Last verified: 8 September 2026. Children: finance · DORA · healthcare · 2026 convergence.
Direct Answer: Continuity compliance is a named plan, approved RTOs, a test calendar with results, and third-party clauses you can show. Finance, healthcare, and infrastructure do not share one statute. Multi-region failover for a bank is an operational-resilience file, not a slogan.
| Sector | Typical names | What they ask to see |
|---|---|---|
| US banks / markets | OCC, FFIEC, SEC, Fed | BCP, tests, vendor resilience |
| EU finance | DORA | ICT risk, incident reporting, testing, register of information |
| Healthcare | CMS EP, Joint Commission, HIPAA contingency | EOP, annual exercises, comms |
| Infrastructure | CISA, NERC CIP, CIRCIA | Sector controls + reporting |
| Management system | ISO 22301 | BCMS you can audit |
Confirm live text on the regulator’s page before you cite a date. Severe-but-plausible testing: operational resilience testing.
FAQ
What activity validates that recovery plans work?
Testing with an after-action. See the exercise desk.
Is DORA a US bank rule?
No. It is EU. US firms with EU financial entities or critical ICT roles still read it.