Summary of Initiative (4th Sep 2024)

Question 1

What is the background?

Answer 1

There used to be different frameworks to assess criticality (e.g., C3, Critical Processes, etc.). With CPS 230, we now use ‘Critical Operations’ and have removed everything except C3.

C3 is still being used, but we’re not certain where or how, and we have no governance to ensure it is being applied consistently. This is a huge problem because the bank is making key decisions based on C3 methodology.

We need to determine how C3 is being used, where it overlaps with Critical Operations, and whether we should uplift it or remove it, or something else.

Question 2

Where are three areas C3 is currently being used (or is suspected to be)?

Answer 2

1. Business Continuity
2. ServiceNow
3. Group Performance Model (via Tech Modernisation measure, which is informed by C3).