Business impact analysis, dependency mapping and tested recovery - with supplier risk linked directly to the services that keep you running.
When the supplier goes down, you go down. Map the dependency before the incident - and make the link visible to your board.
Score services by impact over time - RTO, RPO and maximum tolerable disruption.
An interactive dependency graph links each service to the suppliers, systems and assets it relies on - and auto-derives a per-service dependency-risk score from the map.
Owned continuity plans per critical service - activation criteria, recovery steps, comms plan and an approval workflow, exportable to PDF.
Run and record exercises from tabletop to full failover - capturing achieved RTO against target, with findings tracked to closure.
Supplier compromise maps straight to service impact - exposure known before the event.
Plans re-validated on change; gaps tracked to closure.
FCA, PRA, DORA and the NCSC CAF all expect proven recovery of important business services within impact tolerance. Here it is - live, not a binder on a shelf.
A live resilience score across the whole lifecycle - not a binder on a shelf, a posture that moves as your controls, dependencies and tested plans change.
| Capability | BIA spreadsheet | BCP documents | CMDB | Business Resilience |
|---|---|---|---|---|
| BIA with RTO / RPO | Frozen snapshot | Not really | Asset data only | Live, criticality-scored |
| Dependency graph | None | Free text | Wiring, not impact | Interactive, FK-linked |
| Cascade / blast radius | None | None | Partial | Mapped before the incident |
| Tested continuity + log | None | Filed, never tested | None | Tabletop to full failover |
| Recovery-readiness score | None | None | None | Prevent / Absorb / Recover |
| Connected to your platform | Re-keyed | Re-keyed | Separate tool | Reuses services, assets, risk & CAF |
RTO, RPO and MTPD per critical service, with impact modelled over time.
Every supplier and system a service relies on - concentration risk made visible.
Tabletop and scenario exercises with findings tracked through to closure.
Pre-map supplier dependencies to critical services, so ‘are we exposed?’ is answered in minutes.