Operational Resilience & Third-Party Risk Toolkit — OSFI B-10/E-21, DORA (Word + Excel)

When a critical vendor fails or a critical operation stops, regulators no longer ask whether you had a policy — they ask for your register, your impact analysis, your tolerances, and your test evidence. This toolkit builds all of it as one connected system: third-party risk management and operational resilience, implemented against the three frameworks that now define the field — OSFI B-10 (third-party risk), OSFI E-21 (operational risk & resilience, effective 1 November 2025) and the EU's DORA (Regulation (EU) 2022/2554, applying since 17 January 2025) — aligned throughout to ISO 22301 business continuity practice.

Framework stack:

• OSFI Guideline B-10 — Third-Party Risk Management: governance, inventory & materiality, due diligence, contract provisions, monitoring, fourth parties, concentration risk, exit strategies
• OSFI Guideline E-21 — Operational Risk Management and Resilience: critical operations, tolerances for disruption, end-to-end dependency mapping, severe-but-plausible scenario testing
• EU DORA — Regulation (EU) 2022/2554 — ICT risk management, major-incident classification & reporting, resilience testing and TLPT, ICT third-party risk: the Article 28(3) register of information, pre-contract assessment, Article 30 contractual provisions, exit strategies
• ISO 22301 — business impact analysis, continuity strategies, plans, and exercise programmes (clauses 8.2–8.5)

What's included (12 items):

• Start Here Guide — the framework map, how the pieces fit, and the order to work in
• Third-Party Risk Management Policy — the full B-10 lifecycle: four risk tiers with approvals, due-diligence depth by tier, mandatory contract provisions, fourth-party and concentration rules, monitoring cadence, tested exit strategies
• Business Impact Analysis Guide and Template — the seven-step BIA method, an impact rating scale, and fill-in process and dependency tables with a worked example: impacts over time, MTPD, RTO/RPO, minimum service levels, E-21 tolerance statements
• Business Continuity Plan Template — activation criteria and severity guide, response teams, the first-four-hours procedure, strategies for system loss, vendor outage, facility loss, workforce loss, cyber incidents and regional events, backlog and stand-down management
• Disaster Recovery Plan Template — tiered systems inventory, 3-2-1-1-0 backup standards, recovery sequencing and failback, SaaS/vendor recovery handling, restore and failover testing requirements
• Crisis Communications Pack — spokesperson and approval rules plus pre-approved templates: holding statements (disruption, cyber, vendor failure), internal staff notice, customer notice, regulator notification, service-restored message, media Q&A preparation
• Resilience Testing and Exercises Guide — seven test types and what each proves, programme rules, a six-scenario library (ransomware, 48-hour vendor outage, cloud region failure, facility loss, workforce loss, backup compromise) with injects and success criteria, and a 1–5 scoring rubric
• Vendor Due Diligence Questionnaire (Excel) — 46 resilience-focused questions in 8 sections: financial viability, business continuity, disaster recovery, insurance, subcontractors & fourth parties, concentration risk, exit & portability, governance & track record — Yes/Partial/No/N/A dropdowns, reviewer guidance on every question, and an automatic scoring summary with a suggested tier
• Vendor Criticality Register (Excel) — your B-10 inventory and DORA register of information: criticality tier, materiality, critical-operation support, substitutability, data locations, contract dates and notice periods, due-diligence dates, monitoring frequency, exit-strategy status — with a summary dashboard flagging overdue reviews and contracts expiring within 180 days
• Resilience Gap Checklists (Excel) — 59 requirements across three sheets (OSFI B-10: 20 · OSFI E-21: 18 · EU DORA: 21), each with a plain-English explanation, status dropdown, owner and evidence columns
• Testing and Exercise Log (Excel) — the examiner-ready evidence log for every exercise and test, with findings, actions, owners and due dates, plus an annual programme planner
• Copyright & Licence Terms

Who it's for: operational risk and resilience leads, third-party risk and vendor management teams, business continuity managers, CIOs and CISOs, and compliance teams at banks, credit unions, insurers, payment and fintech firms — and any organization whose customers, insurers, or regulators now ask B-10, E-21 or DORA questions. Pairs with the Vendor Security Assessment Pack: that pack tests a vendor's security controls; this one tests whether the vendor keeps you running — and lets you leave.

Please note: Templates and general information, not legal advice, certification, or a guarantee of compliance with any framework named. Framework summaries are a working consolidation — verify requirement text against the official publications (OSFI; EUR-Lex) and the applicable technical standards.

Copyright & licence: © 2026 Zee Consulting. All rights reserved. This product and everything in it is the intellectual property of Zee Consulting. Your purchase gives one named organization a licence to use and customize the documents for its own internal business — nothing more. The files must not be resold, shared, redistributed, sublicensed, or given to clients or any other organization, in original or modified form. Anyone who uses these materials without a licence is infringing copyright, and Zee Consulting reserves the right to pursue litigation and claim damages and legal costs to the fullest extent permitted by law. The full Copyright & Licence Terms are included in the download (Copyright_and_Licence_Terms.docx) and inside the Start Here guide.

Requirements: Microsoft Word and Excel (or compatible: Google Docs/Sheets, LibreOffice). Instant download after purchase — no shipping, no waiting.