SIFMA and Protiviti reissued their paper on third-party resilience on October 6, eighteen months after the original. The standards for rebuilding systems, protecting backups, and testing recovery are largely the same. What changed is the clock. The update states that frontier AI models have materially changed the cyber threat environment and are compressing the time a firm has to identify, contain, and recover from a disruptive event.

That matters because of what the paper admits about the starting point. Critical suppliers have historically been reluctant to share details of their recovery capabilities, and when they do share, it is often clear they have not invested enough. Suppliers say they test recovery regularly without stating how often or showing results. They say they can recover within the client's targets without stating their own recovery time. Many of these suppliers serve most of the large financial institutions at once, so one supplier's unproven claim becomes an exposure for the whole sector.