Standardized Comprehensive Infrastructure Risk Assessment For Financial Sector Institutions (SCIRA-FSI)
In response to recent high-profile outages and increasingly complex hybrid IT architectures deployed by Financial Sector Institutions (FSIs), financial sector supervisory authorities are implementing regulatory requirements around operational resilience to encourage more proactive and effective risk management practices.
Recognizing the growing regulatory requirement and the adoption of more complex hybrid IT infrastructures by the FSI community, Uptime Institute has introduced the SCIRA-FSI assessment to help financial sector organizations assess the operational resilience of their critical infrastructure across enterprise-owned data centers, multi-tenant data center service providers, cloud, IT, and managed service providers. Uptime Institute brought together over 20 premier financial institutions from across the world to form its Program Design Partners and build a standardized approach to help the sector better assess and mitigate outages.
SCIRA-FSI is based on Uptime Institute’s analysis of over 20 data center and commonly applied financial sector standards, including internal assessment protocols shared by its Program Design Partners, common FSI infrastructure risks gathered from Uptime Institute’s Abnormal Incident Report database of 8,000 data points on the root cause of outages, and Uptime Institute’s experience working on over 250 FSI projects across the globe.
Request a Meeting
Have questions about SCIRA-FSI? 填写表格，我们将立即与您联系。
Legislation Update
EU’s Digital Operational Resilience Act Enacted 2023 年 1 月 16 日
The EU's Digital Operational Resilience Act (“DORA”) entered into force on 2023 年 1 月 16 日. Uptime Institute has tracked this legislation and its widespread impact on digital infrastructure owners, operators and providers since its initial draft published in 2020. Read more about this important legislation below.
Read the Update
Read the Update
SCIRA-FSI is Designed to Address Sector Challenges
In extensive interviews with the Financial Sector Institutions that participated as our Program Design Partners, we designed SCIRA-FSI to address the top three challenges facing global financial sector firms in regards to IT risk mitigation and regulatory compliance.
Sector Challenge
Resourcing Constraints Prevent Global Assessments
While outsourced IT service providers like cloud, colo and SaaS partners typically undergo a risk assessment during vendor due diligence, internal compliance departments and third-party regulators typically require ongoing assessments of these partners to remain compliant.
Many clients lack the staff resources or internal processes and protocols to conduct these assessments consistently and comprehensively at service-provider facilities around the world.
SCIRA-FSI Solution
Consistent Delivery, Around the Globe
With Uptime Institute staff on the ground in every major market globally, our clients can eliminate staff travel requirements and ensure they meet internal and regulatory requirements to perform standardized, consistent assessments of any owned and operated or third-party critical infrastructure.
This not only delivers consistency of approach and execution, but ensures the organization can identify outage risk across its IT estate.
Sector Challenge
Meeting Compliance and Regulatory Requirements
90% of our Design Partners stated that local regulators are more actively monitoring for outages and requesting proof that audits are being conducted on a regular basis.
FSIs must take a proactive, instead of a reactive stance in regards to IT audits - ensuring they can demonstrate evidence of consistent, standardized and regular audits of owned and third-party infrastructure.
SCIRA-FSI Solution
Ongoing Assessments from a Trusted Authority
SCIRA-FSI customers receive comprehensive assessments from Uptime Institute for their owned and operated sites as well as third-party colocation, cloud and SaaS sites.
Our assessments are designed to satisfy regulatory requirements for data center audits and demonstrate to regulators that you are taking a proactive stance to measure and reduce risk across your IT estate.
Sector Challenge
Standardized Assessments Across Infrastructure Partners
During product development, the feedback from our Design Partners was clear - the sector is looking for a comprehensive standard that incorporates FSI internal compliance and regulatory requirements in each market, while delivering consistency across the global IT estate.
SCIRA-FSI Solution
A Comprehensive Standard for Global Consistency
Our team reviewed the scope element from over 20 standards commonly used by the FSI community and reviewed numerous FSI internal assessments to develop our comprehensive standard.
The output is a standardized, comprehensive assessment across four key areas of risk, made up of 142 observation points to assess at each site. Each observation point is evaluated for level of risk, as well as a level of impact severity, giving customers a means to identify key focus areas for improvement and risk reduction.
SCIRA-FSI Assessment Components
SCIRA-FSI examines the underlying physical data centre infrastructure(s) including management and operational controls, along with design, operations, and oversight of the business service at a holistic level to minimize and mitigate both physical and operational outage risks.
Site Characteristics
Site location risks
建造特点
Building construction
建造特点
Building construction
Topology & Infrastructure
Infrastructure conditions
Power systems
Cooling systems
Supplementary systems
Security systems
Telecommunications
Power systems
Cooling systems
Supplementary systems
Security systems
Telecommunications
Facility Operations
人员配置及组织
Training and personnel development
Systems and program management
Health and safety
Training and personnel development
Systems and program management
Health and safety
Oversight
Regulatory compliance
Code compliance
Standards and certifications
Sustainability
Energy efficiency
Code compliance
Standards and certifications
Sustainability
Energy efficiency
Overview of the Assessment Process
During each site assessment visit, Uptime Institute consultants use the SCIRA-FSI assessment protocol to examine each scope element and determine whether the potential risk to site resilience is not present, present but mitigated, or present and unmitigated. The impact of risk is reviewed and evaluated based on the scale of risk and the impact severity of the consequences of failure.
Upon completing the assessment, clients receive a detailed report on their current physical and operational risks, a set of actionable recommendations for resolving those risks and an Executive Overview summarizing risks and recommendations from the assessment.
This approach not only aids FSIs in their efforts to proactively prevent outage incidents, but also serves as documentation for regulatory filing requirements to prove that a comprehensive risk management assessment has been completed for infrastructures that support critical business services.
SCIRA-FSI Report Preview
Partner to the World's Leading Financial Sector Institutions
Uptime Institute has completed over 250 projects with the world's leading Financial Sector Institutions.
Our SCIRA-FSI product represents a new offering to this industry, but we've spent decades helping leading FSIs design, build, operate and assess their critical infrastructure.
Our SCIRA-FSI product represents a new offering to this industry, but we've spent decades helping leading FSIs design, build, operate and assess their critical infrastructure.
Learn More about SCIRA-FSI
SCIRA-FSI represents a new era in critical infrastructure assessments - moving beyond owned and operated infrastructure to colocation providers, cloud providers and Software-as-a-Service (SaaS) vendors who you rely on to manage your critical systems.
We know you have questions. We look forward to answering them.
Additional Regulatory Requirements Resources
Visit the resources below for additional details on the regulatory requirements financial sector supervisory authorities are implementing around operational resilience and risk management practices globally.
Banco de España
Bank of England
Banque de France
Basel Committee on Banking Supervision
Central Bank of Malaysia
China Banking and Insurance Regulatory Commission
European Banking Authority
European Commission
Federal Financial Supervisory Authority (BAFiN) - Germany
Monetary Authority of Singapore
Swiss Financial Market Supervisory Authority
Banking Regulation and Supervision Agency (BRSA) - Turkey
U.S. Government Accountability Office
U.S. Office of the Comptroller of the Currency