{
 "name": "FFIEC BCM booklet section map",
 "description": "All 55 sections of the FFIEC Business Continuity Management booklet (November 2019, edited February 2026), each with a quoted key expectation and its Appendix A examination objective, plus 7 tabletop scenarios mapped to the sections they test.",
 "page": "https://risktemplate.com/reference/ffiec-business-continuity-management-booklet/",
 "csv": "https://risktemplate.com/reference/data/ffiec-business-continuity-management-booklet.csv",
 "creator": "RiskTemplates (risktemplate.com)",
 "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
 "last_verified": "2026-10-14",
 "row_count": 55,
 "built_from": [
  "scripts/reference/ffiec_bcm_sections.json",
  "scripts/reference/sources/ffiec_bcm_2019_web.json",
  "scripts/reference/sources/ffiec_bcm_2026_edits.json",
  "scripts/templates/bcp_kit_spec.py (SCENARIOS)",
  "scripts/templates/bcp_kit_content.py (SCENARIO_DETAIL)",
  "scripts/templates/bcp_ttx_content.py (CARDS notices)"
 ],
 "disclaimer": "Reference summary, not legal advice. Quotes are from the FFIEC Business Continuity Management booklet; read each section in full at its official URL.",
 "booklet": {
  "title": "Business Continuity Management",
  "series": "FFIEC Information Technology Examination Handbook",
  "issued": "November 2019",
  "pages": 86,
  "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/",
  "pdf_url": "https://ithandbook.ffiec.gov/media/2nifgh2b/ffiec_itbooklet_businesscontinuitymanagement_v3.pdf",
  "replaced": "Business Continuity Planning booklet (February 2015)"
 },
 "revision_2026": {
  "whats_new": {
   "url": "https://ithandbook.ffiec.gov/whats-new",
   "date": "2026-02-27",
   "text": "In February 2026, the Federal Financial Institutions Examination Council, on behalf of its members, released updates to the FFIEC IT Handbook to remove references to reputational risk, consistent with Executive Order 14331 of August 7, 2025. The updates do not establish new requirements."
  },
  "pdf": {
   "url": "https://ithandbook.ffiec.gov/media/2nifgh2b/ffiec_itbooklet_businesscontinuitymanagement_v3.pdf",
   "modified": "2026-03-05",
   "cover_date": "November 2019",
   "pages": 86
  },
  "changes": [
   {
    "section": "III.A.3",
    "page": "iiia3-impact-of-disruption",
    "before": "Through the BIA process, management should evaluate the potential impact of disruptive events, including operational, financial, and reputational impacts.",
    "after": "Through the BIA process, management should evaluate the potential impacts of disruptive events, including operational, financial, and other impacts.",
    "title": "Impact of Disruption"
   },
   {
    "section": "III.B.2",
    "page": "iiib2-likelihood-and-impact",
    "before": "As part of the assessment, management should quantify the impacts and define loss criteria as either quantitative (financial) or qualitative (e.g., impact to customers, reputational impact).",
    "after": "As part of the assessment, management should quantify the impacts and define loss criteria as either quantitative (financial) or qualitative (e.g., impact to customers).",
    "title": "Likelihood and Impact"
   },
   {
    "section": "V.F.3",
    "page": "vf3-crisis-or-emergency-management",
    "before": "Management should consider the impact of a crisis or emergency on the entity’s reputation and personnel.",
    "after": "Management should consider the impact of a crisis or emergency on the entity and personnel.",
    "title": "Crisis or Emergency Management"
   }
  ],
  "checked": "2026-10-14"
 },
 "appendix_a_objectives": [
  {
   "n": 1,
   "text": "Determine the appropriate scope and objectives for the examination.",
   "section": null
  },
  {
   "n": 2,
   "text": "Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.",
   "section": "II.A"
  },
  {
   "n": 3,
   "text": "Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.",
   "section": "II.B"
  },
  {
   "n": 4,
   "text": "Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.",
   "section": "III.A"
  },
  {
   "n": 5,
   "text": "Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.",
   "section": "III.B"
  },
  {
   "n": 6,
   "text": "Determine whether the entity’s risk management strategies are designed to achieve resilience.",
   "section": "IV.A"
  },
  {
   "n": 7,
   "text": "Determine whether the entity’s BCM includes communication protocols.",
   "section": "IV.B"
  },
  {
   "n": 8,
   "text": "Assess the appropriateness of the entity’s enterprise-wide BCP.",
   "section": "V"
  },
  {
   "n": 9,
   "text": "Determine whether the BCM program includes training and awareness to educate stakeholders about the entity’s continuity objectives and BCM goals.",
   "section": "VI"
  },
  {
   "n": 10,
   "text": "Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",
   "section": "VII"
  },
  {
   "n": 11,
   "text": "Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.",
   "section": "VIII"
  },
  {
   "n": 12,
   "text": "Determine whether the board has established expectations for BCM reporting.",
   "section": "IX"
  },
  {
   "n": 13,
   "text": "Discuss corrective action and communicate findings.",
   "section": null
  }
 ],
 "rows": [
  {
   "id": "Introduction",
   "title": "Introduction",
   "part": "Intro",
   "level": 0,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/introduction/",
   "covers": "What the booklet is for, which entities it covers, and that it replaced the February 2015 \"Business Continuity Planning\" booklet.",
   "quote": "This booklet does not impose requirements on entities. Instead, this booklet describes practices that examiners may use to assess an entity’s BCM function.",
   "quote_partial": false,
   "app_a_objectives": [],
   "app_a_objective_text": "",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "I",
   "title": "Business Continuity Management",
   "part": "I",
   "level": 1,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/i-business-continuity-management/",
   "covers": "Defines business continuity management (BCM) as the process for overseeing resilience, continuity and response, aligned with strategy and the entity’s role in the financial sector.",
   "quote": "BCM is the process for management to oversee and implement resilience, continuity, and response capabilities to safeguard employees, customers, and products and services.",
   "quote_partial": false,
   "app_a_objectives": [],
   "app_a_objective_text": "",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "II",
   "title": "Business Continuity Management Governance",
   "part": "II",
   "level": 1,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/ii-business-continuity-management-governance/",
   "covers": "The governance elements: risk appetite, continuity levels, policy and plans, resources, competent management and performance monitoring.",
   "quote": "BCM governance should include: Aligning BCM practices with the risk appetite. Identifying the continuity level needed, consistent with the operation’s criticality.",
   "quote_partial": false,
   "app_a_objectives": [
    2,
    3
   ],
   "app_a_objective_text": "Objective 2: Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program. Objective 3: Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "II.A",
   "title": "Board and Senior Management Responsibilities",
   "part": "II",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/ii-business-continuity-management-governance/iia-board-and-senior-management-responsibilities/",
   "covers": "What board oversight and management oversight should include: accountability, resources, continuity objectives and acting on test results.",
   "quote": "The board and senior management govern business continuity through defining responsibilities and accountability, and by allocating adequate resources to business continuity.",
   "quote_partial": false,
   "app_a_objectives": [
    2
   ],
   "app_a_objective_text": "Objective 2: Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.",
   "evidence_source": "Appendix A",
   "evidence": "Providing a credible challenge to management responsible for the business continuity process (e.g., the board minutes provide evidence of active discussions).",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "II.B",
   "title": "Audit",
   "part": "II",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/ii-business-continuity-management-governance/iib-audit/",
   "covers": "Independent audit of the program’s design and operating effectiveness, reported to the board, including use of service organization control reports.",
   "quote": "The board and senior management should engage internal audit or independent personnel to review and validate the design and operating effectiveness of the BCM program.",
   "quote_partial": false,
   "app_a_objectives": [
    3
   ],
   "app_a_objective_text": "Objective 3: Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.",
   "evidence_source": "Appendix A",
   "evidence": "Determine whether audit leverages SOC reports and other external artifacts from third-party service providers, as appropriate.",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "III",
   "title": "Risk Management",
   "part": "III",
   "level": 1,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iii-risk-management/",
   "covers": "Places BCM inside enterprise risk management, with the business impact analysis (BIA) and risk assessment as its foundation.",
   "quote": "The BIA and risk assessment represent the foundation of BCM.",
   "quote_partial": false,
   "app_a_objectives": [
    4,
    5
   ],
   "app_a_objective_text": "Objective 4: Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact. Objective 5: Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "III.A",
   "title": "Business Impact Analysis",
   "part": "III",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iii-risk-management/iiia-business-impact-analysis/",
   "covers": "Identify and rank business functions, analyze interdependencies, assess the impact of a disruption and set recovery priorities.",
   "quote": "The BIA should define recovery priorities and resource dependencies for critical processes.",
   "quote_partial": false,
   "app_a_objectives": [
    4
   ],
   "app_a_objective_text": "Objective 4: Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.",
   "evidence_source": "Appendix A",
   "evidence": "Management may use the following artifacts to identify the functions: Organizational charts. Work flows (also called process maps). Interview notes. Network diagrams/topologies. Data flow diagrams.",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "III.A.1",
   "title": "Identification of Critical Business Functions",
   "part": "III",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iii-risk-management/iiia-business-impact-analysis/iiia1-identification-of-critical-business-functions/",
   "covers": "Inventory critical functions, assets, infrastructure and third-party service providers with a method that can be repeated after changes.",
   "quote": "The methodology used should be repeatable, allowing management to reevaluate information after significant changes.",
   "quote_partial": false,
   "app_a_objectives": [
    4
   ],
   "app_a_objective_text": "Objective 4: Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "III.A.2",
   "title": "Interdependency Analysis",
   "part": "III",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iii-risk-management/iiia-business-impact-analysis/iiia2-interdependency-analysis/",
   "covers": "Find single points of failure and dependencies on internal systems, third-party service providers, suppliers and partners, and align contracts with them.",
   "quote": "For pre-existing contracts and SLAs, management should confirm that the contract and SLA requirements align with management’s and the customer’s continuity and resilience expectations.",
   "quote_partial": false,
   "app_a_objectives": [
    4
   ],
   "app_a_objective_text": "Objective 4: Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [
    "TTX-03"
   ],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "III.A.3",
   "title": "Impact of Disruption",
   "part": "III",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iii-risk-management/iiia-business-impact-analysis/iiia3-impact-of-disruption/",
   "covers": "Set the recovery point objective (RPO), recovery time objective (RTO) and maximum tolerable downtime (MTD) from the impact of a disruption, and test interrelated RTOs.",
   "quote": "Management should consider interrelated RTOs for each business function to determine the total downtime caused by a disruption.",
   "quote_partial": false,
   "app_a_objectives": [
    4
   ],
   "app_a_objective_text": "Objective 4: Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [
    "TTX-01"
   ],
   "changed_2026": true,
   "last_verified": "2026-10-14"
  },
  {
   "id": "III.B",
   "title": "Risk Assessment",
   "part": "III",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iii-risk-management/iiib-risk-assessment/",
   "covers": "Assess the likelihood and impact of disruptions, including geographic and third-party threats, and choose risk treatments within risk appetite.",
   "quote": "Management should evaluate the likelihood and impact of potential disruptions and events.",
   "quote_partial": false,
   "app_a_objectives": [
    5
   ],
   "app_a_objective_text": "Objective 5: Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.",
   "evidence_source": "Appendix A",
   "evidence": "Review risk assessment(s) to determine whether management has identified all reasonably foreseeable hazards and threats to the continuity and resilience of the entity.",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "III.B.1",
   "title": "Risk Identification",
   "part": "III",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iii-risk-management/iiib-risk-assessment/iiib1-risk-identification/",
   "covers": "Identify natural, technological and human-caused threats, geographic and geopolitical risk, cyber risk, threat intelligence and supply-chain links.",
   "quote": "Management should address common operational functions in the business continuity plan (BCP) instead of having unique plans for every type of hazard or threat.",
   "quote_partial": false,
   "app_a_objectives": [
    5
   ],
   "app_a_objective_text": "Objective 5: Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "III.B.2",
   "title": "Likelihood and Impact",
   "part": "III",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iii-risk-management/iiib-risk-assessment/iiib2-likelihood-and-impact/",
   "covers": "Score likelihood and impact, include worst-case scenarios, and treat the gap between likely threats and current controls as the risk exposure.",
   "quote": "Worst-case scenarios, such as destruction of the facilities and loss of life, should be addressed.",
   "quote_partial": false,
   "app_a_objectives": [
    5
   ],
   "app_a_objective_text": "Objective 5: Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": true,
   "last_verified": "2026-10-14"
  },
  {
   "id": "IV",
   "title": "Business Continuity Strategies",
   "part": "IV",
   "level": 1,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iv-business-continuity-strategies/",
   "covers": "Risk-based strategies for personnel, processes, technology, facilities and data, developed after the BIA and risk assessment.",
   "quote": "Strategies should be validated to confirm that they are viable and sufficient for peak work volumes.",
   "quote_partial": false,
   "app_a_objectives": [
    6,
    7
   ],
   "app_a_objective_text": "Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience. Objective 7: Determine whether the entity’s BCM includes communication protocols.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "IV.A",
   "title": "Resilience",
   "part": "IV",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iv-business-continuity-strategies/iva-resilience/",
   "covers": "Resources for resilience: off-site repositories, backups, recovery infrastructure and the resilience of critical third-party service providers.",
   "quote": "The business strategy, not technology solutions, should drive resilience.",
   "quote_partial": false,
   "app_a_objectives": [
    6
   ],
   "app_a_objective_text": "Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "IV.A.1",
   "title": "Physical",
   "part": "IV",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iv-business-continuity-strategies/iva-resilience/iva1-physical/",
   "covers": "Diverse telecommunications lines, redundant branch-to-data-center links, backups, multiple power sources and geographically diverse sites.",
   "quote": "To avoid the potential for failures after a disruption, management, when possible, should diversify telecommunication lines, establish redundant connections between branches and data centers",
   "quote_partial": true,
   "app_a_objectives": [
    6
   ],
   "app_a_objective_text": "Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [
    "TTX-06"
   ],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "IV.A.2",
   "title": "Cyber Resilience",
   "part": "IV",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iv-business-continuity-strategies/iva-resilience/iva2-cyber-resilience/",
   "covers": "Staying operational through cyber attacks that can hit production and backups at once, secondary disruptions and simultaneous attacks.",
   "quote": "Given the broad and increasing spectrum of cyber threats, resilience measures should be flexible enough to adapt to a diverse range of events.",
   "quote_partial": false,
   "app_a_objectives": [
    6
   ],
   "app_a_objective_text": "Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [
    "TTX-02"
   ],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "IV.A.3",
   "title": "Data Backup and Replication",
   "part": "IV",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iv-business-continuity-strategies/iva-resilience/iva3-data-backup-and-replication/",
   "covers": "Backups, an off-site repository of software and configurations, synchronous and asynchronous replication, retention, and offline backups protected from malware.",
   "quote": "Entities should safeguard against replicating malware and data corruption.",
   "quote_partial": false,
   "app_a_objectives": [
    6
   ],
   "app_a_objective_text": "Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [
    "TTX-01",
    "TTX-02"
   ],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "IV.A.4",
   "title": "Personnel",
   "part": "IV",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iv-business-continuity-strategies/iva-resilience/iva4-personnel/",
   "covers": "Plan for mass absenteeism, staff who cannot reach facilities, and the basic needs of displaced employees.",
   "quote": "While any one employee’s role may not be designated as mission critical, management should plan for mass absenteeism during an event or disruption.",
   "quote_partial": false,
   "app_a_objectives": [
    6
   ],
   "app_a_objective_text": "Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [
    "TTX-04",
    "TTX-06"
   ],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "IV.A.5",
   "title": "Third-Party Service Providers",
   "part": "IV",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iv-business-continuity-strategies/iva-resilience/iva5-third-party-service-providers/",
   "covers": "Assess critical providers’ resilience, single-point-of-failure risk, the scope of their audit reports, and continuity terms in contracts and service-level agreements.",
   "quote": "Management should assess critical third-party service providers’ susceptibility to multiple event scenarios and verify such third parties’ resilience capabilities.",
   "quote_partial": false,
   "app_a_objectives": [
    6
   ],
   "app_a_objective_text": "Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience.",
   "evidence_source": "Appendix A",
   "evidence": "Reviewed third-party service provider’s resilience capabilities, including available test and SOC reports.",
   "evidence_partial": false,
   "tested_by": [
    "TTX-01",
    "TTX-03",
    "TTX-07"
   ],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "IV.A.6",
   "title": "Telecommunications",
   "part": "IV",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iv-business-continuity-strategies/iva-resilience/iva6-telecommunications/",
   "covers": "Telecommunications redundancy, \"last mile\" single points of failure, carrier paths, and the federal Telecommunications Service Priority, Government Emergency Telecommunications Service and Wireless Priority Service programs.",
   "quote": "Given the critical nature of telecommunications, management should ensure appropriate redundancy levels in the entity’s telecommunications infrastructure.",
   "quote_partial": false,
   "app_a_objectives": [
    6
   ],
   "app_a_objective_text": "Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [
    "TTX-06",
    "TTX-07"
   ],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "IV.A.7",
   "title": "Power",
   "part": "IV",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iv-business-continuity-strategies/iva-resilience/iva7-power/",
   "covers": "Short- and long-term power plans: alternate energy sources, fuel, generator load capacity, maintenance and testing.",
   "quote": "Furthermore, management should develop plans to provide electricity in the event of a long-term power disruption.",
   "quote_partial": false,
   "app_a_objectives": [
    6
   ],
   "app_a_objective_text": "Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [
    "TTX-06"
   ],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "IV.A.8",
   "title": "Change Management",
   "part": "IV",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iv-business-continuity-strategies/iva-resilience/iva8-change-management/",
   "covers": "Keep recovery systems and documentation in step with production changes, and control emergency changes made during an event.",
   "quote": "Even during events, changes should still be properly authorized, monitored, and documented.",
   "quote_partial": false,
   "app_a_objectives": [
    6
   ],
   "app_a_objective_text": "Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience.",
   "evidence_source": "Booklet",
   "evidence": "Change tickets and corresponding activity should be reviewed for appropriateness once the event has been resolved.",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "IV.B",
   "title": "Communications",
   "part": "IV",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/iv-business-continuity-strategies/ivb-communications/",
   "covers": "Several ways to reach staff, customers, regulators, responders and other external groups, with protocols and contact lists.",
   "quote": "BCM should include communication protocols and contact lists to notify stakeholders.",
   "quote_partial": false,
   "app_a_objectives": [
    7
   ],
   "app_a_objective_text": "Objective 7: Determine whether the entity’s BCM includes communication protocols.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [
    "TTX-02",
    "TTX-04",
    "TTX-05"
   ],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "V",
   "title": "Business Continuity Plan",
   "part": "V",
   "level": 1,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/v-business-continuity-plan/",
   "covers": "The written plan: authorities, responsibilities, procedures, relocation strategies and the components it should contain.",
   "quote": "Furthermore, the BCP should be a living document, regularly updated so that it remains current with system enhancements and organizational changes.",
   "quote_partial": false,
   "app_a_objectives": [
    8
   ],
   "app_a_objective_text": "Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "V.A",
   "title": "Event Management",
   "part": "V",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/v-business-continuity-plan/va-event-management/",
   "covers": "Definitions of events, disruptions and triggers, with escalation thresholds, reporting procedures and response teams.",
   "quote": "The BCP should include event management procedures that detail reasonably foreseeable event types and provide thresholds and responses.",
   "quote_partial": false,
   "app_a_objectives": [
    8
   ],
   "app_a_objective_text": "Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "V.B",
   "title": "Continuity and Recovery",
   "part": "V",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/v-business-continuity-plan/vb-continuity-and-recovery/",
   "covers": "Working during downtime: manual procedures, transaction tracking, alternate identity verification, and fraud and suspicious activity reporting.",
   "quote": "When appropriate, procedures should address manual steps for critical functions, such as back-office operations, loan operations, and customer support.",
   "quote_partial": false,
   "app_a_objectives": [
    8
   ],
   "app_a_objective_text": "Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "V.C",
   "title": "Facilities and Infrastructure",
   "part": "V",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/v-business-continuity-plan/vc-facilities-and-infrastructure/",
   "covers": "Alternatives for operations, facilities, suppliers, utilities and key personnel, with short-, medium- and long-term relocation.",
   "quote": "The BCP should identify alternatives for core operations, facilities, infrastructure systems, suppliers, utilities, interdependent business partners, and key personnel.",
   "quote_partial": false,
   "app_a_objectives": [
    8
   ],
   "app_a_objective_text": "Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [
    "TTX-01",
    "TTX-06"
   ],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "V.C.1",
   "title": "Data Center Recovery Alternatives",
   "part": "V",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/v-business-continuity-plan/vc-facilities-and-infrastructure/vc1-data-center-recovery-alternatives/",
   "covers": "Recovery site options (cold, warm, hot, mirrored, mobile, colocation, reciprocal agreement, disaster recovery as a service) and documenting the choice.",
   "quote": "While these arrangements may be acceptable as a short-term solution, management should not rely on them as a long-term recovery solution.",
   "quote_partial": false,
   "app_a_objectives": [
    8
   ],
   "app_a_objective_text": "Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.",
   "evidence_source": "Appendix A",
   "evidence": "Verify that management documents the reasons (e.g., cost and service level) for choosing recovery alternatives",
   "evidence_partial": true,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "V.C.2",
   "title": "Branch Relocation",
   "part": "V",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/v-business-continuity-plan/vc-facilities-and-infrastructure/vc2-branch-relocation/",
   "covers": "Temporarily limiting, closing or moving branch operations, which may need regulator approval.",
   "quote": "An important BCP component is establishing a physical location where personnel and customers can go to conduct business.",
   "quote_partial": false,
   "app_a_objectives": [
    8
   ],
   "app_a_objective_text": "Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "V.D",
   "title": "Payment Systems",
   "part": "V",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/v-business-continuity-plan/vd-payment-systems/",
   "covers": "Alternate arrangements when automated teller machines, funds transfers, electronic banking or remote deposit capture fail, and higher cash demand.",
   "quote": "The BCP should address alternate arrangements if payment systems fail (e.g., automated teller machines (ATM), funds transfers, electronic banking, remote deposit capture, or mobile capabilities).",
   "quote_partial": false,
   "app_a_objectives": [
    8
   ],
   "app_a_objective_text": "Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [
    "TTX-07"
   ],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "V.E",
   "title": "Liquidity Considerations",
   "part": "V",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/v-business-continuity-plan/ve-liquidity-considerations/",
   "covers": "Cash and liquidity needs during an event: emergency borrowing, cash delivery and emergency purchase authority.",
   "quote": "The BCP should detail processes to address potential cash and liquidity needs during adverse events.",
   "quote_partial": false,
   "app_a_objectives": [
    8
   ],
   "app_a_objective_text": "Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [
    "TTX-05",
    "TTX-06",
    "TTX-07"
   ],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "V.F",
   "title": "Other Components",
   "part": "V",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/v-business-continuity-plan/vf-other-components/",
   "covers": "Incident response, disaster recovery and crisis or emergency management as parts of the plan.",
   "quote": "The BCP may incorporate other plans and procedures to minimize a disruption’s impact.",
   "quote_partial": false,
   "app_a_objectives": [
    8
   ],
   "app_a_objective_text": "Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "V.F.1",
   "title": "Incident Response",
   "part": "V",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/v-business-continuity-plan/vf-other-components/vf1-incident-response/",
   "covers": "Incident response priorities, communications with stakeholders and the media, prearranged forensic services and periodic testing.",
   "quote": "Management should periodically update and test the entity’s incident response program to verify that it functions as intended, given rapidly changing threats.",
   "quote_partial": false,
   "app_a_objectives": [
    8
   ],
   "app_a_objective_text": "Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [
    "TTX-02"
   ],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "V.F.2",
   "title": "Disaster Recovery",
   "part": "V",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/v-business-continuity-plan/vf-other-components/vf2-disaster-recovery/",
   "covers": "Restoring IT infrastructure, data and systems in priority order, including backlogged and lost transactions.",
   "quote": "Disaster recovery should address guidelines for returning operations back to a normalized state with minimum disruption.",
   "quote_partial": false,
   "app_a_objectives": [
    8
   ],
   "app_a_objective_text": "Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [
    "TTX-02"
   ],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "V.F.3",
   "title": "Crisis or Emergency Management",
   "part": "V",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/v-business-continuity-plan/vf-other-components/vf3-crisis-or-emergency-management/",
   "covers": "Recognizing a crisis, activating the plan, designated decision-makers, and contact lists that are kept current.",
   "quote": "The contact list should be distributed and accessible to key personnel and should be verified and updated regularly.",
   "quote_partial": false,
   "app_a_objectives": [
    8
   ],
   "app_a_objective_text": "Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [
    "TTX-05"
   ],
   "changed_2026": true,
   "last_verified": "2026-10-14"
  },
  {
   "id": "VI",
   "title": "Training",
   "part": "VI",
   "level": 1,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/vi-training/",
   "covers": "Risk-based, multi-year training for the board, management, process owners and frontline staff, updated as the program changes.",
   "quote": "The training program should include conditions for activating the BCP and what to do when key personnel are unavailable.",
   "quote_partial": false,
   "app_a_objectives": [
    9
   ],
   "app_a_objective_text": "Objective 9: Determine whether the BCM program includes training and awareness to educate stakeholders about the entity’s continuity objectives and BCM goals.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [
    "TTX-04"
   ],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "VII",
   "title": "Exercises and Tests",
   "part": "VII",
   "level": 1,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/vii-exercises-and-tests/",
   "covers": "The difference between exercises (people, processes and systems) and tests (specific aspects of a system), and what examiners review.",
   "quote": "Effectively, the distinction between the two is that exercises address people, processes, and systems whereas tests address specific aspects of a system.",
   "quote_partial": false,
   "app_a_objectives": [
    10
   ],
   "app_a_objective_text": "Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "VII.A",
   "title": "Exercise and Test Program",
   "part": "VII",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/vii-exercises-and-tests/viia-exercise-and-test-program/",
   "covers": "A program and schedule covering every process and system component, run at appropriate intervals and after significant changes.",
   "quote": "Exercises and tests should occur either at appropriate intervals, when new risks are identified, or when significant changes affect the entity’s operating environment.",
   "quote_partial": false,
   "app_a_objectives": [
    10
   ],
   "app_a_objective_text": "Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",
   "evidence_source": "Appendix A",
   "evidence": "Assess whether the entity’s consolidated exercise and test schedule is reflective of exercise and test objectives and the overall exercise and test universe.",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "VII.B",
   "title": "Exercise and Test Policy",
   "part": "VII",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/vii-exercises-and-tests/viib-exercise-and-test-policy/",
   "covers": "What the policy should set: roles, minimum frequency, scope, reporting, documentation, fixing deficiencies and third-party testing.",
   "quote": "Establish minimum frequency, scope, and reporting requirements.",
   "quote_partial": false,
   "app_a_objectives": [
    10
   ],
   "app_a_objective_text": "Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "VII.C",
   "title": "Exercise and Test Strategies",
   "part": "VII",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/vii-exercises-and-tests/viic-exercise-and-test-strategies/",
   "covers": "Multi-year strategies that prove connectivity, functionality, volume and capacity at alternate facilities, including outsourced activities.",
   "quote": "Management should test all aspects of the entity’s BCP.",
   "quote_partial": false,
   "app_a_objectives": [
    10
   ],
   "app_a_objective_text": "Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "VII.D",
   "title": "Exercise and Test Objectives",
   "part": "VII",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/vii-exercises-and-tests/viid-exercise-and-test-objectives/",
   "covers": "Objectives for exercises and tests: recovery within RTOs, RPOs and MTDs, familiar staff, and identified gaps.",
   "quote": "As the exercise and test process matures, it should become increasingly complex up to and including full-scale recovery exercises.",
   "quote_partial": false,
   "app_a_objectives": [
    10
   ],
   "app_a_objective_text": "Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "VII.E",
   "title": "Exercise and Test Plans",
   "part": "VII",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/vii-exercises-and-tests/viie-exercise-and-test-plans/",
   "covers": "Plans with scenario, assumptions, metrics, roles, schedule and escalation; results reviewed, used to update the plan and reported to the board.",
   "quote": "Exercises and test plans should include metrics to assess whether objectives are met.",
   "quote_partial": false,
   "app_a_objectives": [
    10
   ],
   "app_a_objective_text": "Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",
   "evidence_source": "Booklet",
   "evidence": "Management should review the exercise and test results, update the BCP where appropriate, and report the results to the board or board-designated committee.",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "VII.F",
   "title": "Exercise and Test Scenarios",
   "part": "VII",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/vii-exercises-and-tests/viif-exercise-and-test-scenarios/",
   "covers": "Realistic, risk-based scenarios, including third-party and cyber events, using only the resources available in a real event, with written scripts.",
   "quote": "To the extent possible, scenarios should include only resources that would be available during an event (e.g., backup files or equipment at the alternate site).",
   "quote_partial": false,
   "app_a_objectives": [
    10
   ],
   "app_a_objective_text": "Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",
   "evidence_source": "Appendix A",
   "evidence": "Verify that exercise and test scripts document the procedures for executing the exercise or test",
   "evidence_partial": true,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "VII.G",
   "title": "Exercise and Test Methods",
   "part": "VII",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/vii-exercises-and-tests/viig-exercise-and-test-methods/",
   "covers": "Choosing methods by size, complexity and business; more rigorous methods and frequency give more confidence.",
   "quote": "Rigorous exercise methods and increased frequency help provide greater confidence in the continuity and resilience of business functions.",
   "quote_partial": false,
   "app_a_objectives": [
    10
   ],
   "app_a_objective_text": "Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "VII.G.1",
   "title": "Full-Scale Exercise",
   "part": "VII",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/vii-exercises-and-tests/viig-exercise-and-test-methods/viig1-full-scale-exercise/",
   "covers": "Uses all available people and systems to recover every critical system at the alternate site, for example simulating loss of the primary facilities.",
   "quote": "A full-scale exercise simulates full use of available resources (personnel and systems) prompting a full recovery of business processes.",
   "quote_partial": false,
   "app_a_objectives": [
    10
   ],
   "app_a_objective_text": "Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "VII.G.2",
   "title": "Limited-Scale Exercise",
   "part": "VII",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/vii-exercises-and-tests/viig-exercise-and-test-methods/viig2-limited-scale-exercise/",
   "covers": "Recovers targeted business processes with the people and systems involved; gives a limited view of interconnectivity and capacity.",
   "quote": "A limited-scale exercise is a simulation involving applicable resources (personnel and systems) to recover targeted business processes.",
   "quote_partial": false,
   "app_a_objectives": [
    10
   ],
   "app_a_objective_text": "Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "VII.G.3",
   "title": "Tabletop Exercise",
   "part": "VII",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/vii-exercises-and-tests/viig-exercise-and-test-methods/viig3-tabletop-exercise/",
   "covers": "A discussion-based walk-through of roles and responses that checks plans are reasonable and compatible, but cannot prove recovery on its own.",
   "quote": "By themselves, tabletop exercises are likely insufficient to validate recovery capabilities, because they are limited to a discussion-based analysis of policies and procedures.",
   "quote_partial": false,
   "app_a_objectives": [
    10
   ],
   "app_a_objective_text": "Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "VII.G.4",
   "title": "Tests",
   "part": "VII",
   "level": 3,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/vii-exercises-and-tests/viig-exercise-and-test-methods/viig4-tests/",
   "covers": "Measurable tests of system resilience against the plan and recovery objectives, with defined success criteria.",
   "quote": "Test methodologies and frequencies should align with the risk associated with the business function as well as the entity’s testing strategies and objectives.",
   "quote_partial": false,
   "app_a_objectives": [
    10
   ],
   "app_a_objective_text": "Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "VII.H",
   "title": "Industry Exercises and Resilience",
   "part": "VII",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/vii-exercises-and-tests/viih-industry-exercises-and-resilience/",
   "covers": "Sector-wide exercises such as the Treasury Department’s Hamilton Series, and Treasury’s public Financial Sector Cyber Exercise Template.",
   "quote": "There are several methods for entities of all sizes to participate, such as through third-party service provider user groups or industry initiatives.",
   "quote_partial": false,
   "app_a_objectives": [
    10
   ],
   "app_a_objective_text": "Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "VII.I",
   "title": "Third-Party Service Provider Testing",
   "part": "VII",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/vii-exercises-and-tests/viii-third-party-service-provider-testing/",
   "covers": "Include critical providers in the test program, secure the contractual right to test, and obtain their results and remediation plans.",
   "quote": "Management should actively participate in the entity’s third-party service providers’ testing programs and should verify that testing strategies include likely significant disruptive events.",
   "quote_partial": false,
   "app_a_objectives": [
    10
   ],
   "app_a_objective_text": "Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",
   "evidence_source": "Booklet",
   "evidence": "Management should request and receive test results and reports, remediation action plans and status reports upon their completion, and related analysis or modeling.",
   "evidence_partial": false,
   "tested_by": [
    "TTX-03"
   ],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "VII.J",
   "title": "Testing for Core and Significant Firms",
   "part": "VII",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/vii-exercises-and-tests/viij-testing-for-core-and-significant-firms/",
   "covers": "Testing for firms that clear and settle in critical financial markets, under the 2003 interagency Sound Practices Paper.",
   "quote": "Exercise and testing activities should confirm that such critical clearing and settlement activities could be recovered within RTOs.",
   "quote_partial": false,
   "app_a_objectives": [
    10
   ],
   "app_a_objective_text": "Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",
   "evidence_source": "",
   "evidence": "",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "VII.K",
   "title": "Post-Exercise and Post-Test Actions",
   "part": "VII",
   "level": 2,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/vii-exercises-and-tests/viik-post-exercise-and-post-test-actions/",
   "covers": "Document issues, set action plans with target dates, retest fixes, update the plan and report to the board.",
   "quote": "Management should document issues identified during exercises and tests and create action plans with target dates for resolving issues.",
   "quote_partial": false,
   "app_a_objectives": [
    10
   ],
   "app_a_objective_text": "Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.",
   "evidence_source": "Booklet",
   "evidence": "Exercise and test results may include the following documentation: Dates and locations. An executive summary comparing objectives and results.",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "VIII",
   "title": "Maintenance and Improvement",
   "part": "VIII",
   "level": 1,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/viii-maintenance-and-improvement/",
   "covers": "Regular review of the program on defined triggers, lessons learned from events, and version control of key documents.",
   "quote": "Because risks and technology often change, management should regularly review and update the business continuity program to reflect the current environment.",
   "quote_partial": false,
   "app_a_objectives": [
    11
   ],
   "app_a_objective_text": "Objective 11: Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.",
   "evidence_source": "Booklet",
   "evidence": "The BCM documentation should include evidence substantiating periodic updates of the BIA, risk assessment, and BCP(s).",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  },
  {
   "id": "IX",
   "title": "Board Reporting",
   "part": "IX",
   "level": 1,
   "url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/ix-board-reporting/",
   "covers": "Regular written reports to the board on the BIA, risk assessment, plan, test results and issues, with minutes that show challenge and approvals.",
   "quote": "Board minutes should reflect business continuity discussion (including credible challenges) and approvals.",
   "quote_partial": false,
   "app_a_objectives": [
    12
   ],
   "app_a_objective_text": "Objective 12: Determine whether the board has established expectations for BCM reporting.",
   "evidence_source": "Appendix A",
   "evidence": "Review board minutes to determine whether management periodically reports to the board on the status of BCM.",
   "evidence_partial": false,
   "tested_by": [],
   "changed_2026": false,
   "last_verified": "2026-10-14"
  }
 ],
 "scenario_count": 7,
 "scenarios": [
  {
   "id": "TTX-01",
   "title": "Cloud region outage",
   "summary": "The cloud region that hosts production fails for most of a business day; zone redundancy does not help and failover to the secondary region has never run at full production load.",
   "booklet_sections": [
    {
     "id": "III.A.3",
     "label": "III.A.3 Impact of Disruption (interrelated RTOs)"
    },
    {
     "id": "IV.A.3",
     "label": "IV.A.3 Data Backup and Replication"
    },
    {
     "id": "IV.A.5",
     "label": "IV.A.5 Third-Party Service Providers"
    },
    {
     "id": "V.C",
     "label": "V.C Facilities and Infrastructure (data center recovery alternatives)"
    }
   ],
   "notices": [
    {
     "sender": "Fintech or BaaS platform serving a bank (bank service provider)",
     "recipient": "Each affected bank's designated contact",
     "trigger": "Determination that a computer-security incident (including harm to availability) has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services for four or more hours",
     "clock": "As soon as possible after that determination (can be before 4 hours have passed)",
     "source": "12 CFR 53.4"
    },
    {
     "sender": "Fintech",
     "recipient": "Its bank partner",
     "trigger": "As defined in the program agreement (often broader than 53.4)",
     "clock": "As the contract says",
     "source": "Program agreement"
    },
    {
     "sender": "Bank (if you are one)",
     "recipient": "Its primary federal regulator",
     "trigger": "Notification incident: a computer-security incident that has materially disrupted or degraded, or is reasonably likely to, its ability to serve a material portion of its customers, a material business line, or operations whose failure would threaten US financial stability (12 CFR 53.2(b)(7))",
     "clock": "As soon as possible, no later than 36 hours after determination",
     "source": "12 CFR 53.3"
    }
   ],
   "other_references": [
    "12 CFR 53.4 if you are a bank service provider (notify affected bank customers)"
   ],
   "note": "",
   "decisions_to_test": "When to declare and fail over; what to tell the bank partner and customers; whether to pause money movement.",
   "participants": "Chief Technology Officer, site reliability, payments operations, communications, compliance",
   "suggested_method": "Failover test or limited-scale exercise"
  },
  {
   "id": "TTX-02",
   "title": "Ransomware",
   "summary": "Ransomware encrypts production servers and file shares overnight; backups exist, but one backup set may also be compromised and the attacker claims to have copied customer data.",
   "booklet_sections": [
    {
     "id": "IV.A.2",
     "label": "IV.A.2 Cyber Resilience"
    },
    {
     "id": "IV.A.3",
     "label": "IV.A.3 Data Backup and Replication"
    },
    {
     "id": "V.F.1",
     "label": "V.F.1 Incident Response"
    },
    {
     "id": "V.F.2",
     "label": "V.F.2 Disaster Recovery"
    },
    {
     "id": "IV.B",
     "label": "IV.B Communications"
    }
   ],
   "notices": [
    {
     "sender": "Fintech or BaaS platform serving a bank (bank service provider)",
     "recipient": "Each affected bank's designated contact",
     "trigger": "Determination that a computer-security incident (including harm to availability) has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services for four or more hours",
     "clock": "As soon as possible after that determination (can be before 4 hours have passed)",
     "source": "12 CFR 53.4"
    },
    {
     "sender": "NYDFS-covered entity",
     "recipient": "The superintendent",
     "trigger": "Cybersecurity incident at the entity, an affiliate or a third-party service provider",
     "clock": "No later than 72 hours after determination",
     "source": "23 NYCRR 500.17(a)"
    },
    {
     "sender": "NYDFS-covered entity that makes an extortion payment",
     "recipient": "The superintendent (electronically, on the DFS form)",
     "trigger": "An extortion (ransom) payment made in connection with a cybersecurity event",
     "clock": "Notice within 24 hours of the payment; written explanation within 30 days",
     "source": "23 NYCRR 500.17(c)"
    },
    {
     "sender": "Non-bank financial institution under Federal Trade Commission (FTC) jurisdiction (for example a non-bank lender)",
     "recipient": "The Federal Trade Commission (electronic form on ftc.gov)",
     "trigger": "Notification event (unencrypted customer information acquired without authorization) involving the information of at least 500 consumers",
     "clock": "As soon as possible, no later than 30 days after discovery",
     "source": "16 CFR 314.4(j)"
    },
    {
     "sender": "Fintech",
     "recipient": "Its bank partner",
     "trigger": "As defined in the program agreement (often broader than 53.4)",
     "clock": "As the contract says",
     "source": "Program agreement"
    },
    {
     "sender": "Bank (if you are one)",
     "recipient": "Its primary federal regulator",
     "trigger": "Notification incident: a computer-security incident that has materially disrupted or degraded, or is reasonably likely to, its ability to serve a material portion of its customers, a material business line, or operations whose failure would threaten US financial stability (12 CFR 53.2(b)(7))",
     "clock": "As soon as possible, no later than 36 hours after determination",
     "source": "12 CFR 53.3"
    }
   ],
   "other_references": [
    "23 NYCRR 500.16 (plans must address ransomware; annual testing including restoring from backups)",
    "16 CFR 314.4(h) (FTC Safeguards Rule incident response plan)",
    "12 CFR 53.3 / 53.4 notification"
   ],
   "note": "The booklet does not use the word \"ransomware\"; it covers the threat under cyber resilience and data backup. NYDFS 500.16 names ransomware explicitly.",
   "decisions_to_test": "Isolate or keep running; which backups are clean; ransom decision rights; notices and their deadlines.",
   "participants": "Executives, Chief Information Security Officer, technology, legal, compliance, communications, insurance contact",
   "suggested_method": "Tabletop exercise, then a backup restoration test"
  },
  {
   "id": "TTX-03",
   "title": "Critical vendor / core processor failure",
   "summary": "The core processor (or banking-as-a-service middleware provider) goes down for several days, or fails as a business, and the ledger of record is unavailable or cannot be reconciled.",
   "booklet_sections": [
    {
     "id": "III.A.2",
     "label": "III.A.2 Interdependency Analysis"
    },
    {
     "id": "IV.A.5",
     "label": "IV.A.5 Third-Party Service Providers"
    },
    {
     "id": "VII.I",
     "label": "VII.I Third-Party Service Provider Testing"
    }
   ],
   "notices": [
    {
     "sender": "Fintech",
     "recipient": "Its bank partner",
     "trigger": "As defined in the program agreement (often broader than 53.4)",
     "clock": "As the contract says",
     "source": "Program agreement"
    },
    {
     "sender": "The middleware provider (the bank service provider to Bank A), not you",
     "recipient": "Bank A's designated contact",
     "trigger": "Only a computer-security incident counts; a business failure or bankruptcy on its own is not one",
     "clock": "As soon as possible after determination",
     "source": "12 CFR 53.4 (the provider's duty)"
    },
    {
     "sender": "Bank (if you are one)",
     "recipient": "Its primary federal regulator",
     "trigger": "Notification incident: a computer-security incident that has materially disrupted or degraded, or is reasonably likely to, its ability to serve a material portion of its customers, a material business line, or operations whose failure would threaten US financial stability (12 CFR 53.2(b)(7))",
     "clock": "As soon as possible, no later than 36 hours after determination",
     "source": "12 CFR 53.3"
    }
   ],
   "other_references": [
    "2023 Interagency Guidance on Third-Party Relationships (business continuity in contracts)",
    "12 CFR 53.4"
   ],
   "note": "",
   "decisions_to_test": "How long to wait for the vendor; manual processing limits; how to reconcile balances; customer access to funds.",
   "participants": "Executives, operations, finance, compliance, legal, the vendor or bank partner",
   "suggested_method": "Tabletop exercise or joint test with third party"
  },
  {
   "id": "TTX-04",
   "title": "Key personnel unavailability / pandemic",
   "summary": "A contagious illness or a single event takes out a large share of staff, including two people who are the only ones able to run a Mission Critical process.",
   "booklet_sections": [
    {
     "id": "IV.A.4",
     "label": "IV.A.4 Personnel"
    },
    {
     "id": "VI",
     "label": "VI Training"
    },
    {
     "id": "IV.B",
     "label": "IV.B Communications"
    }
   ],
   "notices": [
    {
     "sender": "Fintech",
     "recipient": "Its bank partner",
     "trigger": "As defined in the program agreement (often broader than 53.4)",
     "clock": "As the contract says",
     "source": "Program agreement"
    }
   ],
   "other_references": [
    "Interagency Statement on Pandemic Planning (March 2020), cited in the booklet references"
   ],
   "note": "",
   "decisions_to_test": "Who can approve and execute critical steps; minimum staffing; what stops first.",
   "participants": "Chief Operating Officer, Human Resources, process owners",
   "suggested_method": "Tabletop exercise"
  },
  {
   "id": "TTX-05",
   "title": "Social-media-driven deposit run",
   "summary": "A rumor about the bank (or the fintech's sponsor bank) spreads on social media and withdrawal requests spike within hours, faster than the contingency funding plan assumed.",
   "booklet_sections": [
    {
     "id": "V.E",
     "label": "V.E Liquidity Considerations"
    },
    {
     "id": "IV.B",
     "label": "IV.B Communications"
    },
    {
     "id": "V.F.3",
     "label": "V.F.3 Crisis or Emergency Management"
    }
   ],
   "notices": [
    {
     "sender": "Bank",
     "recipient": "Its supervisory office (primary federal regulator; state regulator if state-chartered)",
     "trigger": "Liquidity stress, as agreed with supervisors (not a computer-security incident notice)",
     "clock": "Promptly, per supervisory expectations",
     "source": "Supervisory relationship; funding and liquidity addendum (2023)"
    },
    {
     "sender": "Fintech (sponsor bank under stress)",
     "recipient": "Its bank partner before any public statement about the bank",
     "trigger": "Any customer communication that mentions the bank",
     "clock": "Before publication",
     "source": "Program agreement"
    }
   ],
   "other_references": [
    "Addendum to the Interagency Policy Statement on Funding and Liquidity Risk Management: contingency funding plans (July 28, 2023)",
    "Interagency Sound Practices to Strengthen Operational Resilience (SR 20-24; directed to the largest firms)"
   ],
   "note": "",
   "decisions_to_test": "Funding sources and when to use them; withdrawal handling; public statements and their timing.",
   "participants": "Executives, Chief Financial Officer or treasury, communications, compliance, the bank (or sponsor bank)",
   "suggested_method": "Tabletop exercise"
  },
  {
   "id": "TTX-06",
   "title": "Regional natural disaster (hurricane)",
   "summary": "A hurricane makes landfall near headquarters and the primary operations site: power and telecommunications are out for days, staff are evacuating and branches or offices are closed.",
   "booklet_sections": [
    {
     "id": "IV.A.1",
     "label": "IV.A.1 Physical"
    },
    {
     "id": "IV.A.4",
     "label": "IV.A.4 Personnel"
    },
    {
     "id": "IV.A.6",
     "label": "IV.A.6 Telecommunications"
    },
    {
     "id": "IV.A.7",
     "label": "IV.A.7 Power"
    },
    {
     "id": "V.C",
     "label": "V.C Facilities and Infrastructure (branch relocation)"
    },
    {
     "id": "V.E",
     "label": "V.E Liquidity Considerations (cash needs)"
    }
   ],
   "notices": [
    {
     "sender": "Fintech",
     "recipient": "Its bank partner",
     "trigger": "As defined in the program agreement (often broader than 53.4)",
     "clock": "As the contract says",
     "source": "Program agreement"
    },
    {
     "sender": "Bank (if branches close)",
     "recipient": "Customers and, where required, its regulator",
     "trigger": "Branch or office closure",
     "clock": "Per agency rules for the closure",
     "source": "Your regulator's branch closure rules (confirm with counsel)"
    }
   ],
   "other_references": [
    "ISO 22301:2019 Amendment 1:2024 (climate change considerations)"
   ],
   "note": "",
   "decisions_to_test": "When to close the site; staff safety and relocation; which work moves to other sites; cash and branch needs.",
   "participants": "Executives, facilities, Human Resources, technology, operations",
   "suggested_method": "Tabletop exercise or limited-scale exercise (work from alternate site)"
  },
  {
   "id": "TTX-07",
   "title": "Payment rail disruption (Fedwire / FedACH / card network outage)",
   "summary": "A payment rail you depend on (Fedwire Funds, FedACH or a card network) is down or delayed on a high-volume day, close to a settlement deadline.",
   "booklet_sections": [
    {
     "id": "V.D",
     "label": "V.D Payment Systems"
    },
    {
     "id": "V.E",
     "label": "V.E Liquidity Considerations"
    },
    {
     "id": "IV.A.5",
     "label": "IV.A.5 Third-Party Service Providers"
    },
    {
     "id": "IV.A.6",
     "label": "IV.A.6 Telecommunications"
    }
   ],
   "notices": [
    {
     "sender": "Fintech",
     "recipient": "Its bank partner",
     "trigger": "As defined in the program agreement (often broader than 53.4)",
     "clock": "As the contract says",
     "source": "Program agreement"
    },
    {
     "sender": "Account-holding institution",
     "recipient": "Consumer who reported an error",
     "trigger": "Notice of error on an electronic fund transfer",
     "clock": "Investigate within 10 business days (up to 45 days with provisional credit); longer for new accounts (20 business days / 90 days), point-of-sale debit card and foreign-initiated transfers (90 days)",
     "source": "12 CFR 1005.11(c)"
    }
   ],
   "other_references": [
    "Federal Reserve Financial Services operating hours and processing schedules (check the current schedule; times change)"
   ],
   "note": "",
   "decisions_to_test": "Hold, reroute or resubmit; customer cutoffs; liquidity for delayed settlement.",
   "participants": "Payments operations, treasury, the bank or correspondent, communications",
   "suggested_method": "Tabletop exercise or limited-scale exercise"
  }
 ],
 "scenarios_note": "Tabletop scenarios from the RiskTemplates BCP/DR Kit (version 2026.10.2): summary, booklet sections exercised, notices each can trigger, decisions to test and participants. Injects and facilitator material are in the kit."
}