Topic Resilience & Continuity
When the system goes down — what your program already had to have ready.
Business continuity, disaster recovery, and SOC 2 templates for the team that needs to prove resilience to regulators, auditors, and bank partners. Aligned with ISO 22301, FFIEC BCM, NIST SP 800-34, and AICPA SOC 2.
◆ ISO 22301 · FFIEC BCM · NIST SP 800-34 · AICPA SOC 2
◆ What you'll find here
Resilience that survives an examiner question.
◆ 01
BCP & BIA
Business impact analysis, recovery time objectives, dependency mapping, and the BCP plan structure that holds up during a real outage. Aligned with ISO 22301 and FFIEC BCM.
◆ 02
Disaster recovery
DR runbooks, technology recovery, tabletop exercises, and the test evidence regulators expect. Mapped to NIST SP 800-34 and FFIEC IT Examination Handbook.
◆ 03
SOC 2 readiness
The trust services criteria mapped to working controls. Built for fintechs and SaaS companies preparing for their first SOC 2 audit or maintaining Type II evidence year-round.
◆ Resilience templates
Tools for resilience teams.
BCP, DR, BIA, and SOC 2 templates with Excel workbooks and PDF guides. Buy once, tailor to your program, deploy in days.
Business Continuity & Disaster Recovery (BCP/DR) Kit
BCP and DR templates with BIA, recovery procedures, and a standalone tabletop exercise kit.
SOC 2 Compliance Checklist
151 readiness checks cross-referenced to the AICPA Trust Services Criteria, with evidence collection guidance.
Contingency Funding Plan — Banks
Examiner-ready contingency funding plan for chartered banks built to the 2023 Interagency Addendum.
Contingency Funding Plan — Fintechs
Contingency funding plan for sponsor-bank fintechs — FBO reconciliation, runway-based triggers, post-Synapse stress scenarios.
68+
Resilience articles
4
Frameworks · ISO · NIST · FFIEC · AICPA
US
Federal banking + SOC 2 ecosystem
◆ Latest analysis
From the journal.
Business Continuity
Tabletop Exercise Injects: Build an MSEL That Tests Decisions
A Master Scenario Events List (MSEL) is an exercise controller's run sheet—not a general bank or fintech regulatory requirement. Here's how to build one.
Business Continuity
FCA Operational Resilience: Six Evidence Checks From Its One-Year Observations
The FCA's March 2026 publication gives good-practice examples and improvement areas—not an enforcement verdict. Use these six evidence checks.
Business Continuity
The ECB Just Ran 110 Banks Through a Geopolitical Reverse Stress Test. Here's What US Banks' BCPs Are Missing.
On July 31, 2026, the ECB published results of its thematic geopolitical risk reverse stress test covering 110 directly supervised euro area banks—and urged the sector to improve. The OCC's Spring 2026 Semiannual Risk Perspective added geopolitical risk as a prominent new concern for the first time. Most US bank business continuity programs are built for IT failures and natural disasters. They are not built for this class of scenario.
Business Continuity
DORA's 4-Hour Incident Reporting Clock: What US Banks with EU Operations Are Missing in Their Playbooks
DORA's ICT incident reporting timeline is the strictest in the world — 4 hours to initial notification, 72 hours to the intermediate report, one month to final. US banks with EU branches are subject to it and most have a gap between their US playbook and what Brussels actually requires.
Business Continuity
Personnel Continuity Under FFIEC BCM: Succession Is Not a List of Phone Numbers
Build FFIEC business continuity management personnel coverage with tested backups, delegated authority, usable procedures, and recovery evidence.
Business Continuity
Business Continuity Workaround Strategies: Document the Manual Process Before the System Goes Down
A BCP without documented manual workaround procedures isn't a continuity plan — it's a recovery plan. Here's the workaround template fields and critical-function structure FFIEC examiners expect to see.