiveness of the business continuity program and whether controls are operating effectively.” | FFIEC BCM Booklet, Appendix A, Objective 3 | in force |
| US | FFIEC | business continuity | Examined on whether audit reports to the board and provides an assessment of management's ability to manage and control risks related to continuity and resilience. [adjacent] “Determine whether audit reports to the board and provides an assessment of management's ability to manage and control risks related to continuity and resilience.” | FFIEC BCM Booklet, Appendix A, Objective 3(2) | in force |
| US | FFIEC | business continuity | Audit coverage of BCM should include reasonableness of BIA and risk assessment, reliability and effectiveness of continuity/resilience controls, effectiveness of risk mitigation, test plan adequacy, and monitoring and escalation of exercise issues. “Audit coverage should include the following: a. The reasonableness and comprehensiveness of the BIA...b. The reliability, adequacy, and effectiveness of continuity and resilience controls...d. Whether test plans achieve their stated objectives...e. Audit monitoring of exercises…” | FFIEC BCM Booklet, Appendix A, Objective 3(5) | in force |
| US | FFIEC | business continuity | Examined on whether management conducts an interdependency analysis covering internal systems and business functions, third-party service providers, key suppliers, business partners, and telecommunications and power single points of failure. “Determine whether the interdependency analysis includes: a. Internal systems and business functions...b. Third-party service providers, key suppliers, and business partners. c. Telecommunications single points of failure. d. Power single points of failure.” | FFIEC BCM Booklet, Appendix A, Objective 4(3) | in force |
| US | FFIEC | business continuity | Examined on whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of all reasonably foreseeable hazards and threats to continuity and resilience, including natural, technological, adversarial, and combination risks. “Review risk assessment(s) to determine whether management has identified all reasonably foreseeable hazards and threats to the continuity and resilience of the entity.” | FFIEC BCM Booklet, Appendix A, Objective 5(1) | in force |
| US | FFIEC | business continuity | Examined on whether the risk assessment includes the impact and likelihood of potential disruptive events, including worst-case scenarios, and identifies and analyzes gaps between risk exposure and risk appetite, with controls documented. “Determine whether the risk assessment includes the impact and likelihood of potential disruptive events, including worst-case scenarios...management identifies and analyzes gaps between the entity's risk exposure and the risk appetite, and documents any controls implemented to…” | FFIEC BCM Booklet, Appendix A, Objective 5(4)(5) | in force |
| US | FFIEC | business continuity | Management must evaluate resilience strategies and resource needs, and allocate appropriate personnel, time, and budget to achieve resilience objectives. “Verify that management has evaluated strategies and resource needs and allocates appropriate resources to achieve resilience: a. Appropriate personnel and skillsets...b. Time to identify and implement solutions. c. Budget to accomplish resilience goals and objectives.” | FFIEC BCM Booklet, Appendix A, Objective 6(1) | in force |
| US | FFIEC | business continuity | Examined on whether management implements physical resilience measures including redundant communications between branches and data centers, multiple power sources, and geographic diversification of key entity locations. “Determine whether management has implemented physical resilience measures that: a. Establish redundant communications between branches and data centers. b. Identify multiple power sources. c. Geographically diversify key entity locations.” | FFIEC BCM Booklet, Appendix A, Objective 6(2) | in force |
| US | FFIEC | business continuity | Examined on whether management implements data and cyber resilience measures maintaining confidentiality, integrity, and availability for backup, replication, and production environments; implements appropriate backups with sufficient documentation and retention; and periodically reassesses backup and recovery strategies as technology… “Determine whether management has implemented data and cyber resilience measures that: a. Maintain confidentiality, integrity, and availability for backup, replication, and production environments. b. Implement appropriate backups and sufficient documentation and retention…” | FFIEC BCM Booklet, Appendix A, Objective 6(3) | in force |
| US | FFIEC | business continuity | Evaluate resilience strategies and resource needs, allocating appropriate personnel, budget, and time to achieve resilience objectives. “Verify that management has evaluated strategies and resource needs and allocates appropriate resources to achieve resilience: a. Appropriate personnel and skillsets to carry out the functions. b. Time to identify and implement solutions. c. Budget to accomplish resilience goals” | FFIEC BCM Booklet, Examination Objective 6, Item 1 | in force |
| US | FFIEC | business continuity | Examined on whether management implements physical resilience measures including redundant branch-to-data-center communications, multiple power sources, and geographic diversification of key locations. “Determine whether management has implemented physical resilience measures that: a. Establish redundant communications between branches and data centers. b. Identify multiple power sources. c. Geographically diversify key entity locations.” | FFIEC BCM Booklet, Examination Objective 6, Item 2 | in force |
| US | FFIEC | business continuity | Implement data and cyber resilience measures maintaining confidentiality, integrity, and availability for backup, replication, and production environments. “Maintain confidentiality, integrity, and availability for backup, replication, and production environments.” | FFIEC BCM Booklet, Examination Objective 6, Item 3(a) | in force |
| US | FFIEC | business continuity | Implement appropriate data backups with sufficient documentation and retention periods for each iteration, and periodically reassess backup and recovery strategies as technology and threats change. “Implement appropriate backups and sufficient documentation and retention periods for each iteration of data backup. c. Periodically reassess backup and recovery strategies as technology and threats change.” | FFIEC BCM Booklet, Examination Objective 6, Items 3(b) and 3(c) | in force |
| US | FFIEC | business continuity | Maintain an accessible, off-site repository of software, configuration settings, and related documentation. “Maintain an accessible, off-site repository of software, configuration settings, and related documentation.” | FFIEC BCM Booklet, Examination Objective 6, Item 3(d) | in force |
| US | FFIEC | business continuity | Establish procedures to recover critical networks and systems, covering backup types, levels, update/retention frequencies, compatibility reviews, data transmission controls, and repository maintenance. “Establish procedures to recover critical networks and systems, including: Backup types (physical or virtual). Backup levels (full, incremental, or differential). Update and retention cycle frequencies. Software and hardware compatibility reviews. Data transmission controls. Data…” | FFIEC BCM Booklet, Examination Objective 6, Item 3(e) | in force |
| US | FFIEC | business continuity | Protect offline data backups from destructive malware that may corrupt production and online backup versions of data. “Protect offline data backups from destructive malware that may corrupt production and online backup versions of data.” | FFIEC BCM Booklet, Examination Objective 6, Item 3(f) | in force |
| US | FFIEC | business continuity | Examined on whether management documents and implements personnel resilience measures including staffing plans, lodging, basic necessities, medical support, secure telework, and designation of emergency personnel for critical business processes. “Determine whether management documented and implemented, as appropriate, the following resilience measures for personnel: a. Staffing and skills needed to operate critical functions related to business continuity... f. Designated emergency personnel, including critical business…” | FFIEC BCM Booklet, Examination Objective 6, Item 4 | in force |
| US | FFIEC | business continuity | Examined on whether management documents and implements resilience measures for third-party service providers, including assessing their resilience capabilities, reviewing SOC/test reports, verifying SLA alignment with recovery objectives, and establishing resilience plans for critical TSPs. “Determine whether management documented and implemented, as appropriate, the following resilience measures for third-party service providers: a. Considered disruptive events that threaten the operational resilience and viability of the entity's third-party service provider... f.…” | FFIEC BCM Booklet, Examination Objective 6, Item 5 | in force |
| US | FFIEC | business continuity | Examined on whether management implements telecommunications resilience measures including identifying single points of failure, maintaining outage plans, establishing redundant links with TSPs, diversifying connections, and monitoring telecom provider relationships. “Determine whether management documented and implemented, as appropriate, the following resilience measures for telecommunications: a. Identifying and mitigating single points of failure across the entity's infrastructure... g. Monitoring relationships with telecommunications…” | FFIEC BCM Booklet, Examination Objective 6, Item 6 | in force |
| US | FFIEC | business continuity | Implement power resilience strategies including alternate energy sources, fuel supply arrangements, and regular generator maintenance and testing. “Determine whether management considers the following as part of the entity's power resilience strategies: a. Alternate energy sources (e.g., generators and multiple power grids). b. Fuel requirements... c. Continued maintenance of generators. d. Testing of generators.” | FFIEC BCM Booklet, Examination Objective 6, Item 7 | in force |
| US | FFIEC | business continuity | Align BCM activities with the entity's change management process. “Verify that BCM activities align with the entity's change management process.” | FFIEC BCM Booklet, Examination Objective 6, Item 8 | in force |
| US | FFIEC | business continuity | Examined on whether, if BCP development is outsourced, management maintains oversight and ownership, verifies TSP qualifications, ensures the plan reflects current products/processes/TSPs, and keeps roles/responsibilities current. “If management outsources the BCP's development, verify that management maintains oversight and ownership of the BCP. a. Determine whether management verified the third-party service provider's qualifications and expertise.” | FFIEC BCM Booklet, Examination Objective 8, Item 2 | in force |
| US | FFIEC | business continuity | Include BCP procedures to establish alternate physical locations for personnel and customers to conduct business during disruptions. “Verify that the BCP includes procedures to establish an alternate physical location(s) where personnel and customers can go to conduct business, if appropriate.” | FFIEC BCM Booklet, Examination Objective 8, Item 7 | in force |
| US | FFIEC | business continuity | Address cash management requirements in the BCP, including pre-established cash delivery, branch traffic plans when ATMs are unavailable, operational cash needs, purchase authority, and emergency expense reimbursement. “Verify that the BCP addresses the entity's cash management requirements. Procedures may include: a. Pre-established cash delivery arrangements. b. Plans for increases in branch traffic when ATMs are unavailable. c. Plans for the entity's operational cash needs.” | FFIEC BCM Booklet, Examination Objective 8, Item 9 | in force |
| US | FFIEC | business continuity | Develop a coordinated disaster recovery strategy for data centers, networks, servers, storage, service monitoring, and user support, with procedures for security controls, backlog restoration, and access to critical information repositories. “Verify that management developed a coordinated disaster recovery strategy for data centers, networks, servers, storage, service monitoring, user support, and related software. Verify that procedures address the following: a. Security controls and protocols... b. Procedures for…” | FFIEC BCM Booklet, Examination Objective 8, Item 11 | in force |
| US | FFIEC | business continuity | Examined on whether management implements a BCM training program that inventories skillsets, addresses gaps, educates stakeholders on BCM goals/objectives, incorporates exercises, current/future risks, lessons learned, and new technologies, tailored to the target audience. “Verify that the training program aligns with the entity's BCM strategy. Determine whether management does the following: a. Inventories the current skillsets for BCM and identifies and addresses any training gaps... c. Implements a training program to educate stakeholders about…” | FFIEC BCM Booklet, Examination Objective 9, Items 1–2 | in force |
| US | FFIEC | business continuity | Incorporate significant BCM concepts, interdependencies, disruption impacts, and operational resilience into the training program. “Validate that management incorporates significant business continuity concepts, interdependencies, disruption impacts, and operations resilience into the training program.” | FFIEC BCM Booklet, Examination Objective 9, Item 3 | in force |
| US | FFIEC | business continuity | Examined on whether management implements a comprehensive exercise and testing program with defined objectives and plans to validate the entity's ability to restore critical business functions, appropriate to the entity's risk profile. “Determine whether management implemented a comprehensive exercise and testing program, objectives, and plans to validate the entity's ability to restore critical business functions. 2. Verify that the program is appropriate for the entity's risk profile.” | FFIEC BCM Booklet, Examination Objective 10, Items 1–2 | in force |
| US | FFIEC | business continuity | Examined on whether all functions in the exercise and test universe are covered according to established timeframes (e.g., annually or every three years). “Determine whether management covers all of the functions in the exercise and test universe according to its established timeframes (e.g., all processes are covered annually or every three years).” | FFIEC BCM Booklet, Examination Objective 10, Item 3 | in force |
| US | FFIEC | business continuity | Examined on whether worst-case disruption scenarios are included in the BCM risk assessment and whether gaps between risk exposure and risk appetite are analyzed, with documentation of controls implemented to mitigate residual risk. “Determine whether the risk assessment includes the impact and likelihood of potential disruptive events, including worst-case scenarios. 5. Determine whether management identifies and analyzes gaps between the entity's risk exposure and the risk appetite, and documents any…” | FFIEC BCM Booklet, Examination Objective 6 (preamble), Items 4–5 | in force |
| US | FFIEC | business continuity | Examined on whether management assesses the supply chain interconnectivity between the entity and its third-party service providers as part of BCM risk management. “tivity between other entities and their third-party service providers (i.e., supply chain).” | FFIEC BCM Booklet, Examination Objective 6 (preamble), Item (supply chain) | in force |
| US | FFIEC | business continuity | Examined on whether the exercise and testing program is appropriate for the entity's risk profile and that the consolidated schedule reflects the exercise universe. “Verify that the program is appropriate for the entity's risk profile. Assess whether the entity's consolidated exercise and test schedule is reflective of exercise and test objectives and the overall exercise and test universe.” | FFIEC BCM Booklet, Examination Objective 10, Item 2 | in force |
| US | FFIEC | business continuity | Examined on whether all functions in the exercise and test universe are covered according to established timeframes (e.g., annually or every three years). “Determine whether management covers all of the functions in the exercise and test universe according to its established timeframes (e.g., all processes are covered annually or every three years).” | FFIEC BCM Booklet, Examination Objective 10, Item 3 | in force |
| US | FFIEC | business continuity | Ensure business line management retains ownership for testing its specific business processes and coordinates with enterprise BCM personnel. “Verify that business line management retains ownership for testing its specific business processes and coordinates with personnel involved in the enterprise-wide BCM process and support areas.” | FFIEC BCM Booklet, Examination Objective 10, Item 5 | in force |
| US | FFIEC | business continuity | Develop a robust exercise program that includes policy, roles/responsibilities, sufficient personnel, production data safeguards, emergency stop provisions, verification of continuity assumptions, and volume capacity validation. “the exercise program should incorporate the following: a. A policy that includes strategies and expectations...b. Roles and responsibilities...c. Sufficient personnel...d. Precautions to safeguard production data...e. Provisions for emergency stops...f. Verification of…” | FFIEC BCM Booklet, Examination Objective 10, Item 7 | in force |
| US | FFIEC | business continuity | Compare exercise/test results against the BCP to identify gaps and incorporate revisions where appropriate. “Comparison of exercise and test results against the BCP to identify gaps between the exercise or test process and recovery guidelines, with revisions incorporated where appropriate.” | FFIEC BCM Booklet, Examination Objective 10, Item 7(i) | in force |
| US | FFIEC | business continuity | Maintain an exercise and test policy that includes key roles/responsibilities, minimum frequency/scope/reporting, documentation expectations, deficiency correction processes, and third-party communication/connectivity requirements. “Determine whether the exercise and test policy is appropriate and includes the following: a. Key roles and responsibilities. b. Minimum frequency, scope, and reporting. c. Documentation expectations. d. Processes for correcting deficiencies...” | FFIEC BCM Booklet, Examination Objective 10, Item 8 | in force |
| US | FFIEC | business continuity | Develop multi-year exercise plans using different methodologies and scenarios over time, including transaction processing and functional testing for infrastructure, capacity, and data integrity. “c. Multi-year plan(s) to execute the specific depth and breadth of exercises and tests, which use different methodologies and scenarios over time...f. Transaction processing and functional testing to assess the recoverability of infrastructure, capacity, and data integrity.” | FFIEC BCM Booklet, Examination Objective 10, Items 9(c) and 9(f) | in force |
| US | FFIEC | business continuity | Ensure exercise and test objectives include resilience, system monitoring, and recovery of business processes and critical system components. “Verify that exercise and test objectives include resilience, system monitoring, and the recovery of business processes and critical system components.” | FFIEC BCM Booklet, Examination Objective 10, Item 10 | in force |
| US | FFIEC | business continuity | Examined on whether management develops reasonably foreseeable threat scenarios simulating business disruptions, including threats affecting third-party providers and scenarios testing failover and recovery objective validation. “Determine whether management developed reasonably foreseeable threat scenarios that simulate disruptions in business functions...b. Develop scenarios that include threats that could affect third-party service providers...c. Develop exercises that demonstrate not only the ability…” | FFIEC BCM Booklet, Examination Objective 10, Item 13 | in force |
| US | FFIEC | business continuity | Design exercises and tests to validate personnel knowledge/skills, alternate site operations, transaction processing, backup viability, and network connectivity including with critical third-party service providers. “Verify that exercises and tests are designed to do following: a. Validate personnel knowledge and skills...b. Operate and perform duties...from an alternate site...d. Test the viability of both full and incremental backups. e. Test network connectivity and interdependencies…” | FFIEC BCM Booklet, Examination Objective 10, Item 15 | in force |
| US | FFIEC | business continuity | For full-scale exercises, validate crisis/emergency management processes, communication protocols, alternate location activities, backup media processing, and recovery over sufficient time to allow issues to surface. “If management performs full-scale exercises, verify whether the exercise includes the following...b. Validating that the crisis/emergency management process is operating as designed...f. Validating communication protocols. g. Conducting activities at alternate locations or…” | FFIEC BCM Booklet, Examination Objective 10, Item 16 | in force |
| US | FFIEC | business continuity | For limited-scale exercises, verify personnel knowledge, validate management response, test alternate system connectivity, and verify communication and remote access capability. “If management performs limited-scale exercises, verify whether the exercise includes the following...e. Verifying whether participants can connect to alternate system(s)...g. Testing communication and remote access capability (e.g., switching to alternate equipment or…” | FFIEC BCM Booklet, Examination Objective 10, Item 17 | in force |
| US | FFIEC | business continuity | Examined on whether, for tabletop exercises, operational/support personnel are engaged, functional response capabilities are practiced, plan compatibility across departments is validated, and action plans are created to correct identified issues. “If management performs tabletop exercises, determine whether targeted plans and procedures are reasonable, personnel understand their responsibilities, and different departmental or business unit plans are compatible with each other...f. Creating action plans to correct issues.” | FFIEC BCM Booklet, Examination Objective 10, Item 18 | in force |
| US | FFIEC | business continuity | Examined on whether characteristics of a successful test are defined and validated, including RPO/RTO/MTD validation, peak volume recoverability, system integrity, backup data integrity, and facility/workspace controls. “Verify that management clearly defines the characteristics of a successful test, which may include the following: a. Validating RPOs, RTOs, and MTDs. b. Demonstrating recoverability at peak volumes...e. Testing backup data to assess integrity and availability. f. Certifying…” | FFIEC BCM Booklet, Examination Objective 10, Item 19 | in force |
| US | FFIEC | business continuity | Examined on whether exercises and tests with third-party service providers are included in the enterprise exercise program, based on risk prioritization and criticality of services, with coordinated exercises validating both parties' recovery capabilities. “Determine whether exercises and tests with third-party service providers are included in the entity's enterprise exercise and test program based on the risk prioritization of the third-party service provider and the criticality of the services provided to the entity.” | FFIEC BCM Booklet, Examination Objective 10, Item 21 | in force |
| US | FFIEC | business continuity | Conduct coordinated exercises with critical third parties that include reasonably foreseeable significant disruptive events and document scope, execution, and results where direct participation is not possible. “c. Evidence that exercises and tests of critical service providers include reasonably foreseeable significant disruptive events. d. Documentation of the scope, execution, and results of exercises and tests in which the entity is unable to directly participate.” | FFIEC BCM Booklet, Examination Objective 10, Items 21(c) and 21(d) | in force |
| US | FFIEC | business continuity | Examined on whether the entity participates in critical third-party service providers' exercise and test programs at reasonable intervals, including end-to-end exercises, transaction processing tests, network connectivity tests, bidirectional operations tests, and supply chain considerations. “Determine whether the entity participates in its critical third-party service providers' exercise and test program(s) at reasonable intervals...a. End-to-end and, when appropriate, full-scale exercises. b. Transaction processing and functional testing. c. Network connectivity…” | FFIEC BCM Booklet, Examination Objective 10, Item 22 | in force |
| US | FFIEC | business continuity | Examined on whether testing scenarios with critical third-party providers cover outages at both the provider and the entity, incident response plans, crisis management plans, communication processes, cyber events, and return to normal operations. “Determine whether testing scenarios with critical third-party service providers consider the following: a. An outage or disruption of the service provider. b. An outage or disruption at the entity. c. Incident response plans. d. Crisis management plans. e. Communication…” | FFIEC BCM Booklet, Examination Objective 10, Item 23 | in force |
| US | FFIEC | business continuity | For core or significant firms, validate that backup sites can support typical payment/settlement volumes for extended periods, are fully independent of primary site infrastructure, and are staffed with trained personnel independent of primary site staff. “Determine whether the tests validate the core or significant firm's backup arrangements to confirm the following: a. Backup sites are able to support typical payment and settlement volumes for an extended period. b. Backup sites are fully independent of the critical…” | FFIEC BCM Booklet, Examination Objective 10, Item 24 | in force |
| US | FFIEC | business continuity | For core or significant firms, validate that backup site employees can recover clearing and settlement of open transactions within BCM-defined timeframes and applicable industry standards. “Backup site employees are able to recover clearing and settlement of open transactions within the time frames addressed in the BCM processes and applicable industry standards.” | FFIEC BCM Booklet, Examination Objective 10, Item 24(e) | in force |
| US | FFIEC | business continuity | For core and significant firms, ensure exercise assumptions consider complete inoperability of primary data centers and operations facilities without notice, and extended unavailability of primary site personnel. “Determine whether the exercise and test assumptions are appropriate for core and significant firms and consider the following: a. Primary data centers and operations facilities that are completely inoperable without notice. b. Whether personnel at primary sites...are unavailable…” | FFIEC BCM Booklet, Examination Objective 10, Item 25 | in force |
| US | FFIEC | business continuity | Incorporate significant business continuity concepts, interdependencies, disruption impacts, and operations resilience into the BCM training program. “Validate that management incorporates significant business continuity concepts, interdependencies, disruption impacts, and operations resilience into the training program.” | FFIEC BCM Booklet, Examination Objective [Training], Item 3 | in force |
| US | FFIEC | business continuity | Update the BCM training program, including board training, as significant changes occur. “Verify that the BCM training program, including board training, is updated as significant changes occur.” | FFIEC BCM Booklet, Examination Objective [Training], Item 4 | in force |
| US | FFIEC | business continuity | Examined on whether BCM testing addresses third-party service provider outage/disruption scenarios, including incident response plans, crisis management plans, communication processes, cyber events, and returning to normal operations. “critical third-party service providers consider the following: a. An outage or disruption of the service provider. b. An outage or disruption at the entity. c. Incident response plans. d. Crisis management plans.” | FFIEC BCM Booklet, Examination Objective 10, Procedure 23 | in force |
| US | FFIEC | business continuity | Validate that backup sites for core/significant firms can support typical payment and settlement volumes for an extended period and are fully independent of critical infrastructure supporting primary sites. “Backup sites are able to support typical payment and settlement volumes for an extended period. b. Backup sites are fully independent of the critical infrastructure components that support the primary sites.” | FFIEC BCM Booklet, Examination Objective 10, Procedure 24(a)-(b) | in force |
| US | FFIEC | business continuity | Ensure trained employees are located at backup sites at time of disruption and are independent of primary site staff. “Trained employees are located at the backup sites at the time of disruption. d. Backup site employees are independent of the staff located at the primary site at the time of disruption.” | FFIEC BCM Booklet, Examination Objective 10, Procedure 24(c)-(d) | in force |
| US | FFIEC | business continuity | Ensure backup site employees can recover clearing and settlement of open transactions within BCM-defined and applicable industry-standard time frames. “Backup site employees are able to recover clearing and settlement of open transactions within the time frames addressed in the BCM processes and applicable industry standards.” | FFIEC BCM Booklet, Examination Objective 10, Procedure 24(e) | in force |
| US | FFIEC | business continuity | Ensure exercise and test assumptions include scenarios of complete primary data center inoperability without notice and key personnel unavailability for extended periods. “Primary data centers and operations facilities that are completely inoperable without notice. b. Whether personnel at primary sites, who are located at both data centers and operations facilities, are unavailable for an extended period.” | FFIEC BCM Booklet, Examination Objective 10, Procedure 25(a)-(b) | in force |
| US | FFIEC | business continuity | Examined on whether test assumptions include cascading failure scenarios where other organizations are also affected, potentially spreading disruption across the financial services sector. “Whether other organizations are also affected, causing effects that have the potential to cascade from one organization across to the entire financial services sector.” | FFIEC BCM Booklet, Examination Objective 10, Procedure 25(c) | in force |
| US | FFIEC | business continuity | Include infrastructure disruption (power, telecommunications, transportation) as test assumption scenarios for BCM exercises. “Infrastructure (e.g., power, telecommunications, transportation) that is disrupted.” | FFIEC BCM Booklet, Examination Objective 10, Procedure 25(d) | in force |
| US | FFIEC | business continuity | Test whether data recovery or reconstruction to restart payment and settlement functions can be completed within BCM-defined time frames. “Whether data recovery or reconstruction to restart payment and settlement functions can be completed within the time frames defined by the BCM process and applicable industry standards.” | FFIEC BCM Booklet, Examination Objective 10, Procedure 25(e) | in force |
| US | FFIEC | business continuity | Verify in testing that continuity arrangements remain operational until all pending transactions are closed. “Whether continuity arrangements continue to operate until all pending transactions are closed.” | FFIEC BCM Booklet, Examination Objective 10, Procedure 25(f) | in force |
| US | FFIEC | business continuity | Examined on whether core firms include in their testing strategy plans to test significant firms' ability to recover critical clearing and settlement from geographically dispersed backup sites within a reasonable time frame. “Determine whether the core firm's testing strategy includes plans to test the ability of significant firms that clear or settle transactions to recover critical clearing and settlement activities from geographically dispersed backup sites within a reasonable time frame.” | FFIEC BCM Booklet, Examination Objective 10, Procedure 26 | in force |
| US | FFIEC | business continuity | Examined on whether significant firms maintain an external exercise and test strategy addressing key interdependencies with third-party market providers and key customers, including backup site connectivity. “Determine whether the significant firm has an external exercise and test strategy that addresses key interdependencies, such as exercises and tests with third-party market providers and key customers...Whether external exercise and test strategies include the significant firm's…” | FFIEC BCM Booklet, Examination Objective 10, Procedure 27(a) | in force |
| US | FFIEC | business continuity | Examined on whether significant firms participate in industry or cross-market tests (e.g., Treasury Hamilton Series, FS-ISAC CAPS) including verification of alternate site connectivity and transaction/settlement/payment processes. “Whether the significant firm participates in industry (e.g., U.S. Department of the Treasury's Hamilton Series and FS-ISAC's CAPS exercises) or cross-market tests...Tests should incorporate verifying the connectivity from alternate sites and include transaction, settlement, and…” | FFIEC BCM Booklet, Examination Objective 10, Procedure 27(b) | in force |
| US | FFIEC | business continuity | Management must coordinate execution of the exercise and test program to fully exercise the BCM process, analyze results against stated objectives, and raise/escalate issues for resolution. “Coordinate the execution of its exercise and test program to fully exercise its business continuity planning process. b. Analyze and compare results against stated objectives. c. Raise issues with appropriate personnel and assign responsibility for resolution.” | FFIEC BCM Booklet, Examination Objective 10, Procedure 28(a)-(f) | in force |
| US | FFIEC | business continuity | Management must implement corrective actions and conduct retesting in a timely manner to address deficiencies identified in BCM exercises and tests. “Verify that corrective actions have been implemented and that retesting occurs in a timely fashion to address deficiencies in meeting the entity's objectives.” | FFIEC BCM Booklet, Examination Objective 10, Procedure 29 | in force |
| US | FFIEC | business continuity | Examined on whether test results are used to update BCM processes, enhance future testing, and evaluate whether risk mitigation strategies should be adjusted. “Verify that test results are used to update the business continuity processes, enhance future testing, and evaluate whether risk mitigation strategies should be adjusted.” | FFIEC BCM Booklet, Examination Objective 10, Procedure 30 | in force |
| US | FFIEC | business continuity | Examined on whether management continuously reviews and updates the BCM program to reflect the current environment, triggered by changes including new products/services, third-party changes/deficiencies, new regulations, threat landscape changes, and cyber activity indicators. “Determine whether management reviews and updates the business continuity program to reflect the current environment. Triggers...include...Changes in products and services offered by third-party service providers. d. Deficiencies identified in third-party service provider BCM…” | FFIEC BCM Booklet, Examination Objective 11, Procedure 1 | in force |
| US | FFIEC | business continuity | Examined on whether management periodically reports to the board on BCM status, including BIA, risk assessment, BCP, exercise/test results, and identified issues, with documented rationale for recovery alternatives. “Determine whether reports include a written BCM presentation, including the BIA, risk assessment, BCP, exercise and test results, and identified issues...management documents the reasons (e.g., cost and service level) for choosing recovery alternatives.” | FFIEC BCM Booklet, Examination Objective 12, Procedure 1(a)-(c) | in force |
| US | FRB | business continuity | Establish a board-approved robust operational risk management framework that identifies and mitigates plausible sources of operational risk, ensures high security and reliability, and provides for rapid recovery of critical operations. “manage its operational risks by establishing a robust operational risk-management framework that is approved by its board of directors” | 12 CFR 234.3(a)(17) | in force |
| US | FRB | business continuity | Maintain a business continuity plan incorporating a secondary site with a distinct risk profile from the primary site. “business continuity plan that (1) incorporates the use of a secondary site at a location with a distinct risk profile from the primary site” | 12 CFR 234.3(a)(17)(vii) | in force |
| US | FRB | business continuity | Maintain a BCP designed to enable critical systems to recover and resume operations no later than two hours following disruptive events. “is designed to enable critical systems to recover and resume operations no later than two hours following disruptive events” | 12 CFR 234.3(a)(17)(vii) | in force |
| US | FRB | business continuity | Maintain a BCP designed to enable completion of settlement by the end of the day of disruption, even in extreme circumstances. “is designed to enable it to complete settlement by the end of the day of the disruption, even in case of extreme circumstances” | 12 CFR 234.3(a)(17)(vii) | in force |
| US | FRB | business continuity | Test the business continuity plan at least annually. “is tested at least annually” | 12 CFR 234.3(a)(17)(vii) | in force |
| US | FRB | business continuity | Conduct tests of systems, policies, procedures, and controls in accordance with a documented testing framework that addresses at minimum scope, frequency, participation, interdependencies, and reporting. “conduct tests of its systems, policies, procedures, and controls in accordance with a documented testing framework” | 12 CFR 234.3(a)(17)(i)(A)(1) | in force |
| US | FRB | business continuity | Ensure testing assesses whether systems, policies, procedures, or controls function as intended. “a designated FMU's testing assess whether its systems, policies, procedures, or controls function as intended” | 12 CFR 234.3(a)(17)(i)(A)(2) | in force |
| US | FRB | business continuity | Conduct review of design, implementation, and testing of affected and similar systems, policies, procedures, and controls after any material operational incident. “conduct a review of the design, implementation, and testing of systems, policies, procedures, and controls after the designated FMU experienced any material operational incidents” | 12 CFR 234.3(a)(17)(i)(B) | in force |
| US | FRB | business continuity | Conduct review of affected and similar systems, policies, procedures, and controls when a change to the operating environment could significantly affect plausible sources or mitigants of operational risk. “review the design, implementation, and testing of systems, policies, procedures, and controls after significant changes to the environment in which it operates” | 12 CFR 234.3(a)(17)(i)(B) | in force |
| US | FRB | business continuity | Remediate deficiencies identified during tests and reviews as soon as possible, following established governance processes, including risk analysis, prioritization, and validation. “remediate, as soon as possible and following established governance processes, any deficiencies identified during tests and reviews” | 12 CFR 234.3(a)(17)(i)(C) | in force |
| US | FRB | business continuity | Establish a documented framework for incident management providing for prompt detection, analysis, and escalation of incidents; appropriate response procedures; and incorporation of lessons learned. “establish a documented framework for incident management that provides for the prompt detection, analysis, and escalation of an incident; appropriate procedures for addressing an incident; and incorporation of lessons learned following an incident” | 12 CFR 234.3(a)(17)(vi) | in force |
| US | FRB | business continuity | Include within the incident management framework a plan for notification and communication of material operational incidents identifying entities to be notified, including non-participants that could be affected. “include a plan for notification and communication of material operational incidents. This plan, among other things, would need to identify the entities that would be notified of operational incidents, including non-participants” | 12 CFR 234.3(a)(17)(vi) | in force |
| US | FRB | business continuity | Immediately notify the Board when the designated FMU activates its business continuity plan or has a reasonable basis to conclude there is an actual or likely disruption or material degradation to critical operations, services, or ability to fulfill obligations on time. “notify the Board immediately when it activated its business continuity plan or had a reasonable basis to conclude that (1) there was an actual or likely disruption, or material degradation, to any of its critical operations or services” | 12 CFR 234.3(a)(17)(vi)(A)(1) | in force |
| US | FRB | business continuity | Immediately notify the Board when the designated FMU has a reasonable basis to conclude there is an unauthorized entry, or a vulnerability that could allow unauthorized entry, into its computer/network/electronic systems that affects or could affect critical operations or services. “unauthorized entry or a vulnerability that could allow unauthorized entry, into the designated FMU's computer, network, electronic, technical, automated, or similar systems that affects or has the potential to affect its critical operations or services” | 12 CFR 234.3(a)(17)(vi)(A)(2) | in force |
| US | FRB | business continuity | Notify the Board of incidents in accordance with the process established by the Board. [adjacent] “a designated FMU must notify the Board of incidents 'in accordance with the process established by the Board'” | 12 CFR 234.3(a)(17)(vi)(A) | in force |
| US | FRB | business continuity | Establish criteria and processes for timely communication and responsible disclosure of material operational incidents to participants or other relevant entities, including appropriate communication methods. “establish criteria and processes, including the appropriate methods of communication, to provide for timely communication and responsible disclosure of material operational incidents to its participants or other relevant entities” | 12 CFR 234.3(a)(17)(vi)(B) | in force |
| US | FRB | business continuity | Immediately notify affected participants in the event of actual disruptions or material degradation to critical operations or services or to the ability to fulfill obligations on time. “notify affected participants immediately in the event of actual disruptions or material degradation to its critical operations or services or to its ability to fulfill its obligations on time” | 12 CFR 234.3(a)(17)(vi)(B)(1) | in force |
| US | FRB | business continuity | Notify all participants and other relevant entities in a timely and responsible manner of all other material operational incidents that require immediate Board notification. “notify all participants and other relevant entities in a timely and responsible manner of all other material operational incidents that require immediate notification to the Board” | 12 CFR 234.3(a)(17)(vi)(B)(2) | in force |
| US | FRB | business continuity | Identify and mitigate plausible sources of operational risk (internal and external) through appropriate systems, policies, procedures, and controls that are reviewed, audited, and tested periodically and after major changes. “identify the plausible sources of operational risk, both internal and external, and mitigate their impact through the use of appropriate systems, policies, procedures, and controls that are reviewed, audited, and tested periodically and after major changes” | 12 CFR 234.3(a)(17)(i) | in force |
| US | FRB | business continuity | Identify, monitor, and manage operational risks the designated FMU may pose to other FMUs and trade repositories. [adjacent] “identify, monitor, and manage the operational risks it may pose to other FMUs and trade repositories” | 12 CFR 234.3(a)(17) | in force |
| US | FRB | business continuity | Ensure adequate, scalable capacity to handle increasing stress volumes. “have adequate, scalable capacity to handle increasing stress volumes” | 12 CFR 234.3(a)(17) | in force |
| US | FRB | business continuity | Address potential and evolving vulnerabilities and threats to operational risk, including supply chain and ransomware threats, through systems, policies, procedures, and controls. “address potential and evolving vulnerabilities and threats” | 12 CFR 234.3(a)(17) | in force |
| US | NCUA | business continuity | Establish a written vital records preservation program within six months of insurance certificate issuance to identify, store, and reconstruct vital records in the event such records are destroyed. “The board of directors of a credit union is responsible for establishing a vital records preservation program within six months of its insurance certificate being issued. The program must be in writing and contain procedures for maintaining duplicate vital records at a vital…” | 12 CFR 749.2(a) | in force |
| US | NCUA | business continuity | Include in the written program designated staff responsible for vital records preservation. “The procedures must include: (1) Designated staff responsible for vital records preservation” | 12 CFR 749.2(a)(1) | in force |
| US | NCUA | business continuity | Include in the written program a schedule for the storage and destruction of vital records. “The procedures must include: (2) A schedule for the storage and destruction of vital records” | 12 CFR 749.2(a)(2) | in force |
| US | NCUA | business continuity | Maintain a records preservation log that will aid in locating and easily accessing vital records, in electronic or any other format as determined by the credit union. “A records preservation log as determined by the credit union that will aid in locating and easily accessing the vital records. The log may be in electronic or any other format as determined by the credit union.” | 12 CFR 749.2(a)(3) | in force |
| US | NCUA | business continuity | Store duplicate vital records at a vital records center located far enough from the credit union's offices to avoid simultaneous loss of both sets of records in a catastrophic event. “contain procedures for maintaining duplicate vital records at a vital records center... a storage facility...at any location far enough from the credit union's offices to avoid the simultaneous loss of both sets of records in the event of a catastrophic act.” | 12 CFR 749.2(a); 12 CFR 749.1 (definition of 'Vital records center') | in force |
| US | NCUA | business continuity | Ensure the vital records preservation program covers the six specified categories of vital records, including member account balances, financial reports, bank reconcilements, account/investment lists, and emergency contact information. “Vital records are the most recent and current versions of the records a credit union needs to restore vital member services. These records are: (1) A list of share, deposit, and loan balances... (2) A financial report... (3) Bank reconcilements... (4) A list of the credit…” | 12 CFR 749.1 (definition of 'Vital records', subsections (1)-(5)) | in force |
| US | NCUA | business continuity | Where vital records are maintained by an off-site data processor, ensure the service agreement specifies that the data processor safeguards against simultaneous destruction of production and back-up information. “A credit union that has some or all of its vital records maintained by an off-site data processor is considered to be in compliance for the storage of those records if the service agreement specifies the data processor safeguards against the simultaneous destruction of…” | 12 CFR 749.2(b) | in force |
| US | NCUA | business continuity | Maintain, or contract with a third-party service provider to maintain, any equipment or software necessary for the vital records center so the credit union can access its records. “A credit union must maintain, or contract with a third-party service provider to maintain, any equipment or software for its vital records center necessary for the credit union to access its records.” | 12 CFR 749.3 | in force |
| US | NCUA | business continuity | Maintain effective oversight of any third-party service provider contracted to maintain vital records to ensure the records meet the requirements of 12 CFR 749.3. “If a credit union contracts with a third-party service provider to maintain its records, the credit union must maintain effective oversight of the third-party service provider to ensure the records meet the requirements of this section.” | 12 CFR 749.3 | in force |
| US | NCUA | business continuity | Preserve vital records in a format that accurately reflects the information, remains accessible to all entitled persons, and is capable of reproduction by transmission, printing, or otherwise. “Preserved vital records may be in any format that can be used to reconstruct the credit union's vital records. The format used must accurately reflect the information in the record, remain accessible to all persons entitled to access by statute, regulation, or rule of law, and…” | 12 CFR 749.4 | in force |
| US | NCUA | cybersecurity | Report a reportable cyber incident to the NCUA-designated point of contact as soon as possible and no later than 72 hours after the FICU reasonably believes a reportable cyber incident has occurred. “The NCUA must receive this notification as soon as possible but no later than 72 hours after a federally insured credit union reasonably believes that it has experienced a reportable cyber incident” | 12 CFR 748.1(c) | in force |
| US | NCUA | cybersecurity | Report via email, telephone, or other NCUA-prescribed method to the NCUA-designated point of contact upon occurrence of a reportable cyber incident. “Each federally insured credit union must notify the appropriate NCUA-designated point of contact of the occurrence of a reportable cyber incident via email, telephone, or other similar methods that the NCUA may prescribe.” | 12 CFR 748.1(c) | in force |
| US | NCUA | cybersecurity | Report a cyber incident causing a substantial loss of confidentiality, integrity, or availability of a network or member information system resulting from unauthorized access to sensitive data, disruption of vital member services, or serious impact on safety and resiliency of operational systems. “A substantial loss of confidentiality, integrity, or availability of a network or member information system...that results from the unauthorized access to or exposure of sensitive data, disrupts vital member services...or has a serious impact on the safety and resiliency of…” | 12 CFR 748.1(c)(1)(i)(A) | in force |
| US | NCUA | cybersecurity | Report a cyber incident where a cyberattack or exploitation of vulnerabilities causes disruption of business operations, vital member services, or a member information system. “A disruption of business operations, vital member services, or a member information system resulting from a cyberattack or exploitation of vulnerabilities.” | 12 CFR 748.1(c)(1)(i)(B) | in force |
| US | NCUA | cybersecurity | Report within 72 hours a cyber incident where a compromise of a credit union service organization, cloud service provider, third-party data hosting provider, or supply chain causes disruption of business operations or unauthorized access to sensitive data. “A disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider or by a supply chain compromise.” | 12 CFR 748.1(c)(1)(i)(C) | in force |
| US | NCUA | cybersecurity | When notified by a third-party of a compromise affecting the FICU, report to NCUA within 72 hours of that third-party notification, whichever is sooner than the FICU's own reasonable belief. “within 72 hours of being notified by a third-party, whichever is sooner.” | 12 CFR 748.1(c) | in force |
| US | NCUA | business continuity | A FICU board of directors must establish a written succession plan that addresses specified positions and contains required information to ensure continuity of critical leadership. [adjacent] “a FICU board of directors establish a written succession plan that addresses specified positions and contains certain information” | 12 CFR 701.4(e) | in force |
| US | NCUA | business continuity | The FICU board of directors must review the succession plan no less than every 24 months to ensure it remains current and adequate. [adjacent] “a credit union board must review its succession plan no less than every 24 months, as opposed to the annual review that would have been required under the proposed rule” | 12 CFR 701.4(e) | in force |
| US | NCUA | business continuity | Newly appointed FICU board members must obtain working familiarity with the succession plan no later than six months after appointment. [adjacent] “newly appointed members of the board of directors have a working familiarity with the succession plan no later than six months after appointment” | 12 CFR 701.4(e) | in force |
| US | NCUA | business continuity | The succession plan must identify the anticipated vacancy date for each covered position, such as the incumbent's retirement eligibility date or announced departure date. [adjacent] “The final rule does not require the FICU use a specific date, but suggests some possible proxies, including the individual's anticipated retirement date or announced departure date. A credit union can also note that a retirement or departure date is unknown.” | 12 CFR 701.4(e) | in force |
| US | NCUA | business continuity | The succession plan must cover specified senior leadership positions responsible for oversight or day-to-day management of the FICU, including management officials and senior executive officers per 12 CFR 701.14(b)(2). [adjacent] “succession plans are intended to cover senior leadership positions responsible for the oversight of the FICU or its day-to-day management” | 12 CFR 701.4(e)(2) | in force |
| US | NCUA | business continuity | The succession plan may include other personnel the board deems critical given the FICU's size, complexity, or risk of operations, including positions required due to planned operational changes. [adjacent] “other personnel the board of directors deems critical given the [FICU's] size, complexity, or risk of operations. This includes new positions that may be required due to planned changes in operations, supervisory landscape, or corporate structure.” | 12 CFR 701.4(e)(2)(iii) | in force |
| US | NCUA | business continuity | FISCUs must adhere to the NCUA succession planning requirements to the extent they do not conflict with an applicable state requirement; NCUA defers to enforceable state requirements where no conflict exists. [adjacent] “a FISCU must adhere to the succession planning requirements 'to the extent these regulatory provisions do not conflict with an applicable state requirement.'” | 12 CFR 741.228 | in force |
| US | NCUA | business continuity | Develop and maintain a written security program within 90 days of insurance effective date that prevents destruction of vital records and responds to unauthorized access incidents. “Each federally insured credit union will develop a written security program within 90 days of the effective date of insurance.” | 12 CFR 748.0(a), 748.0(b)(3), 748.0(b)(5) | in force |
| US | NCUA | business continuity | Notify the NCUA regional director within 5 business days of any catastrophic act causing physical destruction or interruption of vital member services projected to last more than two consecutive business days. “Each federally insured credit union will notify the regional director within 5 business days of any catastrophic act that occurs at its office(s).” | 12 CFR 748.1(b) | in force |
| US | NCUA | business continuity | Prepare and file a record of each catastrophic act at the credit union's main office, documenting location, timing, losses, operational deficiencies, and corrective actions. “Within a reasonable time after a catastrophic act occurs, the credit union shall ensure that a record of the incident is prepared and filed at its main office.” | 12 CFR 748.1(b) | in force |
| US | NCUA | business continuity | Notify NCUA's designated point of contact of a reportable cyber incident as soon as possible but no later than 72 hours after the credit union reasonably believes it has experienced such an incident. “The NCUA must receive this notification as soon as possible but no later than 72 hours after a federally insured credit union reasonably believes that it has experienced a reportable cyber incident.” | 12 CFR 748.1(c) | in force |
| US | NCUA | business continuity | Report a cyber incident within 72 hours when a disruption of business operations or vital member services results from a cyberattack or exploitation of vulnerabilities. “A disruption of business operations, vital member services, or a member information system resulting from a cyberattack or exploitation of vulnerabilities.” | 12 CFR 748.1(c)(1)(i)(B) | in force |
| US | NCUA | business continuity | Report within 72 hours when a third-party (CUSO, cloud provider, or other data hosting provider) compromise causes a disruption of business operations or unauthorized access to sensitive data. “A disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider or by a supply chain compromise.” | 12 CFR 748.1(c)(1)(i)(C) | in force |
| US | NCUA | business continuity | Develop and implement a comprehensive written information security program with administrative, technical, and physical safeguards appropriate to the credit union's size and complexity. [adjacent] “A comprehensive written information security program includes administrative, technical, and physical safeguards appropriate to the size and complexity of the credit union and the nature and scope of its activities.” | 12 CFR Part 748, Appendix A, Section II.A | in force |
| US | NCUA | business continuity | Have the board of directors approve the written information security policy and program, and oversee its development, implementation, and maintenance including reviewing management reports. [adjacent] “Approve the credit union's written information security policy and program; and oversee the development, implementation, and maintenance of the credit union's information security program.” | 12 CFR Part 748, Appendix A, Section III.A | in force |
| US | NCUA | business continuity | Assess reasonably foreseeable internal and external threats to member information systems, evaluate likelihood and potential damage of threats, and assess sufficiency of existing controls. “Identify reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of member information or member information systems.” | 12 CFR Part 748, Appendix A, Section III.B | in force |
| US | NCUA | business continuity | Implement response programs specifying actions when unauthorized access to member information systems is suspected or detected, including reports to regulatory and law enforcement agencies. “Response programs that specify actions to be taken when the credit union suspects or detects that unauthorized individuals have gained access to member information systems, including appropriate reports to regulatory and law enforcement agencies.” | 12 CFR Part 748, Appendix A, Section III.C.1.g | in force |
| US | NCUA | business continuity | Implement measures to protect member information against destruction, loss, or damage due to environmental hazards such as fire, water damage, or technical failures. “Measures to protect against destruction, loss, or damage of member information due to potential environmental hazards, such as fire and water damage or technical failures.” | 12 CFR Part 748, Appendix A, Section III.C.1.h | in force |
| US | NCUA | business continuity | Implement monitoring systems and procedures to detect actual and attempted attacks on or intrusions into member information systems. [adjacent] “Monitoring systems and procedures to detect actual and attempted attacks on or intrusions into member information systems.” | 12 CFR Part 748, Appendix A, Section III.C.1.f | in force |
| US | NCUA | business continuity | Regularly test key controls, systems, and procedures of the information security program, with tests conducted or reviewed by independent parties, at a frequency determined by risk assessment. [adjacent] “Regularly test the key controls, systems and procedures of the information security program. The frequency and nature of such tests should be determined by the credit union's risk assessment.” | 12 CFR Part 748, Appendix A, Section III.C.3 | in force |
| US | NCUA | business continuity | Exercise due diligence in selecting service providers, require them by contract to implement appropriate information security measures, and monitor their compliance where indicated by risk assessment. “Exercise appropriate due diligence in selecting its service providers; Require its service providers by contract to implement appropriate measures designed to meet the objectives of these guidelines.” | 12 CFR Part 748, Appendix A, Section III.D | in force |
| US | NCUA | business continuity | Monitor, evaluate, and adjust the information security program in response to relevant changes in technology, threat environment, member information sensitivity, and business arrangements including outsourcing. [adjacent] “Monitor, evaluate, and adjust, as appropriate, the information security program in light of any relevant changes in technology, the sensitivity of its member information, internal or external threats to information, and the credit union's own changing business arrangements.” | 12 CFR Part 748, Appendix A, Section III.E | in force |
| US | NCUA | business continuity | The institution should report to the board or board committee at least annually on the overall status of the information security program, including risk assessment, risk management decisions, service provider arrangements, test results, and security breaches. [adjacent] “Each credit union should report to its board or an appropriate committee of the board at least annually. This report should describe the overall status of the information security program and the credit union's compliance with these guidelines.” | 12 CFR Part 748, Appendix A, Section III.F | in force |
| US | NCUA | business continuity | The institution should develop and implement a risk-based response program to address incidents of unauthorized access to member information, as a key component of the information security program. [adjacent] “Every credit union should also develop and implement a risk-based response program to address incidents of unauthorized access to member information in member information systems that occur nonetheless.” | 12 CFR Part 748, Appendix B, Section II | in force |
| US | NCUA | business continuity | Include in the response program procedures to assess the nature and scope of an incident and identify which member information systems and information types were accessed or misused. “Assessing the nature and scope of an incident, and identifying what member information systems and types of member information have been accessed or misused.” | 12 CFR Part 748, Appendix B, Section II.A.1.a | in force |
| US | NCUA | business continuity | Notify the appropriate NCUA Regional Director (and state supervisory authority for state-chartered CUs) as soon as possible upon discovering an incident involving unauthorized access to sensitive member information. [adjacent] “Notifying the appropriate NCUA Regional Director, and, in the case of state-chartered credit unions, its applicable state supervisory authority, as soon as possible when the credit union becomes aware of an incident involving unauthorized access to or use of sensitive member…” | 12 CFR Part 748, Appendix B, Section II.A.1.b | in force |
| US | NCUA | business continuity | Take appropriate steps to contain and control incidents of unauthorized access to prevent further unauthorized access, including monitoring, freezing, or closing affected accounts while preserving records and evidence. “Taking appropriate steps to contain and control the incident to prevent further unauthorized access to or use of member information, for example, by monitoring, freezing, or closing affected accounts, while preserving records and other evidence.” | 12 CFR Part 748, Appendix B, Section II.A.1.d | in force |
| US | NCUA | business continuity | The institution should require service providers by contract to promptly notify the credit union of unauthorized access incidents to member information to enable timely implementation of the credit union's response program. [adjacent] “A credit union's contract with its service provider should require the service provider to take appropriate actions to address incidents of unauthorized access to or use of the credit union's member information, including notification of the credit union as soon as possible of…” | 12 CFR Part 748, Appendix B, Section II.ii | in force |
| US | NCUA | business continuity | Annually certify compliance with all requirements of 12 CFR Part 748 via the Credit Union Profile through NCUA's online information management system. [adjacent] “The president or managing official of each federally insured credit union must certify compliance with the requirements of this part in its Credit Union Profile annually through NCUA's online information management system.” | 12 CFR 748.1(a) | in force |
| US | NCUA | business continuity | Design the information security program to control risks commensurate with information sensitivity and business complexity, considering and adopting appropriate controls including encryption, access controls, and modification procedures. [adjacent] “Design its information security program to control the identified risks, commensurate with the sensitivity of the information as well as the complexity and scope of the credit union's activities.” | 12 CFR Part 748, Appendix A, Section III.C.1 | in force |
| US | NCUA | other | Credit unions with assets >=$50M must establish and document a written Contingency Funding Plan (CFP) commensurate with complexity, risk profile, and scope of operations addressing liquidity shortfalls in emergencies. [adjacent] “must establish and document a contingency funding plan (CFP) that meets the requirements of paragraph (d) of this section.” | 12 CFR 741.12(b), 741.12(d) | in force |
| US | NCUA | other | The CFP must include policies to manage a range of stress environments, identify possible stress events, and identify likely liquidity responses to such events. [adjacent] “Policies to manage a range of stress environments, identification of some possible stress events, and identification of likely liquidity responses to such events;” | 12 CFR 741.12(d)(3) | in force |
| US | NCUA | other | The CFP must define lines of responsibility within the institution for responding to liquidity events. [adjacent] “Lines of responsibility within the institution to respond to liquidity events;” | 12 CFR 741.12(d)(4) | in force |
| US | NCUA | other | The CFP must specify the frequency at which the institution will test and update the plan. [adjacent] “The frequency that the institution will test and update the plan.” | 12 CFR 741.12(d)(6) | in force |
| US | NCUA | business continuity | Establish and maintain a written vital records preservation program to identify, store, and reconstruct vital records in the event records are destroyed. “All credit unions must have a written program that includes plans for safeguarding records and reconstructing vital records.” | 12 CFR 749.0(a); 12 CFR 749.2 | in force |
| US | NCUA | business continuity | Establish the vital records preservation program within 6 months after the credit union's insurance certificate is issued. “The board of directors of a credit union is responsible for establishing a vital records preservation program within 6 months after its insurance certificate is issued.” | 12 CFR 749.2 | in force |
| US | NCUA | business continuity | Include in the written program procedures for maintaining duplicate vital records at a vital records center. “The program must be in writing and contain procedures for maintaining duplicate vital records at a vital records center.” | 12 CFR 749.2 | in force |
| US | NCUA | business continuity | Designate staff responsible for vital records preservation within the written program. “The procedures must include: designated staff responsible for vital records preservation, a schedule for the storage and destruction of records...” | 12 CFR 749.2 | in force |
| US | NCUA | business continuity | Maintain a records preservation log detailing each stored record's name, storage location, storage date, and name of the person sending the record for storage. [adjacent] “a records preservation log detailing for each record stored, its name, storage location, storage date, and name of the person sending the record for storage.” | 12 CFR 749.2 | in force |
| US | NCUA | business continuity | Maintain or contract with a third party to maintain equipment or software at the vital records center necessary to access vital records. “A credit union must maintain or contract with a third party to maintain any equipment or software for its vital records center necessary to access records.” | 12 CFR 749.3 | in force |
| US | NCUA | business continuity | Locate the vital records center far enough from credit union offices to avoid simultaneous loss of both sets of records in a catastrophic event. “A vital records center is defined as a storage facility...at any location far enough from the credit union's offices to avoid the simultaneous loss of both sets of records in the event of a catastrophic act.” | 12 CFR 749.3 | in force |
| US | NCUA | business continuity | Ensure preserved vital records are in a format that accurately reflects original information, remains accessible to authorized persons, and is capable of reproduction. “The format used must accurately reflect the information in the record, remain accessible to all persons entitled to access by statute, regulation or rule of law, and be capable of reproduction by transmission, printing, or otherwise.” | 12 CFR 749.4 | in force |
| US | NCUA | business continuity | Where an off-site data processor maintains records, ensure the service agreement specifies the data processor safeguards against simultaneous destruction of production and back-up information. “Credit unions which have some or all of their records maintained by an off-site data processor are considered to be in compliance...if the service agreement specifies the data processor safeguards against the simultaneous destruction of production and back-up information.” | 12 CFR 749.2 | in force |
| US | NCUA | business continuity | Conduct a business impact analysis to evaluate potential threats as part of catastrophic act preparedness (recommended). “(1) A business impact analysis to evaluate potential threats;” | 12 CFR Part 749, Appendix B, element (1) | in force |
| US | NCUA | business continuity | Conduct a risk assessment to determine critical systems and necessary resources as part of catastrophic act preparedness (recommended). “(2) A risk assessment to determine critical systems and necessary resources;” | 12 CFR Part 749, Appendix B, element (2) | in force |
| US | NCUA | business continuity | Develop a written catastrophic act preparedness plan identifying persons with authority to enact the plan (recommended). “A written plan addressing: i. Persons with authority to enact the plan;” | 12 CFR Part 749, Appendix B, element (3)(i) | in force |
| US | NCUA | business continuity | Address preservation and ability to restore vital records in the written catastrophic act preparedness plan (recommended). “ii. Preservation and ability to restore vital records;” | 12 CFR Part 749, Appendix B, element (3)(ii) | in force |
| US | NCUA | business continuity | Include in the written plan a method for restoring vital member services through alternate operating locations or service mediums (recommended). “iii. A method for restoring vital member services through identification of alternate operating location(s) or mediums to provide services, such as telephone centers, shared service centers, agreements with other credit unions, or other appropriate methods;” | 12 CFR Part 749, Appendix B, element (3)(iii) | in force |
| US | NCUA | business continuity | Include communication methods for employees and members in the written catastrophic act preparedness plan (recommended). “iv. Communication methods for employees and members;” | 12 CFR Part 749, Appendix B, element (3)(iv) | in force |
| US | NCUA | business continuity | Include regulator notification procedures per 12 CFR 748.1(b) in the written catastrophic act preparedness plan (recommended). “v. Notification of regulators as addressed in 12 CFR 748.1(b);” | 12 CFR Part 749, Appendix B, element (3)(v) | in force |
| US | NCUA | business continuity | Include training — and documentation of training — for all employees and volunteer officials on catastrophic act procedures in the written plan (recommended). “vi. Training and documentation of training to ensure all employees and volunteer officials are aware of procedures to follow in the event of destruction of vital records or loss of vital member services;” | 12 CFR Part 749, Appendix B, element (3)(vi) | in force |
| US | NCUA | business continuity | Include testing procedures and a means for documenting testing results in the written catastrophic act preparedness plan (recommended). “vii. Testing procedures, including a means for documenting the testing results.” | 12 CFR Part 749, Appendix B, element (3)(vii) | in force |
| US | NCUA | business continuity | Establish internal controls for reviewing the catastrophic act preparedness plan at least annually and revising it as circumstances warrant (recommended). “(4) Internal controls for reviewing the plan at least annually and for revising the plan as circumstances warrant, for example, to address changes in the credit union's operations;” | 12 CFR Part 749, Appendix B, element (4) | in force |
| US | NCUA | business continuity | Conduct annual testing of the catastrophic act preparedness plan (recommended). “(5) Annual testing.” | 12 CFR Part 749, Appendix B, element (5) | in force |
| US | OCC | crisis management | Banking organizations must notify their primary Federal regulator of any computer-security incident that rises to the level of a notification incident as soon as possible and no later than 36 hours after determining the incident occurred. “a banking organization must notify its primary Federal regulator of any computer-security incident that rises to the level of a notification incident as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has…” | 12 CFR Part 53 (OCC); 12 CFR Part 225 (Board); 12 CFR Part 304 (FDIC) — Final Rule Section III.A | in force |
| US | OCC | crisis management | Bank service providers must notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade… “the final rule requires a bank service provider to notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines it has experienced a computer-security incident that has caused…” | 12 CFR Part 53 (OCC); 12 CFR Part 225 (Board); 12 CFR Part 304 (FDIC) — Final Rule Section III.A | in force |
| US | OCC | crisis management | Banking organizations must have sufficient understanding of their lines of business to determine which business lines, upon failure, would result in a material loss of revenue, profit, or franchise value, in order to identify notification incidents. [adjacent] “all banking organizations must have a sufficient understanding of their lines of business to be able to determine which business lines would, upon failure, result in a material loss of revenue, profit, or franchise value to the banking organization, so that they can meet their…” | 12 CFR Part 53 (OCC); 12 CFR Part 225 (Board); 12 CFR Part 304 (FDIC) — Final Rule Section III.B.iv | in force |
| US | OCC | crisis management | Banking organizations must apply a 'reasonably likely' materiality standard when determining whether a computer-security incident constitutes a notification incident requiring regulator notification, covering incidents that have materially disrupted or degraded or are reasonably likely to do so. “a banking organization will be required to notify its primary Federal regulator when it has suffered a computer-security incident that has a reasonable likelihood of materially disrupting or degrading the banking organization or its operations.” | 12 CFR Part 53 (OCC); 12 CFR Part 225 (Board); 12 CFR Part 304 (FDIC) — Final Rule Section III.B.iv | in force |
| US | OCC | crisis management | Banking organizations should evaluate whether a material loss of revenue, profit, or franchise value resulting from a computer-security incident is material on an enterprise-wide basis when assessing notification incident status under the second prong of the definition. “a banking organization should evaluate whether the loss is material to the organization as a whole.” | 12 CFR Part 53 (OCC); 12 CFR Part 225 (Board); 12 CFR Part 304 (FDIC) — Final Rule Section III.B.iv | in force |
| US | OCC | crisis management | Bank service providers must ensure their notification to banking organization customers is directed to a bank-designated point of contact rather than an arbitrary individual, requiring coordination with banking organization customers to establish and maintain those contact designations. “requiring that notice be provided to a bank-designated point of contact, rather than to at least two individuals at each banking organization customer.” | 12 CFR Part 53 (OCC); 12 CFR Part 225 (Board); 12 CFR Part 304 (FDIC) — Final Rule Section III.A and III.D.iii | in force |
| US | OCC | crisis management | Banking organizations and bank service providers must determine whether a computer-security incident has occurred based on a determination standard (not a subjective good-faith belief), requiring documented incident assessment processes. “the agencies are replacing the 'good faith belief' standard with a banking organization's determination. The agencies agree with commenters who criticized the proposed 'believes in good faith' standard as too subjective and imprecise.” | 12 CFR Part 53 (OCC); 12 CFR Part 225 (Board); 12 CFR Part 304 (FDIC) — Final Rule Section III.B.iv | in force |
| US | OCC | crisis management | Banking organizations must be capable of identifying computer-security incidents that materially disrupt or degrade (or are reasonably likely to do so) their ability to carry out banking operations or deliver products/services to a material portion of their customer base in the ordinary course of business. “Ability to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base, in the ordinary course of business.” | 12 CFR Part 53 (OCC); 12 CFR Part 225 (Board); 12 CFR Part 304 (FDIC) — Final Rule Section III.B.iv | in force |
| US | OCC | crisis management | Banking organizations must be capable of identifying notification incidents that impact operations whose failure or discontinuance would pose a threat to the financial stability of the United States (the third prong of the notification incident definition). “operations, including associated services, functions and support, as applicable, the failure or discontinuance of which would pose a threat to the financial stability of the United States.” | 12 CFR Part 53 (OCC); 12 CFR Part 225 (Board); 12 CFR Part 304 (FDIC) — Final Rule Section III.B.iv | in force |
| US | OCC | crisis management | Banking organizations that provide sector-critical services and currently notify their primary Federal regulator of computer-security incidents on a same-day basis are encouraged to continue doing so (supervisory expectation). “the agencies would encourage those banking organizations providing sector-critical services that currently notify their primary Federal regulator of these types of incidents on a same-day basis to continue to do so.” | 12 CFR Part 53 (OCC); 12 CFR Part 225 (Board); 12 CFR Part 304 (FDIC) — Final Rule Section III.A (footnote 19) | in force |
| US | OCC | crisis management | Bank service providers must have procedures to determine when a computer-security incident has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services to banking organization customers for four or more hours, triggering the notification obligation. “when the bank service provider determines it has experienced a computer-security incident that has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours.” | 12 CFR Part 53 (OCC); 12 CFR Part 225 (Board); 12 CFR Part 304 (FDIC) — Final Rule Section III.D.ii | in force |
| US | OCC | crisis management | Banking organizations must assess whether a computer-security incident at a bank service provider has or is reasonably likely to have a material impact on the banking organization, potentially triggering the banking organization's own notification requirement to its regulator. “prompt notification will allow the banking organization to assess whether the incident has or is reasonably likely to have a material impact on the banking organization and thus trigger the banking organization's own notification requirement.” | 12 CFR Part 53 (OCC); 12 CFR Part 225 (Board); 12 CFR Part 304 (FDIC) — Final Rule, Introduction and Section III.D.i | in force |
| US | OCC | crisis management | Banking organizations and bank service providers must ensure that contracts with bank service providers address notification provisions consistent with the final rule, so that banking organizations receive prompt notification of computer-security incidents affecting covered services. “while the agencies agree that incident notification is generally addressed by contract, we believe that this issue is important enough to warrant an independent regulatory requirement that ensures consistency and enforceability, without the necessity of revising contractual…” | 12 CFR Part 53 (OCC); 12 CFR Part 225 (Board); 12 CFR Part 304 (FDIC) — Final Rule Section III.D.iv | in force |
| US | OCC | crisis management | Banking organizations must identify and monitor their critical dependence on bank service providers for essential services and ensure operational resilience by receiving timely notification of computer-security incidents at those providers that could disrupt covered services. “banking organizations have become increasingly reliant on third parties to provide essential services. Such third parties may also experience computer-security incidents that could disrupt or degrade the provision of services to their banking organization customers.” | 12 CFR Part 53 (OCC); 12 CFR Part 225 (Board); 12 CFR Part 304 (FDIC) — Final Rule Section III.D.i | in force |
| US | OCC | crisis management | Notify the appropriate OCC supervisory office as soon as possible and no later than 36 hours after determining that a notification incident has occurred. “The OCC must receive this notification from the banking organization as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred.” | 12 CFR 53.3 | in force |
| US | OCC | crisis management | Notify the OCC via email, telephone, or other OCC-prescribed methods upon occurrence of a notification incident. “A banking organization must notify the appropriate OCC supervisory office, or OCC-designated point of contact, about a notification incident through email, telephone, or other similar methods that the OCC may prescribe.” | 12 CFR 53.3 | in force |
| US | OCC | crisis management | Monitor for and determine when a computer-security incident constitutes a 'notification incident' — i.e., one that has materially disrupted or is reasonably likely to materially disrupt banking operations, business lines, or critical operations. “Notification incident is a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, a banking organization's— (i) Ability to carry out banking operations...in the ordinary course of business...” | 12 CFR 53.2(b)(7) | in force |
| US | OCC | crisis management | Bank service providers must notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when a computer-security incident has materially disrupted or degraded covered services for four or more hours. “A bank service provider is required to notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has materially…” | 12 CFR 53.4(a) | in force |
| US | OCC | crisis management | Bank service providers must notify the CEO and CIO (or comparable individuals) of the banking organization customer when no bank-designated point of contact has been previously provided. “If the banking organization customer has not previously provided a bank-designated point of contact, such notification shall be made to the Chief Executive Officer and Chief Information Officer of the banking organization customer, or two individuals of comparable…” | 12 CFR 53.4(a)(2) | in force |
| US | OCC | crisis management | Banking organizations must provide bank service providers with a designated point of contact (email, phone, or other contact) to receive incident notifications. “A bank-designated point of contact is an email address, phone number, or any other contact(s), previously provided to the bank service provider by the banking organization customer.” | 12 CFR 53.4(a)(1) | in force |
| US | OCC | business continuity | Maintain a complete inventory of all third-party relationships and periodically conduct risk assessments for each to determine whether risks have changed and update risk management practices accordingly. [adjacent] “Maintaining a complete inventory of its third-party relationships and periodically conducting risk assessments for each third-party relationship supports a banking organization's determination of whether risks have changed over time” | Interagency TPRM Guidance 2023, Section B (Risk Management) | in force |
| US | OCC | business continuity | Apply more comprehensive and rigorous oversight and management to third-party relationships that support higher-risk or critical activities, including those that could cause significant operational disruption. “banking organizations engage in more comprehensive and rigorous oversight and management of third-party relationships that support higher-risk activities, including critical activities.” | Interagency TPRM Guidance 2023, Section B (Risk Management) | in force |
| US | OCC | business continuity | During planning, identify and assess risks associated with a contemplated third-party relationship—including operational risks—before entering the relationship, with board approval for critical activities. [adjacent] “effective planning allows a banking organization to evaluate and consider how to manage risks before entering into a third-party relationship... when critical activities are involved, plans may be presented to and approved by a banking organization's board of directors” | Interagency TPRM Guidance 2023, Section C.1 (Planning) | in force |
| US | OCC | business continuity | During due diligence, assess a third party's incident response and management capabilities, including how it handles and reports security or operational incidents. “incident response and management, including the third party's ability to respond to and recover from incidents that could disrupt operations” | Interagency TPRM Guidance 2023, Section C.2 (Due Diligence and Third-Party Selection) | in force |
| US | OCC | business continuity | During due diligence, assess a third party's information security program, including controls protecting the confidentiality, integrity, and availability of systems and data critical to the banking organization's operations. “information security, including the third party's information security program and its ability to protect the banking organization's systems, data, and customers” | Interagency TPRM Guidance 2023, Section C.2 (Due Diligence and Third-Party Selection) | in force |
| US | OCC | business continuity | During due diligence, evaluate a third party's operational resilience, including its ability to withstand and recover from disruptions to the services it provides. “operational resilience, including the third party's ability to withstand and recover from disruptions” | Interagency TPRM Guidance 2023, Section C.2 (Due Diligence and Third-Party Selection) | in force |
| US | OCC | business continuity | Include in contracts provisions for incident notification, requiring the third party to promptly notify the banking organization of disruptions or incidents affecting the services provided. “incident notification, requiring the third party to promptly notify the banking organization of any incidents that may affect the third party's ability to provide the contracted services” | Interagency TPRM Guidance 2023, Section C.3 (Contract Negotiation) | in force |
| US | OCC | business continuity | Include in contracts provisions that define service-level agreements (SLAs) for recovery time and availability, ensuring services can be restored within acceptable timeframes following a disruption. “performance standards and service level agreements, including measurable standards for performance and consequences for failure to meet the standards” | Interagency TPRM Guidance 2023, Section C.3 (Contract Negotiation) | in force |
| US | OCC | business continuity | Include in contracts provisions granting the banking organization rights to audit the third party's controls, including those related to business continuity and information security. “audit and examination rights, including the right to conduct audits and examinations of the third party and its subcontractors” | Interagency TPRM Guidance 2023, Section C.3 (Contract Negotiation) | in force |
| US | OCC | business continuity | Include in contracts provisions for orderly termination and business continuity, ensuring the banking organization can transition services or wind down the relationship without disruption to operations. “default and termination rights, including the ability of the banking organization to terminate the contract and transition the activities to another third party or in-house” | Interagency TPRM Guidance 2023, Section C.3 (Contract Negotiation) | in force |
| US | OCC | business continuity | During ongoing monitoring, the institution should monitor a third party's business continuity and disaster recovery capabilities, including reviewing BCP/DR test results on a periodic basis. “ongoing monitoring should include reviewing the third party's business continuity and disaster recovery capabilities, including test results” | Interagency TPRM Guidance 2023, Section C.4 (Ongoing Monitoring) | in force |
| US | OCC | business continuity | During ongoing monitoring, monitor a third party's information security and incident response capabilities and track incidents that could affect the banking organization's operations. “information security, including monitoring changes to the third party's security controls and any security incidents that may affect the banking organization” | Interagency TPRM Guidance 2023, Section C.4 (Ongoing Monitoring) | in force |
| US | OCC | business continuity | During ongoing monitoring, assess changes in third-party concentration risk, including reliance on a single third party for critical services and potential impacts on operational continuity. “concentration risk, including assessing the banking organization's reliance on a single third party for critical activities and the potential impact on the banking organization's operations” | Interagency TPRM Guidance 2023, Section C.4 (Ongoing Monitoring) | in force |
| US | OCC | business continuity | Develop and maintain contingency plans for terminating a critical third-party relationship, ensuring the banking organization can continue operations if the third party fails or the relationship must be ended. “maintaining contingency plans for terminating the relationship, including identifying and transitioning to alternative third parties or moving the activities in-house” | Interagency TPRM Guidance 2023, Section C.5 (Termination) | in force |
| US | OCC | business continuity | Evaluate a third party's use of subcontractors to determine whether subcontracting arrangements may heighten operational or resilience risks to the banking organization, and apply mitigating controls as appropriate. “assessing whether a third party's use of subcontractors may heighten or raise additional risk to the banking organization and applying mitigating factors, as appropriate” | Interagency TPRM Guidance 2023, Section F (Subcontractors discussion / Section C.2) | in force |
| US | OCC | business continuity | Ensure third-party contracts include provisions requiring subcontractors to adhere to the same operational resilience and security standards as the primary third party. “require the third party to bind its subcontractors to any obligations and standards of the third party” | Interagency TPRM Guidance 2023, Section C.3 (Contract Negotiation) / Subcontractors | in force |
| US | OCC | business continuity | Conduct independent reviews of third-party risk management processes, including effectiveness of controls related to operational resilience and business continuity for critical third-party relationships. “independent reviews of the banking organization's third-party risk management processes and controls, including those related to critical activities” | Interagency TPRM Guidance 2023, Section D.2 (Independent Reviews) | in force |
| US | OCC | business continuity | Establish board and senior management oversight of third-party risk management, including approval of policies addressing operational resilience risks from third-party relationships. “the board has ultimate oversight responsibility to ensure that the banking organization operates in a safe and sound manner... senior management implements the board-approved policies” | Interagency TPRM Guidance 2023, Section D.1 (Oversight and Accountability) | in force |
| US | OCC | business continuity | Maintain documentation and reporting sufficient to demonstrate effective management of operational resilience risks across the third-party relationship life cycle, for review by examiners. “documentation and reporting sufficient to support the banking organization's third-party risk management processes and to facilitate examination by the agencies” | Interagency TPRM Guidance 2023, Section D.3 (Documentation and Reporting) | in force |
| US | OCC | business continuity | When a banking organization cannot obtain adequate information to assess a third party's resilience capabilities, the institution is encouraged to consider taking steps to mitigate the resulting risk or determine whether residual risk is within the organization's risk appetite. “banking organizations should consider taking steps to mitigate the risks or, if the risks cannot be mitigated, to determine whether the residual risks are acceptable” | Interagency TPRM Guidance 2023, Section C.2 (Due Diligence) / Section II.E.1 | in force |
| US | OCC | business continuity | Assess concentration risk arising from reliance on a limited number of third-party providers in highly concentrated industries (e.g., cloud computing) and consider alternative arrangements to mitigate operational continuity risk. “asked for additional flexibility for banking organizations to manage relationships with third parties in relatively concentrated industries, mentioning cloud computing as an example” | Interagency TPRM Guidance 2023, Section II.D / Section C.4 (Ongoing Monitoring) | in force |
| US | OCC | business continuity | Ensure that use of collaborative due diligence arrangements or third-party assessment utilities does not abrogate the banking organization's own responsibility to assess and manage operational resilience risks of critical third parties. “use of any collaborative efforts does not abrogate the responsibility of banking organizations to manage third-party relationships in a safe and sound manner... evaluate the conclusions from such collaborative efforts based on the banking organization's own specific circumstances” | Interagency TPRM Guidance 2023, Section II.E.1 (Due Diligence / Collaborative Arrangements) | in force |
| US | OCC | business continuity | Involve staff with requisite technical expertise—including technology, risk, and compliance specialists—at each stage of the third-party relationship life cycle to effectively assess and manage operational resilience risks. “It is important to involve staff with the requisite knowledge and skills in each stage of the risk management life cycle... experts across disciplines, such as compliance, risk, or technology, as well as legal counsel” | Interagency TPRM Guidance 2023, Section C (Third-Party Relationship Life Cycle) | in force |
| US | OCC | business continuity | Implement a comprehensive written information security program with administrative, technical, and physical safeguards appropriate to the institution's size, complexity, and activities. [adjacent] “Each national bank or Federal savings association shall implement a comprehensive written information security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity” | 12 CFR 30 Appendix B, Section II.A | in force |
| US | OCC | business continuity | Board of directors must approve the written information security program and oversee its development, implementation, and maintenance, including assigning specific responsibility. [adjacent] “The board of directors or an appropriate committee of the board of each national bank or Federal savings association shall: 1. Approve the national bank's or Federal savings association's written information security program; and 2. Oversee the development, implementation, and…” | 12 CFR 30 Appendix B, Section III.A | in force |
| US | OCC | business continuity | Identify reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer information systems. [adjacent] “Identify reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer information systems.” | 12 CFR 30 Appendix B, Section III.B.1 | in force |
| US | OCC | business continuity | Assess the likelihood and potential damage of identified threats, taking into consideration the sensitivity of customer information. “Assess the likelihood and potential damage of these threats, taking into consideration the sensitivity of customer information.” | 12 CFR 30 Appendix B, Section III.B.2 | in force |
| US | OCC | business continuity | Design information security program controls commensurate with information sensitivity and the complexity and scope of the institution's activities, including monitoring for attacks and intrusions into customer information systems. [adjacent] “Monitoring systems and procedures to detect actual and attempted attacks on or intrusions into customer information systems;” | 12 CFR 30 Appendix B, Section III.C.1.f | in force |
| US | OCC | business continuity | Implement response programs specifying actions to be taken when unauthorized access to customer information systems is suspected or detected, including reports to regulatory and law enforcement agencies. “Response programs that specify actions to be taken when the national bank or Federal savings association suspects or detects that unauthorized individuals have gained access to customer information systems, including appropriate reports to regulatory and law enforcement agencies;” | 12 CFR 30 Appendix B, Section III.C.1.g | in force |
| US | OCC | business continuity | Implement measures to protect customer information against destruction, loss, or damage due to environmental hazards such as fire, water damage, or technological failures. “Measures to protect against destruction, loss, or damage of customer information due to potential environmental hazards, such as fire and water damage or technological failures.” | 12 CFR 30 Appendix B, Section III.C.1.h | in force |
| US | OCC | business continuity | Regularly test key controls, systems, and procedures of the information security program, with tests conducted or reviewed by independent third parties or independent staff. [adjacent] “Regularly test the key controls, systems and procedures of the information security program. The frequency and nature of such tests should be determined by the national bank's or Federal savings association's risk assessment. Tests should be conducted or reviewed by independent…” | 12 CFR 30 Appendix B, Section III.C.3 | in force |
| US | OCC | business continuity | Exercise appropriate due diligence in selecting service providers that handle customer information. [adjacent] “Exercise appropriate due diligence in selecting its service providers;” | 12 CFR 30 Appendix B, Section III.D.1 | in force |
| US | OCC | business continuity | Require service providers by contract to implement appropriate security measures meeting the objectives of the Information Security Guidelines. [adjacent] “Require its service providers by contract to implement appropriate measures designed to meet the objectives of these Guidelines;” | 12 CFR 30 Appendix B, Section III.D.2 | in force |
| US | OCC | business continuity | Monitor service providers, where indicated by risk assessment, to confirm they have satisfied their contractual security obligations, including reviewing audits, test summaries, or equivalent evaluations. “Where indicated by the national bank's or Federal savings association's risk assessment, monitor its service providers to confirm that they have satisfied their obligations as required by section D.2. As part of this monitoring, a national bank or Federal savings association…” | 12 CFR 30 Appendix B, Section III.D.3 | in force |
| US | OCC | business continuity | Monitor, evaluate, and adjust the information security program in light of changes in technology, information sensitivity, internal/external threats, and changing business arrangements such as outsourcing. [adjacent] “Each national bank or Federal savings association shall monitor, evaluate, and adjust, as appropriate, the information security program in light of any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and…” | 12 CFR 30 Appendix B, Section III.E | in force |
| US | OCC | business continuity | Report to the board or appropriate committee at least annually on the overall status of the information security program, including risk assessment, control decisions, service provider arrangements, test results, security breaches, and program recommendations. [adjacent] “Each national bank or Federal savings association shall report to its board or an appropriate committee of the board at least annually. This report should describe the overall status of the information security program...risk assessment; risk management and control decisions…” | 12 CFR 30 Appendix B, Section III.F | in force |
| US | OCC | business continuity | The institution should develop and implement a risk-based response program to address incidents of unauthorized access to customer information in customer information systems, including systems maintained by service providers. [adjacent] “every financial institution should also develop and implement a risk-based response program to address incidents of unauthorized access to customer information in customer information systems that occur nonetheless. A response program should be a key part of an institution's…” | 12 CFR 30 Appendix B, Supplement A, Section II | in force |
| US | OCC | business continuity | Response program must include procedures to assess the nature and scope of an incident and identify which customer information systems and types of customer information have been accessed or misused. “Assessing the nature and scope of an incident, and identifying what customer information systems and types of customer information have been accessed or misused;” | 12 CFR 30 Appendix B, Supplement A, Section II.A.1.a | in force |
| US | OCC | business continuity | Notify the primary Federal regulator as soon as possible when the institution becomes aware of an incident involving unauthorized access to or use of sensitive customer information. [adjacent] “Notifying its primary Federal regulator as soon as possible when the institution becomes aware of an incident involving unauthorized access to or use of sensitive customer information, as defined below;” | 12 CFR 30 Appendix B, Supplement A, Section II.A.1.b | in force |
| US | OCC | business continuity | Take appropriate steps to contain and control an incident to prevent further unauthorized access, including monitoring, freezing, or closing affected accounts while preserving records and evidence. “Taking appropriate steps to contain and control the incident to prevent further unauthorized access to or use of customer information, for example, by monitoring, freezing, or closing affected accounts, while preserving records and other evidence;” | 12 CFR 30 Appendix B, Supplement A, Section II.A.1.d | in force |
| US | OCC | business continuity | Require service providers by contract to notify the institution as soon as possible of any incident of unauthorized access to the institution's customer information to enable expeditious implementation of the institution's response program. “an institution's contract with its service provider should require the service provider to take appropriate actions to address incidents of unauthorized access to the financial institution's customer information, including notification to the institution as soon as possible of…” | 12 CFR 30 Appendix B, Supplement A, Section II | in force |
| US | OCC | business continuity | Retain responsibility for notifying customers and the regulator when an unauthorized access incident involves customer information in service provider systems, even if the institution contracts the notification function to the service provider. [adjacent] “Where an incident of unauthorized access to customer information involves customer information systems maintained by an institution's service providers, it is the responsibility of the financial institution to notify the institution's customers and regulator. However, an…” | 12 CFR 30 Appendix B, Supplement A, Section II.A.2 | in force |
| US | OCC | business continuity | Train staff to implement the institution's information security program. [adjacent] “Train staff to implement the national bank's or Federal savings association's information security program.” | 12 CFR 30 Appendix B, Section III.C.2 | in force |
| US | OCC | business continuity | Assess the sufficiency of existing policies, procedures, customer information systems, and other arrangements in place to control identified risks. “Assess the sufficiency of policies, procedures, customer information systems, and other arrangements in place to control risks.” | 12 CFR 30 Appendix B, Section III.B.3 | in force |
| US | OCC | business continuity | The institution should ensure trained personnel and reasonable policies and procedures are in place to respond appropriately to customer inquiries and requests for assistance following notification of a security incident. “The institution should, therefore, ensure that it has reasonable policies and procedures in place, including trained personnel, to respond appropriately to customer inquiries and requests for assistance.” | 12 CFR 30 Appendix B, Supplement A, Section III.B.1 (footnote 14) | in force |
| US | SEC | cybersecurity | Develop, implement, and maintain written policies and procedures for an incident response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. “require covered institutions to develop, implement, and maintain written policies and procedures for an incident response program that is reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information” | 17 CFR 248.30(a)(3) | in force |
| US | SEC | cybersecurity | Include in the incident response program procedures to assess the nature and scope of any incident and identify customer information systems and types of customer information that may have been accessed or used without authorization. “Assess the nature and scope of any incident involving unauthorized access to or use of customer information and identify the customer information systems and types of customer information that may have been accessed or used without authorization” | 17 CFR 248.30(a)(3)(i) | in force |
| US | SEC | cybersecurity | Include in the incident response program procedures to take appropriate steps to contain and control an incident to prevent further unauthorized access to or use of customer information. “Take appropriate steps to contain and control the incident to prevent further unauthorized access to or use of customer information” | 17 CFR 248.30(a)(3)(ii) | in force |
| US | SEC | cybersecurity | Include incident response program procedures for notifying affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. [adjacent] “Notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization in accordance with the notification obligations discussed below” | 17 CFR 248.30(a)(3)(iii) | in force |
| US | SEC | cybersecurity | Establish, maintain, and enforce written policies and procedures for oversight of service providers, including due diligence and monitoring, to ensure service providers safeguard customer information and that affected individuals receive required notices. [adjacent] “covered institutions will be required to establish, maintain, and enforce written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring of service providers, including to ensure that affected individuals receive any…” | 17 CFR 248.30(a)(5) | in force |
| US | SEC | cybersecurity | Require service providers to notify the covered institution of a breach as soon as possible, but no later than 72 hours after the service provider becomes aware that an applicable breach has occurred. “the final amendments require covered institutions to ensure that their service providers provide notification as soon as possible, but no later than 72 hours after becoming aware that an applicable breach has occurred” | 17 CFR 248.30(a)(5)(i) | in force |
| US | SEC | cybersecurity | Adopt written policies and procedures with administrative, technical, and physical safeguards to protect customer records and information (safeguards rule), now extended to transfer agents. [adjacent] “The safeguards rule requires brokers, dealers, investment companies, and registered investment advisers to adopt written policies and procedures that address administrative, technical, and physical safeguards to protect customer records and information” | 17 CFR 248.30(a) | in force |
| US | SEC | cybersecurity | The institution is encouraged to periodically review and update incident response assessment and containment procedures to ensure they remain reasonably designed. “covered institutions generally should consider reviewing and updating the assessment procedures periodically to ensure that the procedures remain reasonably designed” | 17 CFR 248.30(a)(3) | in force |
| US | SEC | cybersecurity | Delay customer notification only upon receiving a written request from the Attorney General that notification poses a substantial risk to national security or public safety, consistent with the Public Company Cybersecurity Rules framework. [adjacent] “the final amendments will permit covered institutions to delay providing notice after the Commission receives a written request from the Attorney General that this notice poses a substantial risk to national security or public safety” | 17 CFR 248.30(a)(4) | in force |
| US | SEC | cybersecurity | Disclose any material cybersecurity incident on Form 8-K Item 1.05 within four business days of determining the incident is material, describing nature, scope, timing, and impact. [adjacent] “An Item 1.05 Form 8-K must be filed within four business days of determining an incident was material.” | 17 CFR 249.308, Form 8-K Item 1.05; 17 CFR 240.13a-11 | in force |
| US | SEC | cybersecurity | Make a materiality determination regarding a cybersecurity incident as soon as reasonably practicable after discovery of the incident. [adjacent] “a registrant shall make a materiality determination regarding a cybersecurity incident as soon as reasonably practicable after discovery of the incident.” | Form 8-K Item 1.05, Instruction 1 | in force |
| US | SEC | cybersecurity | Disclose in periodic reports (Form 10-K / Form 20-F) the registrant's processes for assessing, identifying, and managing material risks from cybersecurity threats. [adjacent] “Registrants must describe their processes, if any, for the assessment, identification, and management of material risks from cybersecurity threats.” | 17 CFR 229.106(b) | in force |
| US | SEC | cybersecurity | Disclose in periodic reports the board of directors' oversight of risks from cybersecurity threats. [adjacent] “Describe the board's oversight of risks from cybersecurity threats.” | 17 CFR 229.106(c); Form 20-F | in force |
| US | SEC | cybersecurity | Foreign Private Issuers must describe in Form 20-F management's role in assessing and managing material cybersecurity risks. [adjacent] “FPIs must: Describe management's role in assessing and managing material risks from cybersecurity threats.” | 17 CFR 249.220f; Form 20-F | in force |
| US | SEC | cybersecurity | A registrant may delay an Item 1.05 Form 8-K filing only where the U.S. Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety. [adjacent] “A registrant may delay filing as described below, if the United States Attorney General determines immediate disclosure would pose a substantial risk to national security or public safety.” | Form 8-K Item 1.05; 17 CFR 240.13a-11 | in force |
| US-CT | CT_DOB | business continuity | Adopt, in writing, a program setting forth standards for developing, implementing and maintaining reasonable data security safeguards to protect the security, confidentiality and integrity of customer information, consistent with applicable federal regulations. [adjacent] “adopt, in writing, a program that sets forth standards for developing, implementing and maintaining reasonable data security safeguards to protect the security, confidentiality and integrity of customer information” | Public Act 26-51, Section 1, § 36a-44a(b)(1) | in force |
| US-CT | CT_DOB | business continuity | Comply with all applicable provisions of Subtitle A of Title V of the Gramm-Leach-Bliley Act and its regulations, including 12 CFR Part 364 Appendix B, 12 CFR Part 748 Appendix A, and 16 CFR Part 314 (Safeguards Rule), as amended. [adjacent] “comply with all provisions of Subtitle A of Title V of the Gramm-Leach-Bliley Financial Modernization Act of 1999 ... including, but not limited to, the applicable provisions of 12 CFR Part 364, Appendix B, 12 CFR Part 748, Appendix A and 16 CFR Part 314” | Public Act 26-51, Section 1, § 36a-44a(b)(2) | in force |
| US-CT | CT_DOB | business continuity | File an initial notification with the CT Department of Banking within three business days after knowing or having reason to know of a data security incident that may materially impact the entity's ability to operate in a safe and sound manner or comply with applicable laws and regulations. “file an initial notification with the Department of Banking ... not later than three business days after such licensee, Connecticut bank or Connecticut credit union knows, or has reason to know, of the occurrence of any data security incident that may ... materially impact its…” | Public Act 26-51, Section 1, § 36a-44a(c)(1) | in force |
| US-CT | CT_DOB | business continuity | File an initial notification with the CT Department of Banking within three business days after knowing or having reason to know of a data security incident that may cause significant disruption in customer services. [adjacent] “file an initial notification with the Department of Banking ... not later than three business days after ... knows, or has reason to know, of the occurrence of any data security incident that may ... cause significant disruption in customer services” | Public Act 26-51, Section 1, § 36a-44a(c)(2) | in force |
| US-FL | FL_OFR | cybersecurity | Take reasonable measures to protect and secure data in electronic form containing personal information. [adjacent] “Each covered entity, governmental entity, or third-party agent shall take reasonable measures to protect and secure data in electronic form containing personal information.” | Fla. Stat. §501.171(2) | in force |
| US-FL | FL_OFR | cybersecurity | Upon a security breach, restore the reasonable integrity of the data system that was breached before or during the process of notifying affected individuals. “taking into account the time necessary to allow the covered entity to determine the scope of the breach of security, to identify individuals affected by the breach, and to restore the reasonable integrity of the data system that was breached” | Fla. Stat. §501.171(4)(a) | in force |
| US-FL | FL_OFR | cybersecurity | Include in the written breach notice to the Department: synopsis of breach events, number of affected FL individuals, services offered to affected individuals, copy of individual notice or alternative actions taken, and contact information of the responsible employee/agent. [adjacent] “The written notice to the department must include: 1. A synopsis of the events surrounding the breach...2. The number of individuals in this state...3. Any services related to the breach...4. A copy of the notice required under subsection (4)...5. The name, address, telephone…” | Fla. Stat. §501.171(3)(b) | in force |
| US-FL | FL_OFR | cybersecurity | Provide the Department upon request with a police/incident/forensics report, a copy of breach policies, and steps taken to rectify the breach. [adjacent] “The covered entity must provide the following information to the department upon its request: 1. A police report, incident report, or computer forensics report. 2. A copy of the policies in place regarding breaches. 3. Steps that have been taken to rectify the breach.” | Fla. Stat. §501.171(3)(c) | in force |
| US-FL | FL_OFR | cybersecurity | A third-party agent that experiences a breach of a system it maintains must notify the covered entity within 10 days of breach determination, and must provide the covered entity with all information needed to fulfill its notice obligations. [adjacent] “such third-party agent shall notify the covered entity of the breach of security as expeditiously as practicable, but no later than 10 days following the determination of the breach...A third-party agent shall provide a covered entity with all information that the covered entity…” | Fla. Stat. §501.171(6)(a) | in force |
| US-PA | PA_DOBS | cybersecurity | State agency contractors must notify the chief information security officer (or designee) of the affected State agency upon discovery of a breach, no later than the timeframe specified in the applicable contract. [adjacent] “A State agency contractor shall, upon discovery of the breach...notify the chief information security officer, or a designee, of the State agency affected...as soon as reasonably practical, but no later than the time period specified in the applicable terms of the contract.” | 73 P.S. §2303(a.1)(2) (as amended by Act 151 of 2022, Section 3) | in force |
| US-PA | PA_DOBS | cybersecurity | State agencies under the Governor's jurisdiction must notify the Governor's Office of Administration within three business days following determination of a breach, notwithstanding any existing internal procedures. [adjacent] “A State agency under the Governor's jurisdiction shall also provide notice of a breach of the security of the system to the Governor's Office of Administration within three business days following the determination of the breach.” | 73 P.S. §2303(a.1)(3) (as amended by Act 151 of 2022, Section 3) | in force |
| US-PA | PA_DOBS | cybersecurity | Vendors that maintain, store, or manage computerized data on behalf of another entity must notify that entity upon discovery of a breach so the entity can fulfill its notification obligations. [adjacent] “A vendor that maintains, stores or manages computerized data on behalf of another entity shall provide notice of any breach of the security of the system following discovery by the vendor to the entity on whose behalf the vendor maintains, stores or manages the data.” | 73 P.S. §2303(c) (as amended by Act 151 of 2022, Section 3) | in force |
| US-PA | PA_DOBS | cybersecurity | The encryption/transmission policy must be reviewed at least annually and updated as necessary, considering Federal policies, best practices from other states, and relevant studies. [adjacent] “The policy shall be reviewed at least annually and updated as necessary...an entity shall reasonably consider similar existing Federal policies and other policies, best practices identified by other states and relevant studies and other sources.” | 73 P.S. §2305.1(c)-(d) (as amended by Act 151 of 2022, Section 4) | in force |
| US-PA | PA_DOBS | cybersecurity | The data storage policy must be reviewed at least annually and updated as necessary. [adjacent] “The policy shall be reviewed at least annually and updated as necessary.” | 73 P.S. §2305.2(c) (as amended by Act 151 of 2022, Section 4) | in force |
Knowing which rules bind you is step one. WSquare Advisory builds the operating capability behind compliance — the continuity, third-party, and recovery disciplines these regimes expect. If that's your challenge, let's talk.
Start with an Operating Survey · $5,000 →Not sure it is the right moment? Take the five-minute check first.