Continuity thresholds are becoming the new board-level cyber metric

A bank that stops the intrusion but cannot pay a supplier for three days will hear its security team describe a success while the board has already failed the new test. The difference between stopping an attack and surviving one is what makes the discussion from Limassol worth taking seriously.

Philenews reported on 13 October from the Forbes Cyprus Next Gen Banking & Fintech Summit that panellists were clear: operational resilience is now expected alongside intrusion prevention, and it is becoming the standard against which financial institutions are judged.

Most coverage will place this in banking. The more useful reading is that banking is simply the first sector to be measured with a new unit: a continuity threshold, stated in hours, tested and evidenced. That unit will travel.

The metric shifts from stopped attacks to continued services

Nicholas Kattirtzis of Odyssey Cybersecurity framed the change through DORA. Financial institutions must demonstrate that they can withstand disruption, recover and continue providing essential services, in addition to protecting computer systems. He said, “It’s not simply about restoring the IT system. It’s about making sure that the service continues.”

That sentence deserves to be pinned outside the boardroom. It means a recovery test that proves the core platform is back online is incomplete if the payment service a customer actually uses is still down. Management should know how long critical services could remain unavailable, how quickly they could be restored and whether recovery targets were met during testing. The reassuring sentence in last year’s continuity plan carries little weight. The output of a test does.

Before treating this as a checklist, confirm where your institution sits in DORA’s scope, because the duties attach to the nature of the regulated service. DORA scope and obligations is where many leadership teams begin that mapping.

Continuity becomes an evidence exercise

Kattirtzis also stressed the importance of maintaining evidence of security controls and coordinating regulatory compliance to reduce the administrative burden on security teams. That turns continuity from a written assurance into a dated test result, which is what regulators, auditors and customers will examine. Good evidence also prevents the same work being done three times.

Andreas Michaelides made the legal consequence concrete: companies and directors will be judged on what they did or failed to do before an incident. The board’s questions, and the answers recorded, become the record. Building that record is the work of an advisory engagement that starts from the board’s actual decisions and works backwards to the evidence supporting them.

For a lean security team, the bottleneck is capacity. There is no regulatory affairs department to absorb DORA mapping, and no spare hours to test services the business rarely thinks about. The practical move is to separate services that stop revenue immediately from the long tail, set a target for each, and test the ones that matter first.

The supplier relationship inherits the same test

Solon Houtris warned that outsourcing does not move the risk or the regulatory obligation. Financial institutions remain responsible even when cloud providers, software vendors and external partners carry part of the operation. Security assessments should begin before contracts are signed and continue through the relationship, with contractual safeguards, monitoring and contingency plans for the sudden loss of a supplier.

If your organisation supplies a bank or fintech, expect a questionnaire with a deadline asking for tested recovery time and the date of the last exercise. If you buy cloud services that a bank depends on, you inherit the same need to know your own continuity threshold, because the bank will ask for a measured result. The growth of AI models and automated systems only lengthens the supplier map; each additional dependency makes oversight harder and makes the pre-contract assessment more important.

A question worth putting in front of the board

The single most useful step this quarter is to put a question in front of the board: for each service the board considers critical, do we know the maximum acceptable outage, the last tested recovery time, and the date of that test? If the answer does not exist, the decision to fund the test becomes the board’s call.

Philenews noted that Cyprus’s domestic legislation for DORA enforcement and penalties had not yet been enacted. The sensible reading is to use the current gap to set thresholds and gather test evidence before enforcement arrives, because the obligations themselves are already defined. If the board has no security voice at the table, a virtual CISO can own the continuity threshold work and report it in terms the board can act on.

The first time a continuity threshold is tested in an enforcement context, the board’s pre-incident record will separate a follow-up question from a finding. If that record does not exist today, the work starts with one critical service and one dated test.