Free reference 55 booklet sections

What does the FFIEC Business Continuity Management booklet expect, section by section?

Name: FFIEC BCM booklet section map
Creator: RiskTemplates
License: https://creativecommons.org/licenses/by/4.0/

Short answer

The Federal Financial Institutions Examination Council (FFIEC) Business Continuity Management (BCM) booklet, dated November 2019, has 55 sections and subsections, from governance (II) and the business impact analysis (III.A) to exercises and tests (VII) and board reporting (IX). It is still the current booklet: a February 2026 update removed its references to reputational risk, rewording 3 sentences (III.A.3, III.B.2 and V.F.3), and the FFIEC said "The updates do not establish new requirements."

The booklet sets no fixed testing frequency; the exercise and test policy should "Establish minimum frequency, scope, and reporting requirements." (VII.B). Appendix A turns the sections into 13 examination objectives, and the 7 tabletop scenarios below show which sections each one tests.

Last verified: October 14, 2026

Download CSV JSON

How to use this Sources

What changed in February 2026

The FFIEC's What's New entry dated February 27, 2026 reads:

"In February 2026, the Federal Financial Institutions Examination Council, on behalf of its members, released updates to the FFIEC IT Handbook to remove references to reputational risk, consistent with Executive Order 14331 of August 7, 2025. The updates do not establish new requirements."

In this booklet the update changed 3 sentences. Nothing else in the wording changed. The booklet PDF at the same address was reissued (file dated March 5, 2026) and still shows "November 2019" on its 86 pages.

III.A.3 Impact of Disruption

Before (2019)

~~Through the BIA process, management should evaluate the potential impact of disruptive events, including operational, financial, and reputational impacts.~~

Now

Through the BIA process, management should evaluate the potential impacts of disruptive events, including operational, financial, and other impacts.

III.B.2 Likelihood and Impact

Before (2019)

~~As part of the assessment, management should quantify the impacts and define loss criteria as either quantitative (financial) or qualitative (e.g., impact to customers, reputational impact).~~

Now

As part of the assessment, management should quantify the impacts and define loss criteria as either quantitative (financial) or qualitative (e.g., impact to customers).

V.F.3 Crisis or Emergency Management

Before (2019)

~~Management should consider the impact of a crisis or emergency on the entity’s reputation and personnel.~~

Now

Management should consider the impact of a crisis or emergency on the entity and personnel.

All 55 sections

One row per section and subsection of the November 2019 booklet. Each section links to its page on ithandbook.ffiec.gov. The key expectation is a direct quote; "…" marks a quote that stops mid-sentence.

Abbreviations in the quotes: BCM, business continuity management; BCP, business continuity plan; BIA, business impact analysis; RTO, recovery time objective; RPO, recovery point objective; MTD, maximum tolerable downtime; SLA, service-level agreement; SOC, system and organization controls (audit reports on a service provider's controls); ATM, automated teller machine.

FFIEC Business Continuity Management booklet sections with key expectations and Appendix A objectives, last verified October 14, 2026
Section	What it covers	Key expectation (quote)	Appendix A	Evidence named	Tabletop scenarios
Introduction	What the booklet is for, which entities it covers, and that it replaced the February 2015 "Business Continuity Planning" booklet.	"This booklet does not impose requirements on entities. Instead, this booklet describes practices that examiners may use to assess an entity’s BCM function."	Not cross-referenced	Not named in this section	None
I Business Continuity Management	Defines business continuity management (BCM) as the process for overseeing resilience, continuity and response, aligned with strategy and the entity’s role in the financial sector.	"BCM is the process for management to oversee and implement resilience, continuity, and response capabilities to safeguard employees, customers, and products and services."	Not cross-referenced	Not named in this section	None
II Business Continuity Management Governance	The governance elements: risk appetite, continuity levels, policy and plans, resources, competent management and performance monitoring.	"BCM governance should include: Aligning BCM practices with the risk appetite. Identifying the continuity level needed, consistent with the operation’s criticality."	Objectives 2 and 3 Objective text Objective 2: Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program. Objective 3: Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.	Not named in this section	None
II.A Board and Senior Management Responsibilities	What board oversight and management oversight should include: accountability, resources, continuity objectives and acting on test results.	"The board and senior management govern business continuity through defining responsibilities and accountability, and by allocating adequate resources to business continuity."	Objective 2 Objective text Objective 2: Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program.	"Providing a credible challenge to management responsible for the business continuity process (e.g., the board minutes provide evidence of active discussions)." Appendix A	None
II.B Audit	Independent audit of the program’s design and operating effectiveness, reported to the board, including use of service organization control reports.	"The board and senior management should engage internal audit or independent personnel to review and validate the design and operating effectiveness of the BCM program."	Objective 3 Objective text Objective 3: Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program.	"Determine whether audit leverages SOC reports and other external artifacts from third-party service providers, as appropriate." Appendix A	None
III Risk Management	Places BCM inside enterprise risk management, with the business impact analysis (BIA) and risk assessment as its foundation.	"The BIA and risk assessment represent the foundation of BCM."	Objectives 4 and 5 Objective text Objective 4: Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact. Objective 5: Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.	Not named in this section	None
III.A Business Impact Analysis	Identify and rank business functions, analyze interdependencies, assess the impact of a disruption and set recovery priorities.	"The BIA should define recovery priorities and resource dependencies for critical processes."	Objective 4 Objective text Objective 4: Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.	"Management may use the following artifacts to identify the functions: Organizational charts. Work flows (also called process maps). Interview notes. Network diagrams/topologies. Data flow diagrams." Appendix A	None
III.A.1 Identification of Critical Business Functions	Inventory critical functions, assets, infrastructure and third-party service providers with a method that can be repeated after changes.	"The methodology used should be repeatable, allowing management to reevaluate information after significant changes."	Objective 4 Objective text Objective 4: Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.	Not named in this section	None
III.A.2 Interdependency Analysis	Find single points of failure and dependencies on internal systems, third-party service providers, suppliers and partners, and align contracts with them.	"For pre-existing contracts and SLAs, management should confirm that the contract and SLA requirements align with management’s and the customer’s continuity and resilience expectations."	Objective 4 Objective text Objective 4: Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.	Not named in this section	TTX-03
III.A.3 Impact of Disruption Edited Feb 2026	Set the recovery point objective (RPO), recovery time objective (RTO) and maximum tolerable downtime (MTD) from the impact of a disruption, and test interrelated RTOs.	"Management should consider interrelated RTOs for each business function to determine the total downtime caused by a disruption."	Objective 4 Objective text Objective 4: Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact.	Not named in this section	TTX-01
III.B Risk Assessment	Assess the likelihood and impact of disruptions, including geographic and third-party threats, and choose risk treatments within risk appetite.	"Management should evaluate the likelihood and impact of potential disruptions and events."	Objective 5 Objective text Objective 5: Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.	"Review risk assessment(s) to determine whether management has identified all reasonably foreseeable hazards and threats to the continuity and resilience of the entity." Appendix A	None
III.B.1 Risk Identification	Identify natural, technological and human-caused threats, geographic and geopolitical risk, cyber risk, threat intelligence and supply-chain links.	"Management should address common operational functions in the business continuity plan (BCP) instead of having unique plans for every type of hazard or threat."	Objective 5 Objective text Objective 5: Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.	Not named in this section	None
III.B.2 Likelihood and Impact Edited Feb 2026	Score likelihood and impact, include worst-case scenarios, and treat the gap between likely threats and current controls as the risk exposure.	"Worst-case scenarios, such as destruction of the facilities and loss of life, should be addressed."	Objective 5 Objective text Objective 5: Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events.	Not named in this section	None
IV Business Continuity Strategies	Risk-based strategies for personnel, processes, technology, facilities and data, developed after the BIA and risk assessment.	"Strategies should be validated to confirm that they are viable and sufficient for peak work volumes."	Objectives 6 and 7 Objective text Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience. Objective 7: Determine whether the entity’s BCM includes communication protocols.	Not named in this section	None
IV.A Resilience	Resources for resilience: off-site repositories, backups, recovery infrastructure and the resilience of critical third-party service providers.	"The business strategy, not technology solutions, should drive resilience."	Objective 6 Objective text Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience.	Not named in this section	None
IV.A.1 Physical	Diverse telecommunications lines, redundant branch-to-data-center links, backups, multiple power sources and geographically diverse sites.	"To avoid the potential for failures after a disruption, management, when possible, should diversify telecommunication lines, establish redundant connections between branches and data centers …"	Objective 6 Objective text Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience.	Not named in this section	TTX-06
IV.A.2 Cyber Resilience	Staying operational through cyber attacks that can hit production and backups at once, secondary disruptions and simultaneous attacks.	"Given the broad and increasing spectrum of cyber threats, resilience measures should be flexible enough to adapt to a diverse range of events."	Objective 6 Objective text Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience.	Not named in this section	TTX-02
IV.A.3 Data Backup and Replication	Backups, an off-site repository of software and configurations, synchronous and asynchronous replication, retention, and offline backups protected from malware.	"Entities should safeguard against replicating malware and data corruption."	Objective 6 Objective text Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience.	Not named in this section	TTX-01 TTX-02
IV.A.4 Personnel	Plan for mass absenteeism, staff who cannot reach facilities, and the basic needs of displaced employees.	"While any one employee’s role may not be designated as mission critical, management should plan for mass absenteeism during an event or disruption."	Objective 6 Objective text Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience.	Not named in this section	TTX-04 TTX-06
IV.A.5 Third-Party Service Providers	Assess critical providers’ resilience, single-point-of-failure risk, the scope of their audit reports, and continuity terms in contracts and service-level agreements.	"Management should assess critical third-party service providers’ susceptibility to multiple event scenarios and verify such third parties’ resilience capabilities."	Objective 6 Objective text Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience.	"Reviewed third-party service provider’s resilience capabilities, including available test and SOC reports." Appendix A	TTX-01 TTX-03 TTX-07
IV.A.6 Telecommunications	Telecommunications redundancy, "last mile" single points of failure, carrier paths, and the federal Telecommunications Service Priority, Government Emergency Telecommunications Service and Wireless Priority Service programs.	"Given the critical nature of telecommunications, management should ensure appropriate redundancy levels in the entity’s telecommunications infrastructure."	Objective 6 Objective text Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience.	Not named in this section	TTX-06 TTX-07
IV.A.7 Power	Short- and long-term power plans: alternate energy sources, fuel, generator load capacity, maintenance and testing.	"Furthermore, management should develop plans to provide electricity in the event of a long-term power disruption."	Objective 6 Objective text Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience.	Not named in this section	TTX-06
IV.A.8 Change Management	Keep recovery systems and documentation in step with production changes, and control emergency changes made during an event.	"Even during events, changes should still be properly authorized, monitored, and documented."	Objective 6 Objective text Objective 6: Determine whether the entity’s risk management strategies are designed to achieve resilience.	"Change tickets and corresponding activity should be reviewed for appropriateness once the event has been resolved." Booklet, IV.A.8	None
IV.B Communications	Several ways to reach staff, customers, regulators, responders and other external groups, with protocols and contact lists.	"BCM should include communication protocols and contact lists to notify stakeholders."	Objective 7 Objective text Objective 7: Determine whether the entity’s BCM includes communication protocols.	Not named in this section	TTX-02 TTX-04 TTX-05
V Business Continuity Plan	The written plan: authorities, responsibilities, procedures, relocation strategies and the components it should contain.	"Furthermore, the BCP should be a living document, regularly updated so that it remains current with system enhancements and organizational changes."	Objective 8 Objective text Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.	Not named in this section	None
V.A Event Management	Definitions of events, disruptions and triggers, with escalation thresholds, reporting procedures and response teams.	"The BCP should include event management procedures that detail reasonably foreseeable event types and provide thresholds and responses."	Objective 8 Objective text Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.	Not named in this section	None
V.B Continuity and Recovery	Working during downtime: manual procedures, transaction tracking, alternate identity verification, and fraud and suspicious activity reporting.	"When appropriate, procedures should address manual steps for critical functions, such as back-office operations, loan operations, and customer support."	Objective 8 Objective text Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.	Not named in this section	None
V.C Facilities and Infrastructure	Alternatives for operations, facilities, suppliers, utilities and key personnel, with short-, medium- and long-term relocation.	"The BCP should identify alternatives for core operations, facilities, infrastructure systems, suppliers, utilities, interdependent business partners, and key personnel."	Objective 8 Objective text Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.	Not named in this section	TTX-01 TTX-06
V.C.1 Data Center Recovery Alternatives	Recovery site options (cold, warm, hot, mirrored, mobile, colocation, reciprocal agreement, disaster recovery as a service) and documenting the choice.	"While these arrangements may be acceptable as a short-term solution, management should not rely on them as a long-term recovery solution."	Objective 8 Objective text Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.	"Verify that management documents the reasons (e.g., cost and service level) for choosing recovery alternatives …" Appendix A	None
V.C.2 Branch Relocation	Temporarily limiting, closing or moving branch operations, which may need regulator approval.	"An important BCP component is establishing a physical location where personnel and customers can go to conduct business."	Objective 8 Objective text Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.	Not named in this section	None
V.D Payment Systems	Alternate arrangements when automated teller machines, funds transfers, electronic banking or remote deposit capture fail, and higher cash demand.	"The BCP should address alternate arrangements if payment systems fail (e.g., automated teller machines (ATM), funds transfers, electronic banking, remote deposit capture, or mobile capabilities)."	Objective 8 Objective text Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.	Not named in this section	TTX-07
V.E Liquidity Considerations	Cash and liquidity needs during an event: emergency borrowing, cash delivery and emergency purchase authority.	"The BCP should detail processes to address potential cash and liquidity needs during adverse events."	Objective 8 Objective text Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.	Not named in this section	TTX-05 TTX-06 TTX-07
V.F Other Components	Incident response, disaster recovery and crisis or emergency management as parts of the plan.	"The BCP may incorporate other plans and procedures to minimize a disruption’s impact."	Objective 8 Objective text Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.	Not named in this section	None
V.F.1 Incident Response	Incident response priorities, communications with stakeholders and the media, prearranged forensic services and periodic testing.	"Management should periodically update and test the entity’s incident response program to verify that it functions as intended, given rapidly changing threats."	Objective 8 Objective text Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.	Not named in this section	TTX-02
V.F.2 Disaster Recovery	Restoring IT infrastructure, data and systems in priority order, including backlogged and lost transactions.	"Disaster recovery should address guidelines for returning operations back to a normalized state with minimum disruption."	Objective 8 Objective text Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.	Not named in this section	TTX-02
V.F.3 Crisis or Emergency Management Edited Feb 2026	Recognizing a crisis, activating the plan, designated decision-makers, and contact lists that are kept current.	"The contact list should be distributed and accessible to key personnel and should be verified and updated regularly."	Objective 8 Objective text Objective 8: Assess the appropriateness of the entity’s enterprise-wide BCP.	Not named in this section	TTX-05
VI Training	Risk-based, multi-year training for the board, management, process owners and frontline staff, updated as the program changes.	"The training program should include conditions for activating the BCP and what to do when key personnel are unavailable."	Objective 9 Objective text Objective 9: Determine whether the BCM program includes training and awareness to educate stakeholders about the entity’s continuity objectives and BCM goals.	Not named in this section	TTX-04
VII Exercises and Tests	The difference between exercises (people, processes and systems) and tests (specific aspects of a system), and what examiners review.	"Effectively, the distinction between the two is that exercises address people, processes, and systems whereas tests address specific aspects of a system."	Objective 10 Objective text Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.	Not named in this section	None
VII.A Exercise and Test Program	A program and schedule covering every process and system component, run at appropriate intervals and after significant changes.	"Exercises and tests should occur either at appropriate intervals, when new risks are identified, or when significant changes affect the entity’s operating environment."	Objective 10 Objective text Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.	"Assess whether the entity’s consolidated exercise and test schedule is reflective of exercise and test objectives and the overall exercise and test universe." Appendix A	None
VII.B Exercise and Test Policy	What the policy should set: roles, minimum frequency, scope, reporting, documentation, fixing deficiencies and third-party testing.	"Establish minimum frequency, scope, and reporting requirements."	Objective 10 Objective text Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.	Not named in this section	None
VII.C Exercise and Test Strategies	Multi-year strategies that prove connectivity, functionality, volume and capacity at alternate facilities, including outsourced activities.	"Management should test all aspects of the entity’s BCP."	Objective 10 Objective text Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.	Not named in this section	None
VII.D Exercise and Test Objectives	Objectives for exercises and tests: recovery within RTOs, RPOs and MTDs, familiar staff, and identified gaps.	"As the exercise and test process matures, it should become increasingly complex up to and including full-scale recovery exercises."	Objective 10 Objective text Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.	Not named in this section	None
VII.E Exercise and Test Plans	Plans with scenario, assumptions, metrics, roles, schedule and escalation; results reviewed, used to update the plan and reported to the board.	"Exercises and test plans should include metrics to assess whether objectives are met."	Objective 10 Objective text Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.	"Management should review the exercise and test results, update the BCP where appropriate, and report the results to the board or board-designated committee." Booklet, VII.E	None
VII.F Exercise and Test Scenarios	Realistic, risk-based scenarios, including third-party and cyber events, using only the resources available in a real event, with written scripts.	"To the extent possible, scenarios should include only resources that would be available during an event (e.g., backup files or equipment at the alternate site)."	Objective 10 Objective text Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.	"Verify that exercise and test scripts document the procedures for executing the exercise or test …" Appendix A	None
VII.G Exercise and Test Methods	Choosing methods by size, complexity and business; more rigorous methods and frequency give more confidence.	"Rigorous exercise methods and increased frequency help provide greater confidence in the continuity and resilience of business functions."	Objective 10 Objective text Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.	Not named in this section	None
VII.G.1 Full-Scale Exercise	Uses all available people and systems to recover every critical system at the alternate site, for example simulating loss of the primary facilities.	"A full-scale exercise simulates full use of available resources (personnel and systems) prompting a full recovery of business processes."	Objective 10 Objective text Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.	Not named in this section	None
VII.G.2 Limited-Scale Exercise	Recovers targeted business processes with the people and systems involved; gives a limited view of interconnectivity and capacity.	"A limited-scale exercise is a simulation involving applicable resources (personnel and systems) to recover targeted business processes."	Objective 10 Objective text Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.	Not named in this section	None
VII.G.3 Tabletop Exercise	A discussion-based walk-through of roles and responses that checks plans are reasonable and compatible, but cannot prove recovery on its own.	"By themselves, tabletop exercises are likely insufficient to validate recovery capabilities, because they are limited to a discussion-based analysis of policies and procedures."	Objective 10 Objective text Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.	Not named in this section	None
VII.G.4 Tests	Measurable tests of system resilience against the plan and recovery objectives, with defined success criteria.	"Test methodologies and frequencies should align with the risk associated with the business function as well as the entity’s testing strategies and objectives."	Objective 10 Objective text Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.	Not named in this section	None
VII.H Industry Exercises and Resilience	Sector-wide exercises such as the Treasury Department’s Hamilton Series, and Treasury’s public Financial Sector Cyber Exercise Template.	"There are several methods for entities of all sizes to participate, such as through third-party service provider user groups or industry initiatives."	Objective 10 Objective text Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.	Not named in this section	None
VII.I Third-Party Service Provider Testing	Include critical providers in the test program, secure the contractual right to test, and obtain their results and remediation plans.	"Management should actively participate in the entity’s third-party service providers’ testing programs and should verify that testing strategies include likely significant disruptive events."	Objective 10 Objective text Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.	"Management should request and receive test results and reports, remediation action plans and status reports upon their completion, and related analysis or modeling." Booklet, VII.I	TTX-03
VII.J Testing for Core and Significant Firms	Testing for firms that clear and settle in critical financial markets, under the 2003 interagency Sound Practices Paper.	"Exercise and testing activities should confirm that such critical clearing and settlement activities could be recovered within RTOs."	Objective 10 Objective text Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.	Not named in this section	None
VII.K Post-Exercise and Post-Test Actions	Document issues, set action plans with target dates, retest fixes, update the plan and report to the board.	"Management should document issues identified during exercises and tests and create action plans with target dates for resolving issues."	Objective 10 Objective text Objective 10: Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives.	"Exercise and test results may include the following documentation: Dates and locations. An executive summary comparing objectives and results." Booklet, VII.K	None
VIII Maintenance and Improvement	Regular review of the program on defined triggers, lessons learned from events, and version control of key documents.	"Because risks and technology often change, management should regularly review and update the business continuity program to reflect the current environment."	Objective 11 Objective text Objective 11: Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process.	"The BCM documentation should include evidence substantiating periodic updates of the BIA, risk assessment, and BCP(s)." Booklet, VIII	None
IX Board Reporting	Regular written reports to the board on the BIA, risk assessment, plan, test results and issues, with minutes that show challenge and approvals.	"Board minutes should reflect business continuity discussion (including credible challenges) and approvals."	Objective 12 Objective text Objective 12: Determine whether the board has established expectations for BCM reporting.	"Review board minutes to determine whether management periodically reports to the board on the status of BCM." Appendix A	None

Appendix A: the 13 examination objectives

Appendix A is the examiner work program. Objectives 2 to 12 each point to one section; objective 1 sets the scope of the exam and objective 13 closes it.

Objective 1: Determine the appropriate scope and objectives for the examination.
Objective 2 (II.A): Determine whether the board and senior management promote effective governance of business continuity through defined responsibilities, accountability, and adequate resources to support the program. Section row
Objective 3 (II.B): Determine whether the board and senior management engage audit or other independent review functions to review and validate the design and operating effectiveness of the BCM program. Section row
Objective 4 (III.A): Determine whether management developed an appropriate and repeatable BIA process that identifies all business functions and prioritizes them in order of criticality, analyzes related interdependencies, and assesses a disruption’s impact. Section row
Objective 5 (III.B): Determine whether management conducts a risk assessment sufficient to evaluate the likelihood and impact of potential disruptions and events. Section row
Objective 6 (IV.A): Determine whether the entity’s risk management strategies are designed to achieve resilience. Section row
Objective 7 (IV.B): Determine whether the entity’s BCM includes communication protocols. Section row
Objective 8 (V): Assess the appropriateness of the entity’s enterprise-wide BCP. Section row
Objective 9 (VI): Determine whether the BCM program includes training and awareness to educate stakeholders about the entity’s continuity objectives and BCM goals. Section row
Objective 10 (VII): Determine whether the exercise and testing program is sufficient to allow management to assess the entity’s ability to meet its continuity objectives. Section row
Objective 11 (VIII): Determine whether management continuously measures the progress and assesses the effectiveness of BCM and uses the information to improve the BCM process. Section row
Objective 12 (IX): Determine whether the board has established expectations for BCM reporting. Section row
Objective 13: Discuss corrective action and communicate findings.

Tabletop scenario library: 7 scenarios mapped to the booklet

Each scenario lists the booklet sections it exercises, the notices it can trigger, the decisions to test and who should be in the room. Section VII.G.3 is clear that a tabletop alone does not prove recovery; use the suggested method to follow up.

Notice abbreviations: CFR, Code of Federal Regulations; NYDFS or DFS, New York State Department of Financial Services; NYCRR, New York Codes, Rules and Regulations; BaaS, banking-as-a-service; FTC, Federal Trade Commission.

Tabletop exercise scenarios from the RiskTemplates BCP/DR Kit mapped to FFIEC BCM booklet sections
Scenario	Summary	Booklet sections	Notices it can trigger	Decisions to test	Participants and method
TTX-01 Cloud region outage	The cloud region that hosts production fails for most of a business day; zone redundancy does not help and failover to the secondary region has never run at full production load. Related guidance 12 CFR 53.4 if you are a bank service provider (notify affected bank customers)	III.A.3 IV.A.3 IV.A.5 V.C	Fintech or BaaS platform serving a bank (bank service provider) → Each affected bank's designated contact: As soon as possible after that determination (can be before 4 hours have passed) (12 CFR 53.4) Fintech → Its bank partner: As the contract says (Program agreement) Bank (if you are one) → Its primary federal regulator: As soon as possible, no later than 36 hours after determination (12 CFR 53.3)	When to declare and fail over; what to tell the bank partner and customers; whether to pause money movement.	Chief Technology Officer, site reliability, payments operations, communications, compliance Method: Failover test or limited-scale exercise
TTX-02 Ransomware	Ransomware encrypts production servers and file shares overnight; backups exist, but one backup set may also be compromised and the attacker claims to have copied customer data. The booklet does not use the word "ransomware"; it covers the threat under cyber resilience and data backup. NYDFS 500.16 names ransomware explicitly. Related guidance 23 NYCRR 500.16 (plans must address ransomware; annual testing including restoring from backups) 16 CFR 314.4(h) (FTC Safeguards Rule incident response plan) 12 CFR 53.3 / 53.4 notification	IV.A.2 IV.A.3 V.F.1 V.F.2 IV.B	Fintech or BaaS platform serving a bank (bank service provider) → Each affected bank's designated contact: As soon as possible after that determination (can be before 4 hours have passed) (12 CFR 53.4) NYDFS-covered entity → The superintendent: No later than 72 hours after determination (23 NYCRR 500.17(a)) NYDFS-covered entity that makes an extortion payment → The superintendent (electronically, on the DFS form): Notice within 24 hours of the payment; written explanation within 30 days (23 NYCRR 500.17(c)) Non-bank financial institution under Federal Trade Commission (FTC) jurisdiction (for example a non-bank lender) → The Federal Trade Commission (electronic form on ftc.gov): As soon as possible, no later than 30 days after discovery (16 CFR 314.4(j)) Fintech → Its bank partner: As the contract says (Program agreement) Bank (if you are one) → Its primary federal regulator: As soon as possible, no later than 36 hours after determination (12 CFR 53.3)	Isolate or keep running; which backups are clean; ransom decision rights; notices and their deadlines.	Executives, Chief Information Security Officer, technology, legal, compliance, communications, insurance contact Method: Tabletop exercise, then a backup restoration test
TTX-03 Critical vendor / core processor failure	The core processor (or banking-as-a-service middleware provider) goes down for several days, or fails as a business, and the ledger of record is unavailable or cannot be reconciled. Related guidance 2023 Interagency Guidance on Third-Party Relationships (business continuity in contracts) 12 CFR 53.4	III.A.2 IV.A.5 VII.I	Fintech → Its bank partner: As the contract says (Program agreement) The middleware provider (the bank service provider to Bank A), not you → Bank A's designated contact: As soon as possible after determination (12 CFR 53.4 (the provider's duty)) Bank (if you are one) → Its primary federal regulator: As soon as possible, no later than 36 hours after determination (12 CFR 53.3)	How long to wait for the vendor; manual processing limits; how to reconcile balances; customer access to funds.	Executives, operations, finance, compliance, legal, the vendor or bank partner Method: Tabletop exercise or joint test with third party
TTX-04 Key personnel unavailability / pandemic	A contagious illness or a single event takes out a large share of staff, including two people who are the only ones able to run a Mission Critical process. Related guidance Interagency Statement on Pandemic Planning (March 2020), cited in the booklet references	IV.A.4 VI IV.B	Fintech → Its bank partner: As the contract says (Program agreement)	Who can approve and execute critical steps; minimum staffing; what stops first.	Chief Operating Officer, Human Resources, process owners Method: Tabletop exercise
TTX-05 Social-media-driven deposit run	A rumor about the bank (or the fintech's sponsor bank) spreads on social media and withdrawal requests spike within hours, faster than the contingency funding plan assumed. Related guidance Addendum to the Interagency Policy Statement on Funding and Liquidity Risk Management: contingency funding plans (July 28, 2023) Interagency Sound Practices to Strengthen Operational Resilience (SR 20-24; directed to the largest firms)	V.E IV.B V.F.3	Bank → Its supervisory office (primary federal regulator; state regulator if state-chartered): Promptly, per supervisory expectations (Supervisory relationship; funding and liquidity addendum (2023)) Fintech (sponsor bank under stress) → Its bank partner before any public statement about the bank: Before publication (Program agreement)	Funding sources and when to use them; withdrawal handling; public statements and their timing.	Executives, Chief Financial Officer or treasury, communications, compliance, the bank (or sponsor bank) Method: Tabletop exercise
TTX-06 Regional natural disaster (hurricane)	A hurricane makes landfall near headquarters and the primary operations site: power and telecommunications are out for days, staff are evacuating and branches or offices are closed. Related guidance ISO 22301:2019 Amendment 1:2024 (climate change considerations)	IV.A.1 IV.A.4 IV.A.6 IV.A.7 V.C V.E	Fintech → Its bank partner: As the contract says (Program agreement) Bank (if branches close) → Customers and, where required, its regulator: Per agency rules for the closure (Your regulator's branch closure rules (confirm with counsel))	When to close the site; staff safety and relocation; which work moves to other sites; cash and branch needs.	Executives, facilities, Human Resources, technology, operations Method: Tabletop exercise or limited-scale exercise (work from alternate site)
TTX-07 Payment rail disruption (Fedwire / FedACH / card network outage)	A payment rail you depend on (Fedwire Funds, FedACH or a card network) is down or delayed on a high-volume day, close to a settlement deadline. Related guidance Federal Reserve Financial Services operating hours and processing schedules (check the current schedule; times change)	V.D V.E IV.A.5 IV.A.6	Fintech → Its bank partner: As the contract says (Program agreement) Account-holding institution → Consumer who reported an error: Investigate within 10 business days (up to 45 days with provisional credit); longer for new accounts (20 business days / 90 days), point-of-sale debit card and foreign-initiated transfers (90 days) (12 CFR 1005.11(c))	Hold, reroute or resubmit; customer cutoffs; liquidity for delayed settlement.	Payments operations, treasury, the bank or correspondent, communications Method: Tabletop exercise or limited-scale exercise

Each scenario has a full card in the Business Continuity & Disaster Recovery (BCP/DR) Kit: a timed set of injects, facilitator prompts, what good looks like and a hot-wash and after-action template, plus a Scenario Library tab that tracks when each scenario was last run.

◆ Further reading

◆ How to use this

Read the row, then read the statute.

Find the section you are working on (the filter narrows by part of the booklet), then open the official text from the section link. The quote is one sentence; the section usually says more.
Use the Appendix A objective to see how an examiner will approach the section, and the evidence column for the documents the booklet or Appendix A names. A blank evidence cell means the booklet does not name a document there, not that nothing will be asked for.
Remember the booklet "does not impose requirements on entities". Your own regulator, charter, bank partner agreement and state rules (for example New York State Department of Financial Services Part 500) can add requirements it does not have.
Pick tabletop scenarios that exercise the sections where your program is thinnest. A tabletop tests decisions; prove recovery times with a limited-scale or full-scale exercise or a test.
If you cite a quote, cite the section number and the booklet, and check the live text: the FFIEC edits the InfoBase in place.

Methodology

Section numbers, titles and quotes come from the booklet on the FFIEC IT Examination Handbook InfoBase. Every quote was checked against the archived November 2019 text and against the live pages read on October 14, 2026, after the February 2026 edits; a sentence-by-sentence comparison found 3 changed sentences, shown above. "What it covers" is our one-sentence summary. The Appendix A objective is the one Appendix A cross-references to the section; subsections take their parent's. The evidence column is filled only where the booklet or Appendix A names a document or record. The 7 scenarios are generated from the source files of the RiskTemplates BCP/DR Kit (version 2026.10.2); the notices column is the kit's list of notices each scenario can trigger.

Not legal advice

This is a reference summary for risk and compliance teams, not legal advice. Laws change and how they apply depends on your facts. Confirm each obligation against the cited text and with counsel before you rely on a deadline.

◆ FAQ

Common questions.

Is the FFIEC Business Continuity Management booklet still current?

Yes. The November 2019 booklet is still the Business Continuity Management booklet in the FFIEC IT Examination Handbook. On February 27, 2026 the FFIEC posted that it had updated the IT Handbook "to remove references to reputational risk, consistent with Executive Order 14331 of August 7, 2025" and that "The updates do not establish new requirements." In this booklet that changed three sentences, in III.A.3, III.B.2 and V.F.3. The booklet PDF was reissued at the same address and still carries the November 2019 date.

What replaced the 2015 FFIEC Business Continuity Planning booklet?

The Business Continuity Management booklet, published in November 2019. Its introduction says: "With the publication of this booklet, the FFIEC member agencies replace the “Business Continuity Planning” booklet issued in February 2015." It adds that "The change from business continuity planning to business continuity management reflects the changes in customer and industry expectations for the resilience of operations."

How often does the FFIEC say business continuity plans must be tested?

The booklet sets no fixed frequency. Section VII.B says the entity’s exercise and test policy should "Establish minimum frequency, scope, and reporting requirements." Section VII.A says exercises and tests "should occur either at appropriate intervals, when new risks are identified, or when significant changes affect the entity’s operating environment." Appendix A asks examiners whether management covers every function on its own timetable, giving "(e.g., all processes are covered annually or every three years)" as an example.

Is a business impact analysis required by the FFIEC?

The booklet states that it "does not impose requirements on entities"; it describes what examiners assess. But it calls the business impact analysis (BIA) and risk assessment "the foundation of BCM", says "Management should develop a BIA that identifies all business functions and prioritizes them in order of criticality", and Appendix A Objective 4 has examiners evaluate the BIA process. An entity examined against the booklet should expect to be asked for one.

What is the difference between RTO and MTD?

In section III.A.3, the recovery time objective (RTO) "defines the maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources and business processes." The maximum tolerable downtime (MTD) "represents the total amount of time the system owner or authorizing official is willing to accept for a business process disruption and includes all impact considerations." NIST SP 800-34 Rev. 1 (section 3.2.1) links the two: "Because the RTO must ensure that the MTD is not exceeded, the RTO must normally be shorter than the MTD."

Is a tabletop exercise enough to satisfy FFIEC testing expectations?

Not on its own. Section VII.G.3 says "By themselves, tabletop exercises are likely insufficient to validate recovery capabilities, because they are limited to a discussion-based analysis of policies and procedures." Section VII.G says management "should use one of the more thorough testing methods discussed in this section to verify the BCP’s viability".

◆ Sources

Primary sources.

The booklet pages on ithandbook.ffiec.gov are the authority; each section row links to its own page.

Data: CSV · JSON. Free to reuse under CC BY 4.0 with attribution to RiskTemplates and a link to this page. Last verified October 14, 2026.

What does the FFIEC Business Continuity Management booklet expect, section by section?

What changed in February 2026

All 55 sections

Appendix A: the 13 examination objectives

Tabletop scenario library: 7 scenarios mapped to the booklet

Read the row, then read the statute.

Common questions.

Primary sources.

The brief, in your inbox.