BCBS Principles for Operational Resilience (2021) P6-34: Incident management scope covers the full life cycle: severity classification, response and recovery procedures linked to continuity plans, and internal and external communication with metrics and lessons learned

What does P6-34 require?

Incident management spans the whole life of an incident. Severity is classified against criteria fixed in advance (for instance the expected time back to normal) so that resources are prioritised and assigned properly; response and recovery procedures connect to the continuity, disaster recovery and related plans; and communication plans report to internal and external stakeholders including regulators, track performance during the incident, and capture lessons afterwards.