Chiara C

Digital & Operational Resilience and Crisis Management Senior Specialist at Cassa Centrale Bank

Banks • Tiempo completo

Oct 2024 - Present • 1 yr 10 mos

I am responsible for defining, implementing, and managing the Operational and Digital Resilience program, as well as Crisis Management. Specifically: . Defining policies, regulations, and operational resilience plans, in line with the requirements of the DORA Regulation, covering broader topics related to operational continuity, ICT continuity, and Disaster Recovery measures. Additionally, I supported the Group's banks (69) in adopting the Group Policy and in defining and customizing individual Operational Resilience Plans . Defining a digital operational resilience strategy, as required by the DORA Regulation; . Designing and conducting tests (simulations and walkthroughs), with a specific focus on restore tests and cyber scenarios such as ransomware, DDoS, and data breaches. Some tests also involve the Crisis Committee to ensure their participation in end-to-end testing sessions. These sessions aim, among other things, to practically test the technological and mitigative (restore) solutions adopted by the Bank. I am also responsible for engaging suppliers in our tests, as well as participating in tests conducted by the suppliers themselves; . Developing and delivering training sessions for internal staff and third parties; . Executing technological mapping to support critical or important functions; .Establishing a crisis management program and related test sessions involving the Crisis Committee, composed of senior management; . Managing and coordinating adverse events, starting from the initial incident management phase (L1 and L2) to support operational functions, up to potential escalation to emergencies and crises (L3 and L4), involving the Crisis Committee and coordinating/supporting the coordination of war rooms, the selection and identification of solutions to be implemented, as well as the overall event management; . Managing third-party risk, participating in and contributing to the supplier contracting phase, as well as

Resilience Senior Consultant

Deloitte • Tiempo completo

Jan 2024 - Nov 2024 • 10 mos

I have coordinated and/or provided support in the following main project activities: Crisis Management Program: I managed the creation of a crisis management program for a well-known Italian banking institution, starting from the writing of the operational crisis management manual, to overseeing the drafting of the crisis management policy and the crisis communication plan. I also conducted three test sessions in which a ransomware attack was simulated with impacts that required the convening of the crisis committee and the crisis management team, as well as the entire management of the event, from the notification of the incident to its resolution. This program and the test sessions are in line with ISO 22361 standards and the DORA regulation. DORA Compliance Project: I participated in several project meetings aimed at a well-known Italian banking institution to identify gaps and corrective actions to be implemented from the perspective of business continuity, testing, third-party management, incident reporting, and notification, in compliance with the requirements of the DORA regulation. The incident classification and management activities were adjusted based on the new classification criteria required by DORA. In this context, internal procedures, notification and classification flows, and responsibilities assigned to various teams were updated. This activity was validated through walkthrough exercises aimed at verifying the robustness of the implemented changes and improvements. Cyber Stress Test: For a well-known Italian financial institution, I supported the activities of conducting the Cyber Stress Test required by the ECB (European Central Bank) for the entire part of filling out the questionnaire. The financial institution conducted the test in an in-depth manner by performing the IT Recovery test. To carry out this activity, I provided support and coordination in defining the impacted perimeter (systems, applications, and processe

Business Continuity & Crisis Management Specialist

Banks • Tiempo completo

May 2022 - Dec 2023 • 1 yr 7 mos

I oversee the management of operational continuity, handling various aspects of the field. This includes developing and conducting Business Impact Analyses (BIAs), executing and leading tests, and culminating in the drafting and revision of the Business Continuity Plan, as well as providing support for the creation of the Disaster Recovery Plan. Additionally, my duties encompass: . Executing BIAs, formulating plans (BCP & DRP), and conducting tests for other banks within the ‘Bper Banca Gruppo’ (including Banco Di Sardegna, Bper Lux, Optima, etc.) as well as those undergoing acquisition (e.g., Carige and Banca Cesare Ponti). . Designing and leading business continuity tests, such as walkthroughs, table-top exercises, and both real and simulated scenarios. . Implementing the ‘Pesse’ plan (issued by Terna) to safeguard against blackouts. . Analyzing potentially systemic processes. . Managing crisis situations. . Providing support in the management of cyber incidents. . Coordinating emergency responses for both minor and major entities (e.g., during earthquakes and floods), particularly for critical processes with strict Recovery Time Objectives (RTOs). . Overseeing the mapping of services. . Addressing climate change concerns and the potential emergency scenarios that may ensue. . Managing mass notifications and call tree systems. . Mapping and supervising critical suppliers (reviewing their BCP and DRP, participating in their tests, and assisting in the preparation of their documentation), ICT third-party service providers, and FEI outsourcing. . Streamlining and updating the business continuity policy and plan, and integrating it with the ICT business continuity plan alongside IT functions. . Focusing on digital and operational resilience, particularly regarding cyber risk. . Administering cyber stress tests mandated by the European Central Bank (ECB). . Creating training programs, courses, and articles for publication on the compan