Third-party resilience

Third-party resilience exercises test how your firm responds when a critical supplier or provider fails. There is no attacker to choose. The exercise is about keeping important services running, meeting your notification duties and managing the supplier through to recovery.

Who can use it

Third-party resilience is included in Pro and Enterprise. It is available when your region is one of:

United Kingdom
European Union
Australia
United Arab Emirates

Each exercise is played against the regulatory reference for your region. If your region is anything else, the Third-Party Resilience filter does not appear. To change your region, see Choose your region.

Scenarios

Core Banking Platform Failure
Critical Supplier Insolvency
Cloud Infrastructure Provider Outage
Ransomware Attack on Key Supplier
Sanctions Designation of a Supplier
Key-Person Dependency at Critical Supplier
Regulatory Enforcement Action Against Supplier
Data Centre Physical Security Incident

In the UAE: choose CBUAE or VARA

If your region is the United Arab Emirates, a UAE regulator: choice appears above the scenarios when you select the Third-Party Resilience filter:

CBUAE: licensed financial institutions
VARA: virtual asset service providers (Dubai)

Pick the one that regulates your firm. It sets the regulatory reference for the exercise. With VARA, Core Banking Platform Failure is not offered, because a virtual asset service provider has no core banking platform. If you switch regulator and your selected scenario is not offered for it, the selection is cleared.

Run an exercise

On Select a scenario, select the Third-Party Resilience filter.
In the UAE, choose your regulator.
Select a scenario, then select Continue to briefing.
On the briefing, add attendees if you like and choose the pressure on your team.
Select Begin exercise.

The rounds follow the third-party resilience phases: Detection & Triage, Invocation & Continuity, Regulatory Assessment & Notification, Supplier & Stakeholder Management, Recovery & Reconciliation and Post-Incident Review. The PDF report includes a Resilience Checklist.