Industries
Your customers trust you with their money. Your program has to earn it on the worst day.
Banks, credit unions, insurers, broker-dealers, and investment firms run on systems that can’t go down, third parties they don’t control, and examiners who will ask what happened and why.
We help financial services firms build business continuity, crisis management, and IT disaster recovery programs that recover the services customers depend on, satisfy the examiners and auditors who check them, and stay simple enough for your teams to run.
✅ Practitioner-led, not advisory
✅ One program that answers to FFIEC, FINRA, SEC, and your third-party risk team
✅ Tested in real exercises, not just on paper
What we hear from financial services leaders
We’ve worked with banks, insurers, investment firms, and other financial institutions for more than a decade. We hear the same things from the people who run their programs:
“It’s quite clear we wouldn’t be in a good spot if we had to recover.”
“We don’t know what we can recover, in what order.”
“We can’t figure out what’s tied to what.”
“How far back we can go, how safe it would be, how fast we can do it. We don’t know any of that.”
“We need to build the case for cyber recovery.”
“Great job reporting the risk. Now we need to do something about it.”
“I don’t have enough time and hands.”
Sound familiar? You don’t need another consultant to tell you what you already know. You need practitioners who will find the gaps, build what’s missing, and help you run it.
The financial services reality
Few industries answer to as many continuity and resilience expectations as financial services, and they keep moving:
- The FFIEC Business Continuity Management booklet, released in November 2019, replaced the 2015 planning booklet. It moved examiners from checking plans to assessing how you manage continuity across the enterprise, as part of operational resilience.
- The Federal Reserve, OCC, and FDIC published Sound Practices to Strengthen Operational Resilience in 2020 for the largest banks, and in 2023 finalized interagency guidance on managing third-party relationships, which replaced each agency’s earlier guidance.
- FINRA Rule 4370 requires every member firm to keep a written business continuity plan, have a member of senior management approve it, and review it every year.
- The SEC gives a public company four business days to disclose a cyber incident after it determines the incident is material.
- Outside the US, the EU’s Digital Operational Resilience Act (DORA) has applied to financial entities since January 17, 2025, and UK regulators required firms to be able to stay within impact tolerances for their important business services by March 31, 2025.
The threats move faster than the rules. A targeted intrusion, a ransomware attack, or a failure at a critical vendor can stop the services your customers depend on in hours. The exam, the disclosure clock, and the headlines all start at the same time.
The answer isn’t a separate binder for every regulator. It’s one program, with one set of plans, one crisis structure, and one testing calendar, that satisfies all of them.
How we help financial services firms
- Resiliency Diagnosis®. A standards-based evaluation of your continuity, crisis, and recovery capabilities against FFIEC, ISO 22301, and NIST, with a maturity score and a prioritized roadmap, in about 12 weeks.
- Business continuity and Business Continuity as a Service. BIAs, plans, governance, and exercises, built with you or run for you, with the audit evidence FFIEC and FINRA examiners look for.
- Resilience as a Service. Business continuity, crisis management, IT disaster recovery, and exercises, run as one program.
- IT disaster recovery. Recovery tiers, dependency mapping, and recovery sequencing, so you know what comes back first and how long it takes.
- Crisis management and cyber incident response planning. One crisis structure, clear activation thresholds, and a cyber response that gets the materiality decision to your executives in time to meet the SEC clock.
- Crisis simulations and cyber crisis exercises. Data breach, ransomware, and payment systems scenarios, from technical tabletops to multi-day enterprise simulations.
- Third-party exercises. Joint exercises with the vendors you depend on most, so you see how the relationship holds up before an incident tests it.
- Crisis communications. Reputation monitoring, rapid response, and messaging for customers, investors, regulators, and the media.
- Maturity models. Self-assess against the FFIEC Business Continuity Maturity Model or, for broker-dealers, the FINRA Business Continuity Maturity Model built on Rule 4370.
“
I didn’t have the time or the hands to run the program the way the board expected. Bryghtpath runs it now. I went from reporting on risk to leading the program that answers for it.
Resilience Lead · Mid-Market Financial Services
70+
participants in one financial services firm’s two-day enterprise cyber simulation
4
crisis teams tested together, from privacy incident response to the executive crisis team
26
discovery interviews behind one global firm’s reputation strategy
24×7
media monitoring with a rapid response escalation process
Financial Services
From Technical Response to Executive Decision: An Enterprise Cyber Simulation
A two-day simulation for a leading financial services and insurance firm that tested decision authority, activation thresholds, and a single source of truth across four crisis teams.
Read the case study →
Financial Services
Reputation Monitoring and Rapid Response for a Global Financial Services Firm
24×7 monitoring, sentiment reporting to senior leaders, and a rapid response process for a major global firm facing ongoing challenges to its reputation.
Read the case study →
Insurance
An Executive Cyber-Extortion Exercise for a Major Health Insurer
Executives worked through the pay or no-pay decision, member and regulator notification, and board engagement in a ransomware scenario.
Read the case study →
Programs aligned to
FFIEC · FINRA · NIST SP 800-53 · ISO 22301 · ISO 22361 · ISO/IEC 27031
Our financial services work
All of our case studies are anonymized.
Banking, investment, and financial services firms
- An enterprise cyber crisis simulation for a leading financial services and insurance firm: two days, more than 70 participants, and a data breach scenario that tested decision authority and activation thresholds. Read the case study.
- Reputation monitoring and rapid response for a major global financial services firm facing ongoing, unwarranted challenges to its reputation. Read the case study.
Insurance
- An executive cyber-extortion exercise for a major U.S. health insurer, testing the decisions on payment, member and regulator notification, and board engagement. Read the case study.
More of our financial services work
- A new enterprise crisis management framework and plan for one of the largest US banks, built with internal stakeholders and executives, followed by training for the new crisis teams and executives and an exercise to validate the plan.
- Support for a Fortune 50 organization’s captive bank and financial services arm through an FFIEC and state regulator audit of business continuity and disaster recovery. We oversaw the collection of required artifacts and built the program elements that were missing. The organization cleared the audit without any significant findings in this area.
- Selection and implementation of a business continuity tool for a major global financial services firm, including custom forms and reporting, to mature its business continuity and disaster recovery program.
- A corporate aviation incident plan and exercise for a financial institution.
Frequently asked questions
Can you help us prepare for an FFIEC examination?
Yes. We build business continuity programs to the FFIEC Business Continuity Management booklet, from governance and the BIA through exercises, testing, and board reporting, and we help you assemble the evidence examiners ask for.
We're a broker-dealer. Do you work with FINRA Rule 4370?
Yes. Rule 4370 requires a written business continuity plan, approval by a member of senior management, and an annual review. Our FINRA Business Continuity Maturity Model shows where your program stands, and we can build or run the program behind it.
What's the difference between operational resilience and business continuity?
Business continuity recovers what stopped. Operational resilience asks whether the services your customers depend on keep running within limits you can tolerate. Regulators now expect both, and one program can deliver both.
How do you test third-party risk?
With joint exercises alongside your critical vendors, or dependency exercises your team runs alone. Questionnaires tell you what a vendor says it will do. An exercise shows you what happens.
Can an exercise help us meet the SEC's four-business-day disclosure window?
Yes. Our cyber exercises put the materiality decision in front of the people who make it, with legal and communications in the room, so you know how long the decision actually takes and who owns it.
Do you work with insurers and firms outside the US?
Yes. Our financial services work includes banks, investment firms, insurers, and real estate organizations, and our Resiliency Diagnosis® work spans North America, Europe, Asia, and the Middle East.
Can you run the program for us?
Yes. Through Business Continuity as a Service or Resilience as a Service, our team runs your program day to day, with your people owning the decisions.
We can help.
Let Bryghtpath put its financial services experience to work for your organization
From your next FFIEC exam to your next ransomware exercise, we’ll help you build a program that holds up when it matters.