stratops.Cyber capabilities as a service
Domain · Crisis, incidents and continuity

Exercised plans that hold on the day of the crisis.

We identify the activities that cannot stop, build the continuity and recovery plans that protect them, and exercise them with your teams until they work.

Describe your needAll domains
Situations

You are in the right place if…

  • Your continuity plan is several years old and has never been tested.
  • You do not know how long your activities can run without IT.
  • Your backups exist, but nobody has checked that a full restore works.
  • A recent incident showed that nobody knew who decided.
  • A client or an authority asks for proof of your crisis exercises.
Our conviction

A plan never exercised does not hold on the day of the crisis.

On the day of the crisis, you discover outdated numbers, unusable backups, forgotten dependencies and decisions nobody dares take. A plan written but never played gives false assurance.

So we start from the impact on your activities, build short, operational plans, and exercise them. Each exercise produces lessons learned; each lesson improves the plan.

Our approach

From business impact to an exercised plan.

Plans proportionate to your size, that fit on a few pages and play out in a few hours.

  1. 01Measure the impactThe business impact analysis (BIA): critical activities, tolerable downtime, acceptable data loss.

    You getA BIA approved by management

  2. 02Build the plansCrisis organisation, continuity and recovery plans, backups matched to the objectives set.

    You getShort, operational plans

  3. 03ExerciseTabletop exercises, restore tests, simulations: from the simplest to the most realistic.

    You getDated exercise reports

  4. 04Learn the lessonsEach exercise or real incident yields lessons learned and tracked improvement actions.

    You getA tracked improvement plan

What the texts say

What the texts expect of continuity.

The texts are not content with a plan: they ask for tested backups, exercised plans and lessons learned.

  • DORADORA art. 11(1) · DORA art. 11(4) · DORA art. 11(6), point (a) · DORA art. 12(1), point (a)

    Financial entities put in place an ICT business continuity policy, maintain and periodically test their continuity plans, at least once a year, and document their backup policies.1234

  • NIS 2NIS 2 art. 21(2), point (c)

    The directive lists business continuity, backup management, disaster recovery and crisis management among the measures Member States must require of entities.5

  • ReCyFReCyF v2.5, objectif 13 · ReCyF v2.5, objectif 14 · ReCyF v2.5, objectif 15

    The ReCyF (working version) sets entities the objective of backups tested at least once a year, continuity and recovery plans for essential entities, preparation for cyber crises and regular exercises.678

  • GDPRRGPD art. 32(1), point (c)

    Security measures include, as appropriate, the ability to restore the availability of and access to personal data in a timely manner after an incident.9

The texts do not apply to every organisation: whether they apply depends on your status, your sector, your size and your contracts. Have it confirmed by your legal counsel or a specialised lawyer.

Our engagement

The same topic, at three levels of engagement.

You choose the level; the scope and deliverables are set by contract.

Level 01

Monitor

At agreed intervals, we check that backups restore and that plans and contacts are up to date.

Deliverables
  • Recurring check of restores
  • Review of contacts and critical dependencies
  • Schedule of exercises and reviews
Level 02

Advise

We conduct the BIA, write or review the plans and design the exercises.

Deliverables
  • Business impact analysis
  • Continuity and recovery plans
  • Exercise scenarios suited to your activities
Level 03

Drive

We run the exercises and the follow-up of improvements with your teams, without making the changes in your systems.

Deliverables
  • Running crisis exercises
  • Lessons learned and improvement plan
  • Evidence file for your clients and authorities
Accelerators

What we bring from day one.

BIA framework

A questionnaire and a scoring method that allow a first impact analysis in a few interviews.

Exercise scenarios

Ransomware, loss of a provider, a site unavailable: scenarios ready to adapt, with their injects.

Short plans

Templates for crisis, continuity and recovery plans that fit on a few pages.

Frequently asked questions

Before we start.

How often must plans be tested?

For a financial entity subject to DORA, at least once a year, and at each substantive change to the systems supporting critical functions. For others, we recommend at least one exercise a year and a more frequent restore test.3

Does an exercise disrupt production?

A tabletop exercise does not: it is played in a meeting room. Technical tests, such as a restore, are scheduled on an environment and a slot agreed in writing.

Do you run the real crisis?

We can support your crisis unit, coordinate the parties and keep the log; the decisions remain your management’s.

Must the continuity plan cover our providers?

Yes, when they support a critical activity: their failure is one of the scenarios. DORA expressly provides for it for critical functions entrusted to ICT providers.2

Start with your critical activities.

Describe your organisation and your existing plans. We come back to you with a proposal for a BIA or a first exercise.

Describe your need
Sources

The excerpts quoted.

Exact text, in its original language, from the frameworks extracted from the official text.

Show the 9 excerpts quoted
  1. 1DORA art. 11(1)32022R2554-a11-p1
    As part of the ICT risk management framework referred to in Article 6(1) and based on the identification requirements set out in Article 8, financial entities shall put in place a comprehensive ICT business continuity policy, which may be adopted as a dedicated specific policy, forming an integral part of the overall business continuity policy of the financial entity.
    Normative force
    directly applicable EU law (regulation, level 1)
    Source
    Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector
    Version
    CELEX 32022R2554 — ELI reg/2022/2554
    Official text
  2. 2DORA art. 11(4)32022R2554-a11-p4
    Financial entities shall put in place, maintain and periodically test appropriate ICT business continuity plans, notably with regard to critical or important functions outsourced or contracted through arrangements with ICT third-party service providers.
    Normative force
    directly applicable EU law (regulation, level 1)
    Source
    Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector
    Version
    CELEX 32022R2554 — ELI reg/2022/2554
    Official text
  3. 3DORA art. 11(6), point (a)32022R2554-a11-p6-1
    test the ICT business continuity plans and the ICT response and recovery plans in relation to ICT systems supporting all functions at least yearly, as well as in the event of any substantive changes to ICT systems supporting critical or important functions;
    Normative force
    directly applicable EU law (regulation, level 1)
    Source
    Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector
    Version
    CELEX 32022R2554 — ELI reg/2022/2554
    Official text
  4. 4DORA art. 12(1), point (a)32022R2554-a12-p1-1
    backup policies and procedures specifying the scope of the data that is subject to the backup and the minimum frequency of the backup, based on the criticality of information or the confidentiality level of the data;
    Normative force
    directly applicable EU law (regulation, level 1)
    Source
    Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector
    Version
    CELEX 32022R2554 — ELI reg/2022/2554
    Official text
  5. 5NIS 2 art. 21(2), point (c)32022L2555-a21-p2-3
    business continuity, such as backup management and disaster recovery, and crisis management;
    Normative force
    EU law to be transposed (directive): not directly applicable, requires national transposition
    Source
    Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)
    Version
    CELEX 32022L2555 — ELI dir/2022/2555
    Official text
  6. 6ReCyF v2.5, objectif 13recyf:obj-13
    Les entités [importantes ou essentielles] mettent en œuvre des mécanismes de sauvegarde et de restauration opérationnels et les testent au minimum une fois par an. Les entités [essentielles] définissent et maintiennent à jour des plans de continuité et de reprise d’activité adaptés aux besoins de leurs activités et services.
    Normative force
    obligation (decree, resilience bill)
    Source
    ReCyF — Référentiel Cyber France (NIS 2, transposition nationale)
    Version
    2.5 du 17/03/2026 (version de travail)
    Status
    Working version: not binding until the transposition is enacted
    Official text
  7. 7ReCyF v2.5, objectif 14recyf:obj-14
    Les entités [importantes ou essentielles] mettent en œuvre une organisation, des processus et des outils adaptés pour se préparer et réagir à des crises d’origine cyber et tiennent à la disposition des autorités nationales compétentes et en particulier de l’autorité nationale de sécurité des systèmes d’information les informations relatives aux parties prenantes externes à l’entité pertinente dans la gestion de la crise. Les [entités essentielles] mettent en œuvre des retours d’expérience permettant d’identifier les axes d’amélioration et les mesures associées à mettre en œuvre suite à un entraînement, un exercice ou une crise réelle.
    Normative force
    obligation (decree, resilience bill)
    Source
    ReCyF — Référentiel Cyber France (NIS 2, transposition nationale)
    Version
    2.5 du 17/03/2026 (version de travail)
    Status
    Working version: not binding until the transposition is enacted
    Official text
  8. 8ReCyF v2.5, objectif 15recyf:obj-15
    Les entités [importantes ou essentielles] réalisent des exercices, tests et entraînements à intervalles réguliers pour vérifier la capacité de leur organisation, de leurs processus, de leurs outils et de leur préparation à faire face aux incidents de sécurité et aux crises d’origine cyber.
    Normative force
    obligation (decree, resilience bill)
    Source
    ReCyF — Référentiel Cyber France (NIS 2, transposition nationale)
    Version
    2.5 du 17/03/2026 (version de travail)
    Status
    Working version: not binding until the transposition is enacted
    Official text
  9. 9RGPD art. 32(1), point (c)32016R0679-a32-p1-3
    the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
    Normative force
    directly applicable EU law (regulation, level 1)
    Source
    Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
    Version
    CELEX 32016R0679 — ELI reg/2016/679
    Official text