Resilience that holds when your supervisor tests it.
Supervisors now judge banks on whether critical services keep running through disruption, including disruption that starts at a supplier.
What is at stake.
- 01
Operational resilience
Critical services must stay within impact tolerance through severe but plausible scenarios.
- 02
Third-party concentration
A handful of cloud and core-banking providers now carry much of the sector.
- 03
Interbank messaging
A SWIFT attestation is only as credible as the assessment behind it.
Where the exposure actually sits.
- R1
Platform outages
Change failures and provider incidents that stop customers transacting.
- R2
Supplier compromise
A breach that reaches the bank through trusted connectivity.
- R3
Fraud-enabling intrusion
Attacks on payment initiation and operator credentials.
- R4
Data integrity
Corrupted ledgers and backups, where recovery is measured in transactions.
The rules that shape the work.
The instruments that set the bar in this sector, and what each one demands.
DORA
EUApplies from 17 January 2025: ICT risk, incident reporting, resilience testing and the register of information.
NIS2
EUCovers banking and market infrastructure. Where both apply, DORA is the sector-specific act for ICT risk.
SWIFT Customer Security Program
GlobalAnnual attestation against the CSCF version in force, backed by an independent assessment.
NYDFS 23 NYCRR Part 500
New YorkAmended in 2023 and phased in through November 2025: governance, MFA, asset inventory and annual certification.
UK operational resilience
United KingdomPRA SS1/21 and FCA PS21/3: remain within impact tolerances for important business services.
How we respond.
Each engagement is scoped to your regulator, your deadline and the evidence your assessor will ask for.
A mid-sized bank’s first major-incident reporting rehearsal.
A processor outage showed nobody could say within four hours whether DORA’s criteria were met. We rebuilt classification into a decision tree tied to the register of information and rehearsed it against three supplier-failure scenarios.
Questions clients ask us.
Does DORA replace NIS2 for banks?
For in-scope financial entities, DORA is the sector-specific act for ICT risk and incident reporting. Any remaining NIS2 obligations depend on national transposition, so we check them entity by entity.
Can one assessment satisfy DORA, NYDFS and SWIFT?
Much of the evidence overlaps, but each regime has its own scope and attestation. We design one control set and show exactly where each regime asks for something extra.
Who performs threat-led penetration testing under DORA?
TLPT applies to entities identified by their competent authority and follows the RTS on TLPT, including its tester requirements. We prepare the scope, support the test and lead remediation through to retest.
Talk to a practitioner who knows your sector.
Tell us what you are preparing for. A senior practitioner who has done this work will reply within one business day.