Frameworks · United Kingdom
The FCA and PRA rules ask you to know your important business services and stay within impact tolerances. Aspian Cloud puts the service and its tolerance on every approval card, so changes are judged by what they could disrupt.
- Instrument
- FCA PS21/3 'Building operational resilience' (SYSC 15A); PRA SS1/21 'Operational resilience: Impact tolerances for important business services'; Software Security Code of Practice (DSIT and NCSC)
- In force
- FCA/PRA rules effective 31 March 2022; firms had to be able to stay within impact tolerances by 31 March 2025 (SYSC TP 10). SS1/21 first published 29 March 2021, updated 11 March 2022. Software Security Code of Practice published May 2025 (gov.uk page shows update 15 Jan 2026); voluntary
- For
- FCA and PRA regulated firms, and software suppliers following the DSIT and NCSC Code of Practice.
| Clause | What it requires | Evidenced by |
|---|---|---|
| SYSC 15A.2 (incl. 15A.2.9) | Identify important business services, set an impact tolerance for each, and be able to stay within it during severe but plausible disruption.Source: handbook.fca.org.uk | Business services and impact tolerances on every change that touches them, shown to approvers as the blast radius. |
| SYSC 15A.4.1 / 15A.5.3 | Map the people, processes, technology and third parties behind each important business service, and test the ability to stay within impact tolerances.Source: handbook.fca.org.uk | The map from repos and environments to business services, kept current by snapshots, and the change history behind each service. |
| PRA SS1/21 | PRA expectations for identifying important business services, setting impact tolerances, mapping, scenario testing and self-assessment by dual-regulated firms.Source: bankofengland.co.uk | Change failure rate and incident records per service, for your self-assessment. |
| Code of Practice Principles 2.1, 2.2, 3.1 | Protect the build environment from unauthorised access, control and log changes to it, and distribute software to customers securely.Source: gov.uk | Build provenance and Hold mode: only approved, prebuilt output reaches production, and changes to the build environment are governed changes. |
Clause references and requirements were read on 8 November 2026. The standard is paywalled or the official site refused access, so references were confirmed from reputable secondary sources. Aspian Cloud evidences these clauses; it doesn’t make you compliant, and your assessor decides.
Want the mapping for a framework we don’t list? Ask us. A new framework is a data file, not a code change.
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.