{"product_id":"operational-resilience-third-party-risk-toolkit-osfi-b-10-e-21-dora-word-excel","title":"Operational Resilience \u0026 Third-Party Risk Toolkit — OSFI B-10\/E-21, DORA (Word + Excel)","description":"\u003cp\u003eWhen a critical vendor fails or a critical operation stops, regulators no longer ask whether you had a policy — they ask for your register, your impact analysis, your tolerances, and your test evidence. This toolkit builds all of it as one connected system: third-party risk management and operational resilience, implemented against the three frameworks that now define the field — \u003cstrong\u003eOSFI B-10\u003c\/strong\u003e (third-party risk), \u003cstrong\u003eOSFI E-21\u003c\/strong\u003e (operational risk \u0026amp; resilience, effective 1 November 2025) and the EU's \u003cstrong\u003eDORA\u003c\/strong\u003e (Regulation (EU) 2022\/2554, applying since 17 January 2025) — aligned throughout to \u003cstrong\u003eISO 22301\u003c\/strong\u003e business continuity practice.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eFramework stack:\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eOSFI Guideline B-10\u003c\/strong\u003e — Third-Party Risk Management: governance, inventory \u0026amp; materiality, due diligence, contract provisions, monitoring, fourth parties, concentration risk, exit strategies\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eOSFI Guideline E-21\u003c\/strong\u003e — Operational Risk Management and Resilience: critical operations, tolerances for disruption, end-to-end dependency mapping, severe-but-plausible scenario testing\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eEU DORA — Regulation (EU) 2022\/2554\u003c\/strong\u003e — ICT risk management, major-incident classification \u0026amp; reporting, resilience testing and TLPT, ICT third-party risk: the Article 28(3) register of information, pre-contract assessment, Article 30 contractual provisions, exit strategies\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eISO 22301\u003c\/strong\u003e — business impact analysis, continuity strategies, plans, and exercise programmes (clauses 8.2–8.5)\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWhat's included (12 items):\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eStart Here Guide — the framework map, how the pieces fit, and the order to work in\u003c\/li\u003e\n\u003cli\u003eThird-Party Risk Management Policy — the full B-10 lifecycle: four risk tiers with approvals, due-diligence depth by tier, mandatory contract provisions, fourth-party and concentration rules, monitoring cadence, tested exit strategies\u003c\/li\u003e\n\u003cli\u003eBusiness Impact Analysis Guide and Template — the seven-step BIA method, an impact rating scale, and fill-in process and dependency tables with a worked example: impacts over time, MTPD, RTO\/RPO, minimum service levels, E-21 tolerance statements\u003c\/li\u003e\n\u003cli\u003eBusiness Continuity Plan Template — activation criteria and severity guide, response teams, the first-four-hours procedure, strategies for system loss, vendor outage, facility loss, workforce loss, cyber incidents and regional events, backlog and stand-down management\u003c\/li\u003e\n\u003cli\u003eDisaster Recovery Plan Template — tiered systems inventory, 3-2-1-1-0 backup standards, recovery sequencing and failback, SaaS\/vendor recovery handling, restore and failover testing requirements\u003c\/li\u003e\n\u003cli\u003eCrisis Communications Pack — spokesperson and approval rules plus pre-approved templates: holding statements (disruption, cyber, vendor failure), internal staff notice, customer notice, regulator notification, service-restored message, media Q\u0026amp;A preparation\u003c\/li\u003e\n\u003cli\u003eResilience Testing and Exercises Guide — seven test types and what each proves, programme rules, a six-scenario library (ransomware, 48-hour vendor outage, cloud region failure, facility loss, workforce loss, backup compromise) with injects and success criteria, and a 1–5 scoring rubric\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eVendor Due Diligence Questionnaire (Excel)\u003c\/strong\u003e — 46 resilience-focused questions in 8 sections: financial viability, business continuity, disaster recovery, insurance, subcontractors \u0026amp; fourth parties, concentration risk, exit \u0026amp; portability, governance \u0026amp; track record — Yes\/Partial\/No\/N\/A dropdowns, reviewer guidance on every question, and an automatic scoring summary with a suggested tier\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eVendor Criticality Register (Excel)\u003c\/strong\u003e — your B-10 inventory and DORA register of information: criticality tier, materiality, critical-operation support, substitutability, data locations, contract dates and notice periods, due-diligence dates, monitoring frequency, exit-strategy status — with a summary dashboard flagging overdue reviews and contracts expiring within 180 days\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eResilience Gap Checklists (Excel)\u003c\/strong\u003e — 59 requirements across three sheets (OSFI B-10: 20 · OSFI E-21: 18 · EU DORA: 21), each with a plain-English explanation, status dropdown, owner and evidence columns\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eTesting and Exercise Log (Excel)\u003c\/strong\u003e — the examiner-ready evidence log for every exercise and test, with findings, actions, owners and due dates, plus an annual programme planner\u003c\/li\u003e\n\u003cli\u003eCopyright \u0026amp; Licence Terms\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWho it's for:\u003c\/strong\u003e operational risk and resilience leads, third-party risk and vendor management teams, business continuity managers, CIOs and CISOs, and compliance teams at banks, credit unions, insurers, payment and fintech firms — and any organization whose customers, insurers, or regulators now ask B-10, E-21 or DORA questions. Pairs with the Vendor Security Assessment Pack: that pack tests a vendor's security controls; this one tests whether the vendor keeps you running — and lets you leave.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003ePlease note:\u003c\/strong\u003e Templates and general information, not legal advice, certification, or a guarantee of compliance with any framework named. Framework summaries are a working consolidation — verify requirement text against the official publications (OSFI; EUR-Lex) and the applicable technical standards.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eCopyright \u0026amp; licence:\u003c\/strong\u003e © 2026 Zee Consulting. All rights reserved. This product and everything in it is the intellectual property of Zee Consulting. Your purchase gives one named organization a licence to use and customize the documents for its own internal business — nothing more. The files must not be resold, shared, redistributed, sublicensed, or given to clients or any other organization, in original or modified form. Anyone who uses these materials without a licence is infringing copyright, and Zee Consulting reserves the right to pursue litigation and claim damages and legal costs to the fullest extent permitted by law. The full Copyright \u0026amp; Licence Terms are included in the download (Copyright_and_Licence_Terms.docx) and inside the Start Here guide.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eRequirements:\u003c\/strong\u003e Microsoft Word and Excel (or compatible: Google Docs\/Sheets, LibreOffice). Instant download after purchase — no shipping, no waiting.\u003c\/p\u003e","brand":"Zee Consulting Templates","offers":[{"title":"Default Title","offer_id":67862651666619,"sku":"ZEE-RES-010","price":299.0,"currency_code":"CAD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0777\/6570\/5915\/files\/operational-resilience-tprm-toolkit-cover.png?v=1792807729","url":"https:\/\/zeeconsulting.myshopify.com\/products\/operational-resilience-third-party-risk-toolkit-osfi-b-10-e-21-dora-word-excel","provider":"Zee Consulting Templates","version":"1.0","type":"link"}