Selling to banks: the business continuity questions you will be asked

If you sell software, cloud, IT or outsourced services to a bank, the due-diligence questionnaire will have a business continuity section. It usually arrives late in the deal, it asks for evidence rather than assurances, and it can hold up a signature.

Your client is not being difficult. Its regulator requires it to check that the suppliers it depends on can keep running through a disruption, and to write that into the contract. Rules in India, the EU, the UK, Australia and the US say much the same thing, so the questions are much the same too. This page lists them, the rule behind each one, and the evidence that answers it, mapped to the clauses of ISO 22301, the business continuity standard.

Two incidents in July 2024 show why the questions got sharper. A faulty CrowdStrike update affected an estimated 8.5 million Windows devices worldwide, by Microsoft's count, and on 19 July RBI reported minor disruptions at 10 Indian banks and NBFCs. Twelve days later, NPCI cut C-Edge Technologies, a technology provider to co-operative and regional rural banks, off from India's retail payment systems after a suspected ransomware attack on a few of its systems. Until the connection was restored, customers of the banks it served could not use those payment systems. On 8 August, RBI's Governor said the global outage "showed the fast-growing dependence on big-techs and third-party technology solution providers", and asked banks to build risk management frameworks for their IT, cyber security and third-party outsourcing arrangements.

Why your client is asking

These rules bind the bank, not you. They reach you through the questionnaire, the contract and the bank's right to audit. They also scale with how much the bank depends on you: RBI's IT chapter is about material outsourcing, DORA's stricter contract terms apply to critical or important functions, and CPS 230 to material service providers. If your service sits on one of those lists, expect the full set of questions below.

Your plan

1. Do you have a business continuity plan that covers the service you provide us?

Why they ask. Every rule above starts here. RBI wants the provider's continuity and recovery procedures documented, maintained and tested (para 40). DORA wants the provider to implement contingency plans (Article 30(3)(c)).

What answers it. The plan itself or a summary of it, with a named owner, an approval date and a scope that clearly includes the client's service. A plan that covers "head office" but not the platform the bank uses does not answer the question.

ISO 22301: 4.3 Scope and 8.4 Business continuity plans and procedures. The 8.4 Control Pack has a plan invocation procedure and a communication plan with a call tree.

2. Who owns it, and when did management last review it?

Why they ask. Due diligence covers your business continuity management, not just the document (RBI para 30(vii)). A plan nobody senior has looked at in two years tells the bank it will not work.

What answers it. A continuity policy approved by top management, a named person accountable for it, and the minutes of the last management review where continuity was on the agenda.

ISO 22301: 5.2 Policy, 5.3 Roles, responsibilities and authorities and 9.3 Management review.

Recovery targets

3. What are your recovery time and recovery point objectives for our service?

Why they ask. The US guidance notes that contracts often require the provider's specific recovery time and recovery point objectives. UK and Australian banks set impact tolerances or tolerance levels for their critical services, and your recovery time has to fit inside them (SS2/21 6.4, CPS 230 para 39).

What answers it. A recovery time objective (how quickly the service comes back) and a recovery point objective (how much data could be lost) for the service the bank buys, and the business impact analysis that produced them. Numbers with no analysis behind them are the first thing a reviewer challenges.

ISO 22301: 8.2 Business impact analysis and risk assessment. The Control Pack has a BIA procedure and a risk assessment template.

4. What do you depend on to deliver it, including your own suppliers?

Why they ask. Your suppliers are the bank's fourth parties. RBI wants prior approval before you sub-contract, the right to ask about your supply chain, and you to be liable for your sub-contractors (paras 34(iv), 69(xi) and 69(xiii)). CPS 230 asks the bank to manage risks from the fourth parties its providers rely on (para 47(c)), and requires you to tell it when you rely on other material providers (para 53(d)).

What answers it. A dependency map for the service: cloud providers, data centres, key software, people and any sub-contractors, with the continuity arrangements you hold for each critical one. The C-Edge incident is what a supplier failure looks like from the bank's side: one provider down, and every bank that relied on it cut off from payments.

ISO 22301: 8.1 Operational planning and control, which requires outsourced processes and the supply chain to be controlled, and 8.2 for the dependencies. Several Control Packs, including those for 8.3 and 8.4, include a supplier continuity questionnaire you can send to your own providers.

5. If your office, cloud region or key people are unavailable, how do you keep running?

Why they ask. The bank needs to know your plan holds up in severe but plausible scenarios, the phrase both the PRA (SS2/21 10.3) and APRA (CPS 230 para 43) use. The US guidance also asks about telecommunications redundancy and preparations for events like natural disasters, pandemics and denial-of-service attacks.

What answers it. The continuity strategy you chose for each scenario (a second region, a standby site, staff cross-trained to cover key roles) and why you chose it.

ISO 22301: 8.3 Business continuity strategies and solutions. The Control Pack has a strategy options matrix.

6. How do you back up our data, and when did you last test a restore?

Why they ask. RBI requires you to be able to isolate the bank's data so it can be removed or destroyed if the agreement ends or things go wrong (para 42). DORA requires the contract to cover access to, recovery and return of the bank's data (Article 30(2)(d)). The PRA expects data recovery plans to consider deliberately destructive cyber attacks (SS2/21 10.8).

What answers it. What you back up, where, how often, how the bank's data is kept separate, and dated records of restore tests showing how long the restore took.

ISO 22301: 8.3 and 8.5 Exercise programme. If you also run ISO 27001, information backup is control A.8.13 in our ISO 27001 toolkit.

Testing

7. How often do you test the plan, and can we see the results?

Why they ask. RBI requires the bank to make sure you test your plan periodically (para 40). APRA requires the bank's own testing to cover disruptions at its material service providers (para 43). The US guidance suggests reviewing a provider's test results and how it performed in real disruptions.

What answers it. An exercise schedule, and the report from your last exercise: what you tested, what went wrong and what you fixed.

ISO 22301: 8.5 Exercise programme, whose Control Pack includes a scenario library and an after-action report template, and 8.6 Evaluation of documentation and capabilities.

8. Will you take part in our continuity tests?

Why they ask. RBI says the bank may consider occasional joint testing and recovery exercises with its provider (para 40). Since July 2026 RBI has gone further: the bank must show readiness through coordinated resilience testing with its vendors and partners that meets its recovery time objective (para 174 of the cybersecurity Directions), so expect this request more often. The PRA expects both parties to commit to support testing (SS2/21 6.4). Under DORA, a provider supporting a critical or important function must also take part in the bank's threat-led penetration testing (Article 30(3)(d)).

What answers it. A named contact, a willingness to join the bank's exercises written into the contract, and a record of tests you have already run with clients or your own providers.

ISO 22301: 8.5. The Control Pack has a template for exercises with vendors and disaster recovery providers.

During a disruption

9. How quickly will you tell us about an incident, and who do we talk to?

Why they ask. This is the question with the tightest clock. RBI requires the bank to make sure you report cyber incidents to it without undue delay, so that it can report to RBI within six hours of your detecting the incident (para 56). Under CPS 230, the bank must tell APRA within 24 hours of a disruption that takes a critical operation outside tolerance (para 41). DORA requires you to notify the bank of developments that could affect the service (Article 30(3)(b)) and to help when an incident occurs (Article 30(2)(f)).

What answers it. A notification time in hours, counted from detection and written into your incident procedure. RBI's six hours also run from the moment you detect the incident, so "within 24 hours" will not work for an Indian bank. Name an incident lead and a deputy, and give the bank a number that gets answered at night and on holidays. When C-Edge was compromised, NPCI cut it off from payments while the security review was still running. A supplier that reports early has more say in decisions like that.

ISO 22301: 8.4 for the response structure and warning and communication, and 7.4 Communication.

Assurance and exit

10. Can we, and our regulator, audit you?

Why they ask. RBI requires a right to audit the provider, including sub-contractors, and a right for RBI to inspect it (paras 34(vii), 34(ix) and 69(xii)). DORA requires unrestricted rights of access, inspection and audit for critical or important functions (Article 30(3)(e)). CPS 230 requires audit access and lets APRA visit the provider on site (paras 53(b) and 54).

What answers it. Contract terms that allow it, and evidence that you already check yourself: internal audit reports on your continuity arrangements and the actions that came out of them.

ISO 22301: 9.2 Internal audit and 9.1 Monitoring, measurement, analysis and evaluation.

11. Are you certified to ISO 22301?

Why they ask. None of these rules requires it. But a certificate can stand in for some of the bank's own checks: RBI lets a bank, depending on its risk assessment, rely on globally recognised third-party certifications from the provider instead of conducting independent audits (para 74). And RBI's 2026 cybersecurity Directions name ISO 22301 as an example of the best practice a bank's own continuity policy should adopt (para 163). That rule is about the bank's policy, not yours, but it means the bank's continuity team already works in ISO 22301 terms.

What answers it. The certificate and its scope statement. Check that the scope includes the service the bank buys. If you are not certified, a continuity programme run to the standard, with the evidence from questions 1 to 10, answers most of the same questions.

ISO 22301: all 26 clauses, in our ISO 22301 toolkit.

12. If the contract ends or you fail, how do we get our service and data back?

Why they ask. RBI requires a provider to cooperate fully with the bank and its new provider for a smooth transition, and bars it from erasing or altering the bank's data during the transition (paras 82 and 83). DORA requires a mandatory transition period in which the provider keeps the service running (Article 30(3)(f)). CPS 230 requires the bank to be able to exit in an orderly way (para 55(d)), and the PRA expects exit plans for when a provider fails (SS2/21 10.1).

What answers it. Write down how a client's data comes back to them: in which formats, how long it takes, and how you confirm deletion afterwards. Then decide what notice and transition period you can honestly offer, because the bank will try to put it in the contract. ISO 22301 does not deal with exit planning directly, so this answer comes from your contract terms and data-handling procedures rather than your continuity plan.

13. What did you change after your last incident or test?

Why they ask. A plan that never changes was never tested. The US guidance points banks at a provider's performance during actual disruptions, and APRA requires the bank to update its own plan, as necessary, every year (para 44).

What answers it. A log of corrective actions from incidents, exercises and audits, with owners, dates and status.

ISO 22301: 10.1 Nonconformity and corrective action and 10.2 Continual improvement.

What to have ready before the questionnaire arrives

Most of the thirteen questions come back to six pieces of evidence, so it pays to have them before a bank asks:

• your continuity policy, signed off by management, with a scope that names the services you sell;
• the business impact analysis, which is where the recovery time and recovery point for each service come from;
• the plan itself, including who is on the response team, the call tree, and how quickly you will tell clients;
• the exercise schedule, plus the report from the most recent exercise;
• a list of your critical suppliers and what each one has in place if it goes down;
• the reports or minutes from your last internal audit and management review.

Reviewers tend to check the dates before anything else. A plan approved three years ago, or an exercise report from before your last big architecture change, raises more questions than it answers.

Every clause guide in the ISO 22301 toolkit comes with a free Control Pack of templates for this work.

Where Singahi fits

We help growing companies answer these questionnaires with evidence rather than promises. That can mean reviewing your answers before they go to the bank, running the business impact analysis behind your recovery numbers, or running an exercise so you have a real report to share. If you want to certify, we get you ready for the audit, and the certificate comes from an accredited certification body.

If a questionnaire is already on your desk, talk to a practitioner.

FAQ

Do these rules apply to my company directly?

Mostly not. They bind the bank, and reach you through its due diligence, its contract and its audit rights. One exception is DORA, which lets EU supervisors designate some ICT providers as critical and oversee them directly (Article 31). That regime is aimed at large technology providers. The first list, published in November 2025, named 19 providers, from cloud platforms to IT services firms, and included one Indian company, Tata Consultancy Services.

Do we need ISO 22301 certification to sell to banks?

None of these rules requires it, and many suppliers answer the questionnaire without it. It helps most when several bank clients ask the same questions, because one audited certificate can replace a lot of repeated evidence, and RBI allows banks to rely on recognised certifications in place of their own audits, subject to their risk assessment.

What if the questionnaire asks about things ISO 22301 does not cover?

It will. Cyber incident reporting, data storage location and exit terms come up in the same questionnaires. RBI's Directions, for example, require IT outsourcing agreements to cover storage of data only in India where regulations require it (para 69(vi)). Information security questions map to ISO 27001, which runs alongside ISO 22301 as one management system; see ISO 27001 vs ISO 22301.

Where can I read the rules themselves?

RBI Managing Risks in Outsourcing Directions, 2025, RBI Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026, DORA, PRA SS2/21, APRA CPS 230 and the US Interagency Guidance on Third-Party Relationships.