Building societies should plan for disruption that lasts weeks, not hours. That means defining the minimum service the Society must protect, agreeing in advance what evidence is needed before restarting, making decision rights clear at every level, agreeing expectations with critical third parties, and testing recovery with people and technology together.
Most building societies have business continuity and disaster recovery plans, and most have tested them in some form. What those plans often assume is that disruption will be short. A system fails, a recovery site takes over, and service is back within hours.
The scenarios that now concern regulators and boards tend to last longer. A ransomware attack that reaches backups. A major cloud or third-party outage, of the kind the authorities rehearsed with the sector in this year’s SIMEX exercise. A payment system failure that spreads across firms. Or corruption of data that is only discovered after it has been copied into every recovery environment.
Since the operational resilience transition ended in March 2025, firms are expected to show that their arrangements would work in events like these, and what they would do once impact tolerances had been breached.
Why isn't a short-outage plan enough?
Because most recovery planning assumes systems fail and come back quickly. Traditional recovery planning is built around availability. Something stops, you switch to a secondary arrangement, and you restore within a recovery time objective.
Prolonged events break that pattern in different ways. Backups may be unusable or unproven. A third party may be down for days with no workaround. Counterparties may suspend connections until they are confident it is safe to reconnect. In some cyber scenarios, the integrity of the data itself is in question, so restoring it quickly is not the same as restoring it safely.
The longer an event runs, the more the questions change. Early on, they are about member service and impact tolerances. Over time, they become questions about liquidity, funding and confidence in the Society itself.
What should a building society protect in a prolonged disruption?
The most useful preparation for a long disruption is agreeing in advance what the Society must protect. Many firms describe this as a minimum viable company: the smallest version of the organisation that must keep running, and the minimum each important business service must still deliver.
CMORG’s guidance on cyber recovery makes the same point. In an event that threatens viability, restoring every service within its time-based tolerance is unlikely to be achievable, so firms should define a minimum scope in advance and keep it narrow.
Useful questions to settle early:
Our page on the Minimum Viable Company explores this in more depth.
How does a building society know it is safe to resume services?
It needs evidence, agreed in advance, that systems and data can be trusted and that counterparties are ready. Restarting too soon can do more damage than staying closed, because a second failure costs far more confidence than the first. Few firms have agreed, in calm conditions, what evidence they would need before restarting a service, who would provide it, and how independent it should be.
The answer will vary by scenario. After a cyber event, it is likely to include independent confirmation that systems and data are clean, reconciliation against external sources, and agreement from counterparties that they are ready to reconnect. Boards may be asked to stand behind a decision to resume, so setting those expectations early pays off.
Who should make decisions during a prolonged disruption?
Each tier needs written authority for what it can decide, what it reports and when it escalates. Most societies run a tiered response, from operational teams through an incident management team to the Board. In a long event, uncertainty about who can decide what is one of the most common causes of delay.
Setting this out saves time early on and stops senior leaders being drawn into detail. The Board benefits from the same clarity: agreed crisis terms of reference, a clear point at which matters reach it, and a standard briefing that separates what is known from what is assumed.
How should building societies test their recovery plans?
With a layered programme that tests people and technology together. Exercising remains essential, but its purpose has shifted towards finding where recovery would break in practice, for people and technology together.
Vary the scenarios and the people involved. Repeating the same outage builds comfort rather than capability. Front-line colleagues are where members feel an incident first, so include them too. Our exercise for the BCI North-East Chapter used role rotation to give participants that wider view.
What should building societies agree with third parties?
In a serious incident, critical suppliers and counterparties make their own decisions, often to protect themselves. If they disconnect, your restart date is partly in their hands.
The aim is not to bring them into your crisis room. It is to agree beforehand what they can expect from you: your contingencies, how you will keep them informed, and what they will need to see before reconnecting. CMORG’s reconnection framework is a good starting point. With new incident and third-party reporting requirements on the way, it is also worth rehearsing who tells which regulator what, and when.
How do you keep a response going for weeks?
A long event needs rotation, named deputies, welfare support and pre-agreed access to outside expertise. Decisions get worse with fatigue, and a response that depends on a few specialists stalls if they are unavailable. Building that depth is unglamorous, but it is often what keeps a response working in its third week.
Where should a building society start?
Each of these starts with a decision taken in calm conditions, which is far easier than taking it mid-incident. As we argued in why single-event planning is no longer enough, resilience is built long before the event that tests it.
Ready to put your plans to the test?
Having business continuity and disaster recovery plans in place is a starting point. The real test is whether they will work when disruption lasts longer than expected, systems and data cannot be trusted, or critical third parties are unavailable.
We work with building societies, mid-tier banks and insurers to validate recovery arrangements through realistic, scenario-led exercises that test decision-making, people, processes and technology together. This helps identify gaps, challenge assumptions and give leadership teams greater confidence in their ability to maintain critical services and recover safely. Get in touch to discuss how we can help put your plans to the test.