Business Continuity and Incident Response
Two complete, board-adoptable programs for smaller credit unions. Every document you need, a Start Here guide, and a search and replace path from download to board adoption. Free, no account, no registration, direct download. Built from 45 years of banking experience.
What is inside each package
Both packages are ZIP files of editable Word documents and Excel workbooks, organized in numbered folders. Nothing is locked, watermarked, or tied to a licence key.
00 START HERE
The working guide. Which file to open first, the complete search and replace table for every bracketed placeholder, the items you have to fill in by hand, and a pre-exam checklist.
Tabletop Exercise Record
A joint test document included in both packages. Its assigned question format shows that staff actually opened the plan and found current information, which a narrative summary cannot.
The search and replace table is the part that saves the afternoon. Every placeholder in every document is bracketed and listed, so you replace [CREDIT UNION NAME], [CORE PROCESSOR] and the rest in one pass per file rather than reading for them. The Start Here guide also flags the blanks you should leave alone, the ones on the recurring forms that get filled in during an actual event rather than during setup.
Placeholder names are shared across both packages and the risk assessment workbooks, so an institution using several of them keeps one consistent audit trail.
Why use these
Built on your own risk assessment
The BCP package opens with a threat scoring workbook and a critical functions workbook, so the scenarios and recovery approach you adopt match your risk profile instead of a generic list.
All four recovery models included
Reciprocal consortium, third party recovery vendor, cloud based, and dedicated backup site. Adopt the one that matches your operation and keep the rest on the shelf. If your recovery approach changes, your plan is already written.
One test covers both plans
The joint Tabletop Exercise Record is in both packages and documents a single annual test that satisfies both policies. Its assigned question format shows that staff actually opened the plan and found current information.
Guided from download to adoption
Each package opens with a Start Here guide: which edition to use, the search and replace table for every placeholder, the items to complete by hand, and a pre-exam checklist.
From download to board-adopted plan
The two packages
BCP Complete Package
The full business continuity and disaster recovery program, in all four recovery model editions, with the risk assessment that has to come first.
- All four editions of the BCP and DR Plan: reciprocal consortium, third party recovery vendor, cloud based, and dedicated backup site
- BCP Risk Assessment, the threat scoring workbook
- BCP Risk Workbook, critical functions by department, with tabs for branch operations, collections, executive, lending, IT and support services
- Joint BCP and IRP Tabletop Exercise Record, a nine section record in assigned question format with a sample announcement email
- Start Here guide with edition selector and full search and replace table
Incident Response Package
The response plan, the playbooks, the record form you fill in during an event, and the vendor data you need on hand before one happens.
- Complete Incident Response Plan with severity classification, a six phase workflow, member notice templates, and NCUA cyber incident reporting
- Ten incident playbooks: ransomware, business email compromise, insider threat, member targeted wire and ACH and check fraud, card compromise, vendor incident, core processor outage, DDoS, lost or stolen device, and AI system incidents
- Incident Record Form, standalone and reusable, covering chronology, counsel determination, the NCUA 72 hour determination, notifications, and a conversations log
- Vendor Data Inventory workbook, which vendors hold which member data
- Vendor Emergency Contacts quick reference sheet
- Joint BCP and IRP Tabletop Exercise Record, the same file that is in the BCP package
- Start Here guide with completion order and full search and replace table
Important legal & exam disclaimers
These are templates, provided free of charge, as-is, with no warranty and no support. They are a starting point, not a finished program, and they do not constitute legal, regulatory, or compliance advice.
No guarantee of regulatory acceptance
Expectations differ by charter, regulator, examiner, asset size, and geography, and may be supplemented by state law. No guarantee of regulatory acceptance, examiner approval, or legal sufficiency is expressed or implied.
Customization is required for compliance
Every plan describes a hypothetical institution. The recovery strategies, escalation thresholds, severity definitions, and vendor dependencies in these files are examples, not findings about your institution. Designed as a flexible framework, you must customize these templates to reflect your institution's specific systems, controls, and vendors before board adoption.
Counsel review recommended
Your completed plan must rest on your own risk assessment and reflect current NCUA and FFIEC expectations. Review by qualified counsel or a compliance professional is strongly recommended before you rely on it. Full terms are on the Terms of Use page and in every download.
Free to use, adapt, and share. Use these inside your institution, adopt your customized versions as your own, give them to your examiners and auditors, and pass a copy to a peer institution if it would help them. What you may not do is sell them or repackage them into something you sell. The full Terms of Use are short and are included in every download.
No support comes with these. No consulting, no customization, and no review of your completed plan. If you find an error or a broken file, info@mycurisk.com will read it, though no response time is promised.
If one of these saved your institution a weekend, a voluntary contribution is welcome and entirely optional. Nothing is withheld without it.