FFIEC IT Examination Handbook BCM-VII.I: VII.I Third-Party Service Provider Testing (Business Continuity Management)

What does BCM-VII.I require?

Third-party service providers are included in the enterprise-wide exercise and testing program in proportion to their criticality, management obtains assurance that they can restore critical services to business and contractual requirements, the contract gives the right to perform or participate in testing, management participates actively in providers' testing, verifies that their strategies include likely significant events, obtains test results, remediation plans, status reports and analysis, tracks issues to resolution by severity, presents results affecting the entity to the board and performs its own analysis rather than equating another entity's recovery with its own.