Our BIA lives in a Word file from 2022.
Fix: Keep a BIA for each process in Operate, with RTO, RPO and MTPD taken from one Time Threshold list, and see every process on the BIA Overview.
See the BIAFINMA
FINMA compliance software
FINMA asks what happens when something breaks. Show the answer, process by process.
Acuna GRC helps banks, insurers and other institutions supervised by FINMA show they can keep working when something breaks. Every critical process has its recovery times, every provider a rating and every operational risk an owner.
1 · ASSESS THE RISKActual → Target
LikelihoodImpact
!Ransomware on file servers9 Risk · High4 Risk · Target
2 · WORK THE TASKSBoard
✓Patch the file serversDone
✓Test the backup restoreIn progressDone · record
Renew the firewall certificatesDue 30 Sep
Treatment plan healthAt riskHealthy
3 · PUBLISH THE POLICYDocument lifecycle
§Information security policyPending ApprovalPublished
Approvers signed2 of 33 of 3
✓Next review in 12 months
What FINMA asks
What does FINMA ask banks to show? That critical functions keep running.
FINMA Circular 2023/1 on operational risks and resilience asks banks to manage their operational risks, ICT and cyber risks among them, and to show they can keep their critical functions running through a severe disruption.
Operational and ICT risk
Identify, assess and limit operational risks, ICT and cyber risks included, with clear responsibilities.
Critical functions
Know your critical functions and what they depend on, set how much disruption each one can tolerate and plan how to recover.
Providers and outsourcing
Keep control of the providers and outsourced services your critical functions rely on.
Does this sound like you?
Why is operational resilience hard to show? The answers are years old.
Most institutions know their critical processes. The time goes into updating the analysis, finding which provider each process depends on and running FINMA next to other frameworks.
We can’t see which provider would stop us.
Fix: Link the suppliers each process depends on in its BIA, each with a suggested criticality, and let SPOF Analysis list the assets several critical processes share.
See providers in the BIAFINMA and DORA mean two programs.
Fix: Run one program. Adopt both in Comply, and one measure counts for each requirement it meets.
See one programHow Acuna GRC covers it
What does FINMA compliance software need to do? Tie processes, risks and providers together.
Acuna GRC runs FINMA across Operate, TPRM, Comply and Assure: the BIA and operational risks in Operate, providers in TPRM, the FINMA requirements in Comply, and the proof in Assure.
01 · Operate
How do we map critical processes and their recovery objectives?
The BIA Overview lists every process in scope with its impact assessment and RTO. For each process you set RTO, RPO and MTPD, describe what happens as an outage lengthens and record the assets, staff and suppliers it depends on. SPOF Analysis lists the assets that support several critical processes.
See Operate →02 · Operate
How do we keep operational risks current?
Keep operational and ICT risks on an impact by likelihood matrix, linked to the threat sources, assets and processes they concern. Each risk has a treatment plan and an owner who approves it, and the owner is reminded before its yearly review.
See risks in Operate →03 · TPRM
How do we manage outsourcing and ICT providers?
TPRM keeps one register of your providers, with questionnaires sent one at a time or as a campaign, a one to three shield rating and a daily A to F grade. Subcontractors show as a supply chain tree, and in the BIA each supplier a process depends on gets a criticality, suggested from its exposure and tier.
See TPRM →04 · Comply
Can we run FINMA and DORA together?
Yes. Adopt FINMA in Comply next to DORA and ISO 27001. Common Measures are mapped across frameworks, so one measure counts for each requirement it meets, and Mapping shows what is left in each.
See Comply →05 · Assure
How do we show management that it works?
KPIs follow your targets over time, records show each control ran, and an incident logged as an issue keeps a dated timeline that shows in the BIA of the process it hit. Reports generated from templates export as PDF or Excel.
See Assure →Aiko at your pace
Can AI tell us which risks look underrated? Aiko flags. You decide.
Ask Aiko which risks look underrated. It checks each risk against its control executions, its KPIs and the threats on its assets, with the source and date of each, and proposes a new score. Nothing changes until you click Change Score, one risk at a time.
1Aiko proposes
Risk analysis · with sourcesRISK-004 · Ransomware on file serversScored Medium × Possible = 4 · evidence says higherBackup restore testLast two runs lateControl · 12 SepPatch level71% against a 95% targetKPI · 30 SepProposed: High × Probable = 92You confirm
You check, one risk at a timeChange Score✓Score changed and loggedRISK-004 risk value493You set the pace
How much Aiko doesSuggest only
Aiko explains. You do it.Ask me first · default
Aiko prepares. You confirm.Do it and tell me
Aiko does it and shows you.
Threats, answered
Ask Aiko which threats can affect availability, which assets a threat exposes or which threats an asset is exposed to.
Some things always ask first
Admins set the highest mode for each action.
Every step on record
Every Aiko action goes into the Activity log.
One Aikoacross Acuna GRC. Add a module and it helps there too. How Aiko works
Swiss experts
Can someone run operational resilience with us all year? Yes, CISO as a service.
Done for you: our experts run the BIA, the operational risk reviews and the provider follow-up in Acuna GRC all year. You review and decide.
.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
CEO of Abilene Group
Henri Haenni
Business continuity and risk management
Legal and compliance expert
Laura Menetrey
GDPR, NIS2, DORA, FADP.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
Do it yourself
You run the program in Acuna GRC, with Aiko.
Done with you
Guidance, reviews and audit preparation with your team.
Done for youCISO as a service
Our experts run it. You review.
CISO as a service, done for you
- Keep the BIA and the risk reviews current
- Follow up your providers and outsourcing
- Prepare the reports for management
Integrations
Can Acuna GRC collect evidence from our tools? Yes, with 100+ connectors.
Connectors pull security data from your identity, device, cloud and backup tools on a schedule, so control values stay current without a manual step.
Animation: a robot arm takes data from Microsoft Entra ID, Microsoft Defender, Azure, AWS, GitHub and Jira and puts it on a belt into your workspace in Acuna, where your evidence, KPIs and security alerts stay current.
Entra ID
Okta
Intune
Jamf Pro
CrowdStrike
Defender
AWS
Azure
Google Cloud
Microsoft 365
Acronis
GitHub
Jira
ServiceNow- 100+ connectors in all
Your tools feed Acuna GRC
Connectors pull security data on a schedule, and API keys let your own systems push data in. Every call is logged.
Missing a connector? We build it.
We design the integration around your setup. Every native connector we have exists because a client needed it.
Fixes land where your team works
Tasks sync both ways with Jira and ServiceNow. See Integrations and API
How it connects
Which parts of Acuna GRC run FINMA? The core, with TPRM for providers.
FINMA runs across the four core workspaces, with TPRM for providers and outsourcing. Add Group management for a financial group and Evaluations for a gap assessment.
Acuna GRC core
Add-on modules
Across the platform
FINMA connects to
- OperateBIA, SPOF Analysis and operational risks
- TPRM (Supplier Shield)Providers rated and graded
- ComplyAdopt FINMA next to DORA
- AssureKPIs, records and incidents
- ImplementAssets, processes and third parties
- Group managementEvery entity in one view
- EvaluationsA FINMA gap assessment
- AikoFlags underrated risks
FAQ
What else do buyers ask about FINMA software?
Does Acuna GRC report to FINMA for us?
No. You deal with FINMA yourself. Acuna GRC keeps your BIA, risks, providers and incident records in one place, so the facts are ready when you need them.
Is Acuna GRC approved by FINMA?
No. Acuna GRC is not approved or certified by FINMA. It helps you run your program and keep the evidence; meeting FINMA’s requirements stays with you.
We have EU business too. Do we need a separate DORA program?
No. Adopt DORA in Comply next to FINMA: one measure counts for each requirement it meets, and the same BIA and provider records serve both. DORA compliance software
How is DORA different from FINMA Circular 2023/1?
DORA is an EU regulation for financial entities in the EU, with set rules on ICT incident reporting and a Register of Information. FINMA Circular 2023/1 sets principles for banks supervised by FINMA. Both ask you to know your critical functions, the providers behind them and how fast you recover, so one BIA and one provider register in Acuna GRC serve both. DORA explained
Can an institution supervised by FINMA run its GRC in the cloud?
That is your decision under your outsourcing rules. Acuna GRC gives the review what it needs: hosting in Switzerland, the EU or the US, as you choose, from a provider that is ISO 27001 certified.
Where is our data hosted?
In Switzerland, the EU or the US, as you choose.
Supervised by FINMA? Start with one step.
Tell us your type of institution and your critical processes. We show you FINMA in Acuna GRC, and how our experts can run it with you.
Hosted in Switzerland, the EU or the US