Resilience you can prove, for a world you can't predict.
The resilience management assurance platform for enterprises that cannot afford to be wrong.
12 pages, PDF, 1.3 MB
The world changed. The method didn't.
Trade wars, inflation shocks, cyber-attacks, conflict and civil unrest no longer arrive one at a time. Yet most programs still follow a fixed methodology, step by step, with plans on a shelf and one exercise a year.
What we stopped believing
Regulators have already changed the question, from "Do you have a plan?" to "Prove you can stay within tolerance." eRMA is built to answer it.
Build it. Sustain it. Prove it.
eRMA is the platform to build, sustain and evidence operational resilience, designed from first principles around three promises.
1. An experience people choose to use
Act on maps, graphs and timelines, not forms. Drag, link and choose on the picture.
Asks only for what it doesn't already know. Less typing, nothing entered twice.
What matters sits where your eye lands. Menus follow your task. Easy to pick up.
Every screen answers a question: for today's work, for operations and for the boardroom.
2. The complete resilience lifecycle
3. Secure, scalable, flexible
Designed for global enterprises, government and risk-averse organizations.
- Vulnerability-scanned code
- SSO, PKI and CAC sign-in
- Encrypted, role-based access
- An audit trail on every change
- No caps: users, employees, sites
- Scales with your infrastructure
- One org tree, with roll-ups
- Federated across agencies
- Start with IT disaster recovery
- Add BC, cyber, storm, ERM, GRC
- On-premise, hybrid or hosted
- On AWS or Azure, or air-gapped
Our dependencies are in a spreadsheet somewhere.
You can't protect what you can't see.
eRMA maps every service down to the people, places, suppliers and systems it runs on, and shows what breaks next when one of them fails.
eRMA Impact Map.
Draw it, don't type it
Link records by dragging them on a canvas. The map builds as you work.
See the blast radius
Pick any record and see everything upstream and downstream, before it matters.
Know where it is
The Geo Map places every record and shows which live hazards are heading its way.
Third-party risk belongs to procurement.
Your suppliers' outages are your outages.
One organization tree and one third-party register show who owns what, who you depend on, and where too much depends on too few.
Organization tree and third-party concentration.
Restructure, no rework
Move, merge or retire units with an effective date. Ownership and roll-ups follow.
Concentration in sight
See how many critical services rely on one supplier, and export the register for regulators.
Sites that know limits
Hours, holidays, alternate sites and live status, from Normal to Evacuated.
A heat map is risk management.
Stop coloring squares. Rank what threatens delivery.
Impact and risk are assessed continuously, not once a year. Every risk is its own record, linked to the services it threatens, backed by outside intelligence and ranked by what it puts at stake.
eRMA Risk Management, inherent and residual.
Impact stays current
The BIA follows every change beneath a service, so objectives never go stale.
Ranked, and explained
A priority score shows why each risk ranks where it does.
Intelligence, not guesswork
Licensed hazard sources suggest a likelihood for every site. People decide.
Approved, not assumed
Ratings go up an approval chain. Accepting a risk above appetite needs an approver and an expiry date.
Early warning
Key risk indicators raise a breach the moment a threshold is crossed.
Controls proven
Tests with segregation of duties. A failed test raises an action.
A plan is a document, written once and filed.
Plans you can act on, repeat and keep current.
Plans in eRMA are tied to live data, scoped by scenario and put in order against each other, so the next disruption meets a plan that already knows your enterprise.
Plan schedule and live strategy.
Actionable
One procedure at a time, with a timeline and a designed recovery time on every plan.
Repeatable
A scenario sets the scope once. Every exercise and every incident reuses it.
Maintainable
When a team, site, application or supplier changes, the plans that rely on it are prompted for review.
Options tested first
Every recovery option is tested against the objectives before it goes into a plan.
Exercises disrupt the business, so we run one a year.
Rehearse the disruption without causing one.
Simulate, exercise and replay as often as your program needs, without touching production, and turn every run into evidence.
Plan Sequencer and Recoverability.
Simulate the timeline
Play a scenario's recovery sequence and see exactly where it misses the RTO.
Exercise safely
Every exercise runs as an exercise incident, measured against RTO, with nothing real disrupted.
Ask what if
Pick what fails and see, in one sentence, what still holds.
The plan is the response.
Disruption doesn't follow the script. Your response shouldn't have to.
From the first alert to a closed record with evidence: live hazards, the services at risk, the people who need help and every decision made, in one picture.
eRMA Geo Map with live feeds.
One live picture
Tasks, issues, messages and decisions, updated for everyone at once.
People first
Roll call finds who is safe and who needs help, wherever they are.
Seen before it arrives
Live feeds near your sites. Draw a footprint and open an incident from the map.
The board gets an annual report.
Everything converges on one answer: can we keep delivering?
Plans, exercises, risks, controls and incidents roll up into one realistic resilience posture, for every unit, every line of business and the board, on any day.
Can We Keep Delivering? dashboard.
For the executive
Posture, coverage, top risks and incidents, on one page.
For every unit
Heat maps and scorecards for every line of business, with drill-down.
For the boardroom
Board packs, snapshots and trends, ready to print and export.
Compliance is a project before the audit.
Compliance is the output, not the project.
Trace every obligation to the controls that meet it, the tests that prove them and the evidence on file. The audit becomes a report, not a scramble.
Traceability map and compliance posture.
Obligations on record
Every regulation and obligation applies to the services, processes and sites it governs.
Test once, comply many
One tested control satisfies many obligations. Signed content packs keep the rules current.
Findings to closure
Every gap becomes a finding, closed only when an independent validator agrees.
Aligned with ISO 22301, ISO/TS 22317, ISO 31000 and ISO 27001, and supports regimes such as DORA, SOX, GLBA, FFIEC, SAMA and CBUAE.
Imagine your program running like this.
Bring a business service you care about. We'll take it from its dependencies to proof, live.
Get the brochure (PDF) · For air-gapped sites, eRMA Portal Services delivers content by signed bundles. Get the Portal Services brochure (PDF)
Screens show fictional demo companies.