Power and Telecommunications Resilience: What the 2026 FFIEC BCM Booklet Requires You to Document and Test

TL;DR

• The 2026 FFIEC BCM Booklet elevated power and telecommunications resilience to a standalone examination focus — expect direct questions about generator testing programs and telecom redundancy documentation
• A generator you haven’t tested under load is an unverified assumption; examiners expect quarterly under-load testing and annual full-load testing with documented results
• The alternate site utility independence requirement is frequently cited in examination findings — a backup site sharing the same power grid segment or telecom central office as your primary doesn’t satisfy it
• The booklet’s exercise vs. test distinction matters: tabletop discussions don’t count as tests, and programs that only run tabletops are incomplete

Most business continuity programs were built when the FFIEC’s BCM guidance treated power and telecommunications resilience as supporting infrastructure — something that showed up in the environmental controls section, not the examination priority list. The March 2026 update changed that.

Power and telecommunications resilience now get standalone coverage in the 2026 FFIEC BCM Booklet, with specific requirements for testing programs, documentation, and alternate site configuration that go beyond what most programs currently produce. The gap isn’t usually in whether the institution has generators or backup telecom — most do. The gap is in whether those systems have been tested, documented, and configured in ways that would actually work during a real outage.

Here’s what the updated booklet requires and where programs typically fall short.

What the 2026 FFIEC BCM Booklet Changed

The March 2026 update to the FFIEC Business Continuity Management IT Examination Handbook addressed several areas where prior examination findings had accumulated: business impact analysis methodology, critical third-party resilience, and — most significantly for operations teams — the specificity of requirements around physical infrastructure resilience.

Earlier versions treated power and telecommunications as secondary concerns, generally covered under facility resilience. The 2026 update gives both categories their own structured requirements covering:

• Dependency documentation — mapping which systems and processes depend on which power and telecommunications infrastructure
• Testing standards — specific frequency and scope expectations for generator tests and telecom failover tests
• Alternate site resilience — explicit requirements that backup sites use different utility infrastructure
• Out-of-band communications — requirements that incident management not depend on the same network infrastructure being recovered

What changed most is the specificity. General statements like “we have generators and backup connections” that satisfied earlier examinations are now expected to be backed by documented testing programs, capacity analysis, and utility independence verification.

The 2026 FFIEC BCM Booklet update covers the full scope of what changed in the March revision; this post focuses on the power and telecommunications components specifically.

Generator Testing: What “We Have a Generator” Doesn’t Satisfy

The most common power resilience gap in examination findings isn’t the absence of backup power — it’s the absence of a documented testing program.

The 2026 booklet expects:

Quarterly under-load testing. Generators should be tested under actual load conditions at least quarterly. Running a generator for 30 minutes with no production systems connected is not an under-load test. The test must confirm that the generator starts, transfers load, and runs critical systems under actual operating conditions.

Annual full-load testing. Once per year, the generator should run under full facility load for a sustained period — four hours is the standard most examiners apply. Full-load testing validates that the generator can sustain operations during an extended outage, not just start and idle.

Documented results. Test logs must capture: date, duration, load percentage, systems supported, results (pass/fail), and any issues identified. Corrective action tracking for failed or degraded tests is expected.

Capacity analysis. Which systems does each generator support? How long can it run at current load on a full fuel tank? What is the refueling plan for extended outages? These questions appear in examination document requests and should be answered in BCP documentation — not improvised during an examination.

The examination finding pattern is consistent: institutions that have generators but can’t produce test logs for the last four quarters get cited. The generator is not considered a functioning control without evidence that it has been tested.

Telecommunications Resilience: What Redundancy Actually Means

Most financial institutions have two internet connections. Whether those connections provide genuine resilience depends on details most BCP programs don’t capture.

Provider diversity. Two connections from the same carrier don’t provide carrier-level redundancy. If the carrier has an outage affecting your service area, both connections fail simultaneously. Genuine redundancy requires separate carriers — with separate contracts, separate billing relationships, and separate technical support contacts.

Path diversity. Two carriers that both route through the same telecommunications central office — or the same physical conduit into the building — can both fail from a single physical event. The 2026 booklet expects documentation that demonstrates the physical paths are diverse, not just the contracts.

What documentation looks like. Examiners ask for: the names of primary and backup telecom providers, confirmation that they use separate physical infrastructure, the location of the nearest central office for each, and records of any telecom failover tests. If you can’t answer “does our backup provider route through the same central office as our primary?” you’re not in a position to demonstrate genuine redundancy.

Out-of-band communications. For incident management — the communications that happen while you’re recovering from an outage — the booklet expects that critical coordination doesn’t depend on the same network being restored. If your incident response relies entirely on Slack, Teams, or corporate email running on your primary network, a network outage creates a communications blackout at the worst possible moment.

The communications failure BCP framework covers how to build backup communications into your incident response and BCP structure. The 2026 booklet requirements reinforce that this capability isn’t optional.

Alternate Site Utility Independence

This is the requirement that generates the most examination findings for institutions with established BCP programs.

The 2026 FFIEC BCM Booklet explicitly requires that recovery sites be served by different utility infrastructure than the primary location. The requirement has two components:

Power utility independence. The primary site and the alternate site should not share a power grid segment to the extent practicable. A backup site in the same building fails simultaneously with the primary during a facility-level power event. A backup site in the same city block may share the same utility distribution equipment. The booklet expects institutions to understand and document the utility infrastructure for both sites and assess whether a single utility failure could affect both.

Telecommunications independence. The alternate site should have telecommunications service from providers and physical infrastructure independent of the primary site’s connections. If both sites are served by the same central office, a central office failure affects both simultaneously.

What documentation looks like. For both sites: the utility providers (electric, telecom), the path of service into the facility, and any shared infrastructure that could create a single point of failure. For many community banks and credit unions using a regional branch or contracted hot site for recovery, the honest answer may be “we don’t know the infrastructure details of the alternate site.” That’s the gap to close.

The practical implication: if your alternate recovery site is a contracted hot site, the vendor should be able to provide documentation of its utility provider diversity. If they can’t, that should appear as a deficiency in your third-party resilience assessment and drive a contract amendment or vendor change.

Exercise vs. Test: Why the Distinction Matters

The 2026 booklet reinforces a distinction that has been in FFIEC guidance for years but frequently collapses in practice:

Exercises are structured discussions, walkthroughs, and awareness activities. A tabletop exercise is an exercise. A plan review is an exercise. Exercises test knowledge and identify plan gaps — they don’t verify that systems actually fail over.

Tests are actual activations. Failing systems over to the alternate site is a test. Running on backup communications is a test. Processing transactions from the recovery site is a test. Tests verify that the systems, connectivity, and procedures actually work under realistic conditions.

Most BCP programs run exercises and document them as tests. The 2026 booklet expects both — and expects that the testing program includes actual activation of critical systems in recovery mode, not just tabletop walkthroughs labeled as tests.

Examination findings cite this distinction specifically: a program that has only conducted tabletop exercises in the last two years, with no documented failover tests, does not have a complete testing program regardless of how detailed the exercise records are.

This isn’t entirely new guidance — the FFIEC has required actual testing for years. What’s new in 2026 is the examination focus on confirming that test records reflect actual system activation, not relabeled exercises.

Documentation: What Examiners Request

When an examiner reviews your BCP/BCM program for power and telecommunications resilience, the document request typically includes:

• Generator inventory and capacity analysis
• Generator test logs for the prior 12–18 months
• Telecom provider documentation for primary and alternate sites
• Evidence of path diversity for telecom connections
• Alternate site utility provider documentation
• Results of failover tests to alternate sites, including any systems that failed to recover
• Remediation tracking for any issues identified in tests

The absence of these documents is treated as the absence of a program. A generator that hasn’t been load-tested is an unverified assumption. An alternate site whose utility independence hasn’t been documented is an assumed resilience benefit that may not exist.

The Business Continuity & Disaster Recovery Kit includes generator testing log templates, telecom resilience documentation frameworks, alternate site assessment checklists, and the full BCP template structure aligned with 2026 FFIEC BCM Booklet requirements. If your program was built before the March 2026 update, the templates address what the updated examination standards specifically require.

So What? 5-Step Action Plan

Step 1: Pull your generator test logs. When was the last quarterly under-load test? When was the last annual full-load test? If you can’t locate documented results within the expected intervals, that’s a gap — find it before an examiner does.

Step 2: Document your telecom provider infrastructure. For each provider at your primary and alternate sites: who are they, and can you confirm the physical path doesn’t share a central office or conduit with the other provider? If you don’t know, get the documentation from your carriers directly.

Step 3: Verify alternate site utility independence. Can you confirm that your recovery site is on a different power utility segment and telecom infrastructure than your primary site? If it’s a contracted hot site, request the documentation from the vendor. If they can’t provide it, that’s a third-party resilience finding.

Step 4: Audit your test records against the exercise vs. test distinction. In the last 24 months, have you run actual failover tests — not just tabletop exercises? Document what was tested, which systems were activated in recovery mode, and what the results showed.

Step 5: Build out-of-band communications into your incident response plan. When your primary network is the thing that’s down, what system are you using to coordinate recovery? If the answer is unclear, the crisis communication plan framework for financial institutions addresses how to build that capability into BCP documentation.

Power outages and telecommunications failures are among the most common disruptions affecting financial institutions — more common than cyberattacks and natural disasters combined in terms of frequency. The 2026 FFIEC BCM Booklet didn’t add power and telecom resilience requirements because they’re theoretical risks. It added them because examination findings showed that programs were treating them as assumed strengths rather than documented, tested capabilities.