Banking IT: how our controls map to operational-resilience expectations
We do not currently serve a bank. This guide shows how the controls we run map to the operational-resilience expectations of the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA), and to the Digital Operational Resilience Act (DORA), so a buyer can assess fit quickly.
Discuss a readiness assessmentWhat the frameworks expect
Operational resilience (PRA SS1/21 and FCA PS21/3)
Firms identify their important business services, set an impact tolerance for each and show they can stay within it through severe but plausible scenarios. Suppliers to those services are asked for evidence.
DORA and third-party risk
Since 17 January 2025, financial entities in the EU keep a register of their information and communication technology (ICT) third-party arrangements, identify those that support critical or important functions, plan exits and include required contract terms.
Recovery that has been tested
Reviews look for evidence that systems and data have been recovered in a test, ideally from backups that cannot be altered, rather than a statement that backups exist.
What our standard controls include
Backup and recovery
Nightly backups, continuous replication from London to our disaster-recovery site in Sofia, and an offline encrypted archive of the platform for an offsite tape cycle.
Identity and access
Single sign-on, a tiered admin model that separates support, engineering and infrastructure access, and per-client access groups.
Monitoring and response
Security monitoring with Wazuh, infrastructure monitoring with Zabbix and alerts that open tickets, with response targets set in our standard agreement.
Where it runs
A private cloud we built and operate in London, replicated to Sofia, Bulgaria, and Microsoft 365 and Azure in UK or EU regions when you choose them. Our sub-processors are listed on our trust page.
How our controls map
We map our controls to Cyber Essentials Plus, the UK General Data Protection Regulation (UK GDPR) and NIST CSF 2.0, the Cybersecurity Framework of the US National Institute of Standards and Technology. For a bank, we would extend that mapping to SS1/21 and DORA as part of a readiness assessment.
How we protect client data is set out on our trust page.
Frequently asked questions
How would you support our operational-resilience mapping?
As part of a readiness assessment, we would map the services we run for you to your important business services and impact tolerances, and provide evidence for the scenarios you test.
How would you supply information for our DORA register?
We would provide it for each service we supply: what it is, where it runs, the sub-processors involved and our exit arrangements.
What evidence of recovery testing can you show?
Tier-1 services were restored at our disaster-recovery site in Sofia in September 2026, and a full offline, encrypted archive of the platform was restore-tested in August 2026. We would share the records under NDA.
Discuss a readiness assessment
A 30-minute call, no slides. We walk through your framework and how our controls would map to it.
Book a call