US Interagency Sound Practices to Strengthen Operational Resilience
The US federal banking agencies' sound practices for operational resilience at the largest and most complex firms: board-set tolerance for disruption and governance, operational risk management with tested controls including at third parties, business continuity management with alternate sites and remote-access contingencies, third-party risk management with substitutability, severe but plausible scenario analysis, secure and resilient information systems with immutable offline backup, surveillance and reporting, and the Appendix A cyber risk management practices from governance to third-party risk.
US Interagency Sound Practices to Strengthen Operational Resilience is a compliance framework from United States (federal banking agencies) with 8 domains and 49 controls. The largest domains are Section 3 Business continuity management (practices a to i) – US Interagency Sound Practices to Strengthen Operational Resilience (9 controls), Appendix A Table 1 Sound practices for cyber risk management (governance, identification, protection, detection, response, recovery, third-party risk management) – US Interagency Sound Practices to Strengthen Operational Resilience (7 controls), Section 2 Operational risk management (practices a to g) – US Interagency Sound Practices to Strengthen Operational Resilience (7 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (8)
Appendix A Table 1 Sound practices for cyber risk management (governance, identification, protection, detection, response, recovery, third-party risk management) – US Interagency Sound Practices to Strengthen Operational Resilience
| Code | Title |
|---|---|
| us-interagency-sound-practices-to-strengthen-operational-resilience::A-DET | Cyber detection: timely detection and impact analysis of anomalous activity, monitoring of systems and assets at discrete intervals, and maintained and tested detection processes |
| us-interagency-sound-practices-to-strengthen-operational-resilience::A-GOV | Cyber governance: risk appetite and tolerance reflect accepted cyber risk, cyber risk management integrated with operational risk, defined roles including a responsible individual, a monitored and improved cybersecurity programme with independent oversight |
| us-interagency-sound-practices-to-strengthen-operational-resilience::A-ID | Cyber identification: identify and manage the data, personnel, devices, systems, third parties and facilities enabling critical operations and core business lines, and understand the cybersecurity risks to them |
| us-interagency-sound-practices-to-strengthen-operational-resilience::A-PROT | Cyber protection: access limited to authorised users, processes and devices; awareness training for personnel including third parties; data managed to protect confidentiality, integrity and availability; encryption at rest and in transit; tested backups; secure disposal; configuration baselines; maintenance; secure-by-design architecture; resilient acquisition and development; replacement before end of support; technical security solutions |
| us-interagency-sound-practices-to-strengthen-operational-resilience::A-REC | Cyber recovery: continuity and disaster recovery plans executed for timely restoration after cybersecurity incidents, improved from lessons learned, with restoration coordinated with internal and external parties |
| us-interagency-sound-practices-to-strengthen-operational-resilience::A-RESP | Cyber response: executed and maintained response procedures, coordination with internal and external stakeholders including regulators and law enforcement, analysis to support recovery, containment and resolution, and improvement from lessons learned |
| us-interagency-sound-practices-to-strengthen-operational-resilience::A-TPRM | Cyber third-party risk management: risks and control effectiveness managed whether performed internally or by a third party, due diligence and monitoring including testing or auditing of third-party security controls, contracts defining responsibility for access rights, configuration and deployment, verification of resilient third-party processes, and validation that third-party systems will operate or recover within tolerance |
Section 1 Governance (practices a to f) – US Interagency Sound Practices to Strengthen Operational Resilience
| Code | Title |
|---|---|
| us-interagency-sound-practices-to-strengthen-operational-resilience::1a | Board approves and periodically reviews the risk appetite for disruption from operational risk at enterprise level and for critical operations and core business lines, and articulates the tolerance for disruption |
| us-interagency-sound-practices-to-strengthen-operational-resilience::1b | Board and senior management ensure resilience practices are led and staffed by people with relevant expertise, with approved budgets and resources and a culture of effective risk management |
| us-interagency-sound-practices-to-strengthen-operational-resilience::1c | Board oversees operational risk management across business lines, the independent operational risk function and internal audit; senior management accountable for adherence to the tolerance for disruption |
| us-interagency-sound-practices-to-strengthen-operational-resilience::1d | Senior management maintains a detailed, accurate and regularly updated overview of the organisational and legal structure identifying critical operations and core business lines and their material entities |
| us-interagency-sound-practices-to-strengthen-operational-resilience::1e | Senior management develops, implements and manages effective and resilient information systems and controls to maintain critical operations and core business lines within the tolerance for disruption |
| us-interagency-sound-practices-to-strengthen-operational-resilience::1f | Internal or external audit independently assesses the design and ongoing effectiveness of operational resilience efforts |
Section 2 Operational risk management (practices a to g) – US Interagency Sound Practices to Strengthen Operational Resilience
| Code | Title |
|---|---|
| us-interagency-sound-practices-to-strengthen-operational-resilience::2a | Senior management oversees operational risk processes, systems and controls that identify and contain a disruption, mitigate its effects and resolve it within the tolerance for disruption |
| us-interagency-sound-practices-to-strengthen-operational-resilience::2b | Business line management identifies and mitigates operational risk exposures in line with the tolerance for disruption |
| us-interagency-sound-practices-to-strengthen-operational-resilience::2c | Operational risk function assesses critical operations and core business lines of the firm and its material entities, their exposure to operational risks and the ability to recover |
| us-interagency-sound-practices-to-strengthen-operational-resilience::2d | Operational risk function regularly reviews, tests and updates internal controls relevant to critical operations and core business lines, including those performed by third parties |
| us-interagency-sound-practices-to-strengthen-operational-resilience::2e | Risk identification and assessment approaches capture business processes and their operational risks, including technology and third-party risk |
| us-interagency-sound-practices-to-strengthen-operational-resilience::2f | Independent audit reviews and challenges the operational risk function and assesses whether it operates within the tolerance for disruption |
| us-interagency-sound-practices-to-strengthen-operational-resilience::2g | Operational risk function works closely with business continuity management and recovery or resolution planning on resilience |
Section 3 Business continuity management (practices a to i) – US Interagency Sound Practices to Strengthen Operational Resilience
| Code | Title |
|---|---|
| us-interagency-sound-practices-to-strengthen-operational-resilience::3a | Business continuity management incorporates business impact analysis, testing, training and awareness, and communication and crisis management policies |
| us-interagency-sound-practices-to-strengthen-operational-resilience::3b | Periodic review of the business continuity plan so contingency strategies match current operations, risks, tolerance and recovery priorities, aligned with payment, clearing and settlement guidance where applicable |
| us-interagency-sound-practices-to-strengthen-operational-resilience::3c | Testing of continuity plans with lessons learned incorporated, tests covering third-party dependencies and joint testing with third parties where possible |
| us-interagency-sound-practices-to-strengthen-operational-resilience::3d | Functional testing of IT systems' ability to deliver minimum service capacity to critical operations and core business lines, with scenarios where objectives cannot be met |
| us-interagency-sound-practices-to-strengthen-operational-resilience::3e | Availability of essential personnel managed, with alternate sites geographically distant, of distinct risk profile and resourced to run critical operations and core business lines |
| us-interagency-sound-practices-to-strengthen-operational-resilience::3f | Remote-access contingencies that let personnel deliver critical operations and core business lines through a disruption, prioritised and resourced, with transition back to normal operations |
| us-interagency-sound-practices-to-strengthen-operational-resilience::3g | Essential personnel trained for back-up roles, with a resilience training and awareness programme evaluated and improved |
| us-interagency-sound-practices-to-strengthen-operational-resilience::3h | Recovery or resolution planning integrated into governance and business-as-usual processes, complementary to risk management and continuity management |
| us-interagency-sound-practices-to-strengthen-operational-resilience::3i | Information in recovery or resolution plans used to identify response options for severe but plausible scenarios and to leverage mapped interconnections and interdependencies |
Section 4 Third-party risk management (practices a to g) – US Interagency Sound Practices to Strengthen Operational Resilience
| Code | Title |
|---|---|
| us-interagency-sound-practices-to-strengthen-operational-resilience::4a | Identify and analyse third-party risk to critical operations and core business lines and prioritise the most significant dependencies |
| us-interagency-sound-practices-to-strengthen-operational-resilience::4b | Formal agreements with third parties, with performance managed and monitored against service requirements and the tolerance for disruption |
| us-interagency-sound-practices-to-strengthen-operational-resilience::4c | Periodic review of third parties' systems and controls reports and test results, with processes and benchmarks for monitoring their ability to deliver during disruptions |
| us-interagency-sound-practices-to-strengthen-operational-resilience::4d | Verify that third parties have sound risk management and controls that identify and mitigate hazards to operations consistent with the tolerance for disruption |
| us-interagency-sound-practices-to-strengthen-operational-resilience::4e | Address key third-party concerns affecting resilience through due diligence, contract negotiation, ongoing monitoring and termination |
| us-interagency-sound-practices-to-strengthen-operational-resilience::4f | Identify risks from providers of public and critical infrastructure services such as energy and telecommunications, with processes to manage their disruption |
| us-interagency-sound-practices-to-strengthen-operational-resilience::4g | Identify alternative third parties and assess substitutability of providers supporting critical operations and core business lines, including bringing a service in-house |
Section 5 Scenario analysis (practices a to e) – US Interagency Sound Practices to Strengthen Operational Resilience
| Code | Title |
|---|---|
| us-interagency-sound-practices-to-strengthen-operational-resilience::5a | Operational risks from risk management, audit, continuity and resolution planning incorporated into severe but plausible scenarios designed to test the tolerance for disruption |
| us-interagency-sound-practices-to-strengthen-operational-resilience::5b | Governance framework and independent review of the integrity and consistency of scenario development |
| us-interagency-sound-practices-to-strengthen-operational-resilience::5c | Scenario design uses the mapped interconnections and interdependencies in recovery or resolution plans, third-party risks and business impact analyses |
| us-interagency-sound-practices-to-strengthen-operational-resilience::5d | Back-test scenarios against past severe disruptions and refine them from the results |
| us-interagency-sound-practices-to-strengthen-operational-resilience::5e | Identify risk transmission channels, concentrations and vulnerabilities across critical operations and core business lines, informing the tolerance for disruption |
Section 6 Secure and resilient information system management (practices a to e) – US Interagency Sound Practices to Strengthen Operational Resilience
| Code | Title |
|---|---|
| us-interagency-sound-practices-to-strengthen-operational-resilience::6a | Information systems supporting critical operations and core business lines, including third-party elements, subject to regularly tested risk identification, protection, detection, response and recovery programmes with situational awareness and timely management information |
| us-interagency-sound-practices-to-strengthen-operational-resilience::6b | Routinely apply and evaluate processes and controls protecting the confidentiality, integrity, availability and overall security of data and information systems |
| us-interagency-sound-practices-to-strengthen-operational-resilience::6c | Controls safeguarding the integrity and availability of critical data against destructive malware including ransomware, with secure, immutable, offline storage for recovery |
| us-interagency-sound-practices-to-strengthen-operational-resilience::6d | Regular review of information systems and controls against industry standards and best practice, updated for evolving cyber threats and new technologies |
| us-interagency-sound-practices-to-strengthen-operational-resilience::6e | Use of a standardised cybersecurity preparedness assessment tool aligned with industry standards, such as those listed in Appendix A |
Section 7 Surveillance and reporting (practices a to c) – US Interagency Sound Practices to Strengthen Operational Resilience
| Code | Title |
|---|---|
| us-interagency-sound-practices-to-strengthen-operational-resilience::7a | Monitor ongoing operational risk exposure against risk appetite and tolerance for disruption, with communication and coordination procedures across the firm |
| us-interagency-sound-practices-to-strengthen-operational-resilience::7b | Timely detection of anomalous activity that could disrupt critical operations and core business lines, with assessment of impact and of protective measures |
| us-interagency-sound-practices-to-strengthen-operational-resilience::7c | Continuous surveillance and reporting to senior management and the board sufficient for timely decisions on responding to a disruption |
What is US Interagency Sound Practices to Strengthen Operational Resilience and who does it apply to?
US Interagency Sound Practices to Strengthen Operational Resilience is a compliance framework from United States (federal banking agencies) with 8 domains and 49 controls. The US federal banking agencies' sound practices for operational resilience at the largest and most complex firms: board-set tolerance for disruption and governance, operational risk management with tested controls including at third parties, business continuity management with alternate sites and remote-access contingencies, third-party risk management with substitutability, severe but plausible scenario analysis, secure and resilient information systems with immutable offline backup, surveillance and reporting, and the Appendix A cyber risk management practices from governance to third-party risk. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does US Interagency Sound Practices to Strengthen Operational Resilience actually require?
US Interagency Sound Practices to Strengthen Operational Resilience has 49 controls organised across 8 domains. The largest domains are Section 3 Business continuity management (practices a to i) – US Interagency Sound Practices to Strengthen Operational Resilience (9 controls), Appendix A Table 1 Sound practices for cyber risk management (governance, identification, protection, detection, response, recovery, third-party risk management) – US Interagency Sound Practices to Strengthen Operational Resilience (7 controls), Section 2 Operational risk management (practices a to g) – US Interagency Sound Practices to Strengthen Operational Resilience (7 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of US Interagency Sound Practices to Strengthen Operational Resilience do I already cover?
US Interagency Sound Practices to Strengthen Operational Resilience does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement US Interagency Sound Practices to Strengthen Operational Resilience?
Start your US Interagency Sound Practices to Strengthen Operational Resilience compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about US Interagency Sound Practices to Strengthen Operational Resilience requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 49 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required