SIFMA Publishes Updated Reconnection Framework for Financial Sector

SIFMA Resources

Published December 16th, 2025

Detected March 28th, 2026

Summary

SIFMA and FSSCC have published an updated version of the Reconnection Framework for the financial sector. The framework provides a five-step process to guide firms through reconnecting to the financial ecosystem after a cyber incident has been contained and mitigated.

View original document View source feed page

What changed

SIFMA and the Financial Services Sector Coordinating Council (FSSCC) have released an updated Reconnection Framework, a guidance document designed to assist financial firms in reconnecting to the financial ecosystem following a cyber incident. The framework outlines a five-step mitigation process: Assess, Remediate, Assure, Reconnect, and Recover, aiming to support both technical reconnection and broader resilience planning.

Financial firms should review and integrate this updated framework into their operational resilience and cybersecurity incident response plans. The document emphasizes communication, coordination, and providing assurance to business and trading partners to facilitate a swift return to normal Business as Usual (BAU) operations after a cyber event is resolved. While non-binding, adherence to such frameworks is crucial for maintaining market confidence and operational continuity.

What to do next

Review and update incident response plans to incorporate the five-step Reconnection Framework (Assess, Remediate, Assure, Reconnect, Recover).
Ensure communication protocols are in place to inform business and trading partners about incident resolution and mitigation.

Source document (simplified)

Guides & Playbooks # Reconnection Framework

December 16, 2025 Issue:
- Operational Resilience and Cybersecurity
Committee:
- Operations & Technology

SIFMA and the Financial Services Sector Coordinating Council (FSSCC) are pleased to announce the publication of the latest version of the Reconnection Framework. The Framework has been updated jointly by both organizations, addressing the scope of reconnection issues across the industry in order to produce a product suitable for broad adoption by the financial services sector.

There are many issues that a firm compromised by a cyber incident must first address in order to reconnect to the financial ecosystem after a cyber event has been contained and mitigated. Most importantly is how the firm should communicate, coordinate, and provide assurance to what could be dozens of business and trading partners in the most efficient and effective way to convey that the problem has been resolved and will not recur. This is crucial so the firm and its business and trading partners can resume normal Business as Usual (BAU) operations.

This document provides a five-step mitigation framework – Assess, Remediate, Assure, Reconnect, and Recover – and is intended to support and inform a technical view of reconnection as well as broader resilience planning.