# Managed Operational Resilience — illustrative scoping and service specification

**Draft prepared 12 October 2026. Not an offer, standard terms or proof of delivery capacity.** A client-specific statement of work is effective only after the provider has confirmed competent staffing, buyer need, access permissions, commercial price and signed agreement.

## 30 / 60 / 90-day start
- **Days 1–30: Perimeter and baseline.** Confirm legal entities and applicable FCA/PRA requirements. Capture named sponsor and service owners, available IBS inventory, impact tolerance evidence, mapped dependencies, risks, board expectations and data handling restrictions. Produce an assumptions/unknowns log.
- **Days 31–60: Challenge and prioritise.** Verify critical supplier dependencies with owners, sample evidence chains, identify poorly-supported recovery claims, propose two exercise scenarios where within scope, and log outstanding gaps with consequences and decision owners.
- **Days 61–90: Exercise and govern.** Conduct only contractually authorised tabletop/desktop tests, track observed evidence, test escalation and communications, submit a remediation register and an accountable governance pack. Real technical failover tests are never automatic.

## Contract schedule: fields to agree before quoting
| Variable | Agree explicitly |
|---|---|
| Client legal entities | Named in-scope firm(s), regulated status verified by the client's specialists |
| Important services | Exact number, service owners, scope limitations and tolerance sign-off |
| Suppliers/dependencies | Agreed review list, client access permissions and change request threshold |
| Meetings | Number of monthly reviews and quarterly governance sessions |
| Exercises | Number, duration, testing environment, responsible reviewer and safe test boundaries |
| Senior specialist days | Named practitioner qualifications, time allocated, absence cover, escalation |
| Standard outputs | Change log, mapping exceptions, action register, test log and board decision record |
| Information security | Client-controlled evidence environment, access control, retention and AI policy |
| Turnaround | Explicit working-day communications window and excluded emergency response |
| Acceptance | Versioned report with source links, limitations, decisions, owner and approval date |
| Change control | Additional scope pricing, review, cancellations and issue escalation |
| Exit/handover | Repository and evidence export rights, review logs, outstanding actions and knowledge transfer |

## Important non-inclusions
This ordinary managed programme does **not** imply a 24/7 incident-response centre, guaranteed regulatory compliance, penetration testing, legal advice, licensed certification, live system cutovers or unlimited vendor interviews. Specialist engagements require separately approved scope and personnel.

## Suggested quarterly board pack index
1. Changed important services or impact tolerance rationale
2. Current mapping confidence by people/process/data/technology/suppliers
3. Severe scenario test observations, limits and outstanding gaps
4. Vulnerabilities by customer consequence, age, owner and risk acceptance
5. Supplier dependence and practical exit/readiness issues
6. Prior decisions closed with evidence and issues requiring approval

Use the factual [worked payment-processor simulation](/examples/payments-processor-outage-board-evidence/) only as a **fictional example**, not evidence of prior client engagements.