The Case Against Taking a Supplier's Recovery Time on Faith

SIFMA and Protiviti reissued their paper on third-party resilience on October 6, eighteen months after the original. The standards for rebuilding systems, protecting backups, and testing recovery are largely the same. What changed is the clock. The update states that frontier AI models have materially changed the cyber threat environment and are compressing the time a firm has to identify, contain, and recover from a disruptive event.

That matters because of what the paper admits about the starting point. Critical suppliers have historically been reluctant to share details of their recovery capabilities, and when they do share, it is often clear they have not invested enough. Suppliers say they test recovery regularly without stating how often or showing results. They say they can recover within the client's targets without stating their own recovery time. Many of these suppliers serve most of the large financial institutions at once, so one supplier's unproven claim becomes an exposure for the whole sector.

AI Is Consuming the Recovery Margin

The paper separates recovery into two parts. The deterministic part, such as rebuilding a system from bare metal and restoring data from an immutable backup, can be timed, tested, and shortened. The nondeterministic part cannot be fixed in advance: finding the intruder, removing it, confirming the environment is clean, and deciding when it is safe to reconnect. The industry's strategy has been to keep shortening the first part so that a wide buffer remains for the second before the institution's impact tolerance is breached.

The 2026 update says that buffer is shrinking. AI-enabled threat activity puts more pressure on detection, containment, and validation, and shortens the window between a vulnerability being discovered and being exploited. It also raises the odds that many institutions and providers are hit by the same fast-moving condition at once. A recovery time tested last year against last year's threat assumptions now says less than it did.

The update adds two expectations that most supplier assessments do not cover. Institutions should confirm that critical suppliers have reassessed their resilience in light of AI-enabled threats, including their own third- and nth-party dependencies. Suppliers should also show how their own use of AI in service delivery and recovery creates new dependencies, and how their recovery plans work when that AI is unavailable or fails.

Third-Party Risk Programs Collect the Wrong Proof

Most third-party risk programs assess the supplier as an entity. A questionnaire is completed, an assurance report is filed, a rating is assigned, and the record sits with compliance. All of that establishes that controls exist. None of it establishes that a specific service can be restored inside the tolerance the institution has set for the business process that depends on it.

The evidence the paper asks for is of a different kind. It includes documented recovery plans, test results showing recovery from immutable backups, proof that production ran from an alternate site for at least five business days, and disclosure of any gap between current capability and the required recovery objective. The update adds evidence that assumptions have been revisited, including what the supplier reported to its own executive management or board. Where a supplier cannot stay within tolerance, the paper expects it to say so and work with clients on workarounds.

No single risk function holds all of this today. In the IRM Navigator Model, the impact tolerance belongs to operational risk management, the recovery engineering belongs to technology risk management, and the supplier assessment usually belongs to GRC. The three work from separate records, so a supplier can be fully compliant in one while its resilience is unproven in the other two. Resilience and compliance are separate outcomes, and a program built to deliver the second does not deliver the first.

Closing that gap means holding four facts in one record for every critical supplier: the business process it supports, the tolerance for that process, the recovery time the supplier has stated, and the dated test that supports it. Where the fourth is missing, the institution has an open resilience finding, whatever the supplier's rating says. The paper is written for financial institutions, but the same reasoning applies to any enterprise whose critical processes run on a small number of shared suppliers.

References

SIFMA and Protiviti, “Third-Party Resilience: Increasing Transparency” (2026 Update), October 6, 2026.