The spine first: what your critical services actually depend on, what recovery each one needs, and whether your vendor contracts can deliver it. Continuity plans, crisis structure, testing, and regulatory alignment follow from that, built by someone who runs platform resiliency for a living, not someone who read the framework.
The frameworks are not the problem. ISO 22301, DORA, and FFIEC agree on the fundamentals, and most failing programs can show a mapping to all three. What they cannot show is a BIA the incident commander actually opens during the outage, an RTO that has ever been reconciled against the vendor SLA it silently depends on, or an exercise that produced findings anyone acted on. The program passes audit and fails the incident, in that order.
This engagement builds the program for the incident first and the audit second, on the theory that a program which works at 2am has no trouble producing evidence at 2pm. It is built for the three rooms where the program gets judged: the outage bridge, the regulator's "show me your testing," and the board's "could that happen to us."
Impact scored across defined dimensions, criticality tiers derived from the scores, and recovery objectives that follow from criticality instead of gut feel. The arithmetic is visible at every step.
What each critical service actually depends on: systems, sites, vendors, and the people who know how it works. Optionally onto the Risk Intelligence Map, where the geography becomes visible.
RTO and RPO set from criticality, then reconciled against vendor SLAs and technical capability. Where the objective exceeds what the contract or the architecture can deliver, that gap is named, priced, and decided, not discovered mid-incident.
BC and DR plans written for the person executing them under stress: decision points, contact paths, and the first hour spelled out. If a plan only makes sense to its author, it is not a plan.
Incident command roles, activation criteria, escalation to executives, and communication templates, so the first fifteen minutes of a crisis are procedure, not improvisation.
A testing calendar that earns its cadence: tabletops with injects that hurt, technical failovers where they matter, findings tracked to closure, and the whole record mapped to DORA, FFIEC, SEC, and FINRA expectations.
Critical services, impact scores, recovery objectives, and dependencies in one place, current enough to open during an incident.
BC, DR, and crisis documents structured for use under stress, with the recovery-gap decisions leadership made recorded next to them.
Exercise scenarios, findings, and closure tracking in a form a regulator accepts as evidence, because it is evidence.
Program components cross-walked to DORA, FFIEC, SEC, and FINRA expectations, so the exam conversation starts from your structure, not the examiner's checklist.
Your services, your regulators, your last bad day, and what exists already. Programs are rebuilt more often than built from zero, and both are fine.
Which workstreams you need, which you already have, and the scope and price agreed before work starts. Nobody pays to rebuild what already works.
BIA, recovery design, plans, and crisis structure built with your service owners in the room, tested as they land rather than at the end.
The first exercises run, findings closed, the testing calendar handed to its owner, and the regulatory map delivered with the evidence behind it.
Rarely. Most programs get rebuilt, not built from zero, and the scoping step exists to name what already works so you do not pay to have it rebuilt. Expect the BIA and the RTO-to-SLA reconciliation to change the most, because that is where the paper usually diverges from reality.
The regulatory map shows where the program meets each expectation and where it does not; gaps get named and decided, not hidden. What no engagement can do is substitute for running the program. The testing record only counts as evidence because the tests actually ran.
Please do. Start with Your BIA Is a Shelf Document, then Your RTO and Your SLA Have Never Met and Tabletops That Aren't Theater. If those failures sound familiar, this is the engagement that fixes them.
Scope and price are set in the first conversation, sized to what you already have.