Independent consultancy for Luxembourg organisations whose continuity arrangements have to hold up under test, audit and real incidents. ISO 22301, DORA and CSSF expectations, delivered by a practitioner who has run them in-house.
The full business continuity cycle, from governance to evidence. Each service can be taken on its own or combined into a programme.
An ISO 22301-aligned BCMS set up from scratch or brought back into shape: policy, scope, governance, plan register, named owners and a working review cycle.
OutputsBCM policy and framework · plan and procedure register · management reporting
BIA and risk assessment run with business and IT owners, ending in agreed RTOs, RPOs, impact tolerances and recovery strategies.
OutputsBIA and risk register · recovery objectives · recovery strategies and mitigation actions
A crisis framework built around how the organisation actually escalates: crisis roles, escalation chains, alerting, call trees, notification cascade and mass communication.
Outputscrisis management plan · escalation and alerting procedures · call-tree tests · team training
An annual programme of disaster-recovery tests, crisis tabletops, loss-of-delegate and loss-of-workspace scenarios and hot-site readiness. A failed test stays open until its action is done.
Outputstest calendar · scenarios · evidence and post-exercise reports · tracked actions
Operational resilience aligned with DORA and CSSF expectations. ICT and outsourcing dependencies held on the same register as internal controls, with continuity terms and exit options that have been tested.
Outputsgap assessment · ICT third-party register (criticality, continuity terms, exit and workaround) · remediation plan
Internal audit of a BCMS against ISO 22301 by a qualified Lead Auditor, or preparation for internal audit, regulatory and certification reviews, with findings followed to closure.
Outputsaudit plan and report · evidence pack · findings and remediation tracker
Four formats, scoped to the problem. Each engagement is agreed in writing, with defined deliverables, before work starts.
Fixed scope and duration. A gap assessment against ISO 22301, DORA or applicable CSSF expectations, with a prioritised remediation plan.
A defined deliverable: a BCMS build, a BIA cycle, a crisis framework, a test programme or a BCM tool implementation.
Cover for a vacant or absent BCM role, full-time for a period or a set number of days per month.
Awareness sessions, crisis-team training and facilitated tabletop exercises, in English, French or Hungarian.
Documents, registers and test evidence reviewed against the standards and expectations that apply to you. Gaps ranked by impact.
Framework, plans and registers built around how the organisation operates, each with a named owner.
Arrangements exercised before they are needed. Results and evidence filed.
Actions tracked to closure, review cycle in place, reporting ready for management and audit.
I have worked in business continuity and operational resilience for more than twelve years, eight of them in Luxembourg: at the European Commission, at Clearstream Banking and at the transfer agency IFDS / SS&C. My career started in 2009 in IT service and customer operations in Budapest, where every incident needed an owner, a complete record and a clean handover. I still work that way.
In those roles I ran the full BCMS cycle in regulated environments: governance, business impact analysis, recovery objectives and strategies, crisis management, testing, third-party resilience and audit remediation. At IFDS I owned the Luxembourg BCMS against CSSF expectations, DORA and ISO 22301, and built the crisis framework for the Luxembourg and Ireland entities. At Clearstream I led the end-to-end implementation of the SAI360 BCM platform.
I hold Luxembourg and Hungarian nationality and work in English, French and Hungarian. Second Site makes this experience available on an assessment, project or interim basis.
Local BCMS and crisis framework for the LU and IE entities; annual BIA for 18 departments and 60 critical services; 14 tests a year (4 DR, 1 crisis tabletop, 6 loss-of-delegate, 2 hot-site, 1 evacuation with loss of workspace); inherited internal-audit items closed.
Group-wide BIA across Deutsche Börse Group covering 1,000 critical services; SAI360 platform from requirements to go-live; audit evidence and remediation with Risk, Information Security and Outsourcing.
Business continuity and IT service continuity plans for Data Network Services across two sites, tested and updated after each exercise.
Site continuity documentation for Budapest, Erfurt and Cape Town; led a multilingual service desk of 15.
B2B and assistance back-office teams for France, Belgium and Luxembourg; backlog cut by changing the process.
Promoted after one year; set up a new service desk and led 20 analysts.
Long before resilience was my job, it was my sport. Orienteering, triathlon and the DJ booth train the same reflexes a continuity programme needs.
A map, a compass, a clock and a decision at every control. When you lose the line, you stop, relocate and carry on without panic. That is what a crisis team has to do.
In briefHungarian national champion, middle distance; standby for the youth national team.
Thirteen hours never go exactly to plan. The finish depends on preparation, pacing and a fallback decided before it is needed: the same logic as a recovery strategy.
In briefSince 2010: first marathon in Paris (2012), Ironman distance in 2013 in 13 hours, eight 70.3 half-distance races, many Olympic and sprint races.
A training plan is built backwards from the target, tested in sessions and adjusted on evidence. I build test programmes the same way.
In briefHungarian state qualification as triathlon coach, Semmelweis University, 2014.
A set is live operations: read the room, keep every transition clean and have the next track cued before the current one ends. No dead air, whatever happens.
In briefHouse and techno behind the decks, as Balian Martinez. balianmartinez.com ↗
A short description of the organisation, its regulatory context and what you need is enough to start.