Service 06

Disaster & Continuity Planning

The question is not whether your family office will face a systems failure, a cyber incident, or the sudden unavailability of a critical individual. It is whether you will be prepared when it happens — and whether your principals, trustees, and clients will be able to tell the difference.

The question most family offices are asking

"We have a continuity plan — but it has never been tested. If something went wrong tomorrow, I'm not certain we could execute it."

An untested plan is a document, not a capability. The work is not writing the plan — it is stress-testing it, identifying where it breaks, and building the infrastructure that keeps the family office operational when the plan is needed.

The challenge

Most family offices are one incident away from operational failure

Family offices are operationally lean by design. A small, trusted team running complex investment operations with limited redundancy is efficient — until something goes wrong. At that point, the same characteristics that make a family office agile become vulnerabilities.

The person who knows how to execute in a particular asset class is unavailable. The system that produces daily valuations is offline. The data that feeds reporting has been encrypted. In a large institution, these events trigger a documented continuity process that has been rehearsed. In most family offices, they trigger a crisis.

Disaster and continuity planning for a family office is not about writing documents. It is about building the operational infrastructure, the documented processes, and the tested recovery capabilities that mean an incident remains manageable — rather than becoming the event that defines the office's reputation.

The scenarios that matter

—

Ransomware attack

Systems encrypted and inaccessible. Trading cannot execute. Valuations cannot be produced. Client reporting is offline. No tested recovery procedure exists for how long this will take to resolve — or how.

—

Key person unavailability

The individual who manages execution for a specific asset class, or who holds the relationships with counterparties, is suddenly unavailable for an extended period. No documented handover process exists.

—

Technology infrastructure failure

Core systems — OMS, portfolio management, data feeds — are unavailable for an extended period. The family office has no alternative means of executing, valuing, or reporting.

—

Data breach or integrity failure

Client data accessed by an unauthorised party, or portfolio data corrupted at source. The family office has no documented incident response process and no clean backup to restore from.

—

Supplier or counterparty failure

A critical service provider — custodian, prime broker, technology vendor — experiences its own operational failure. The family office has no contingency for how it operates in their absence.

The difference testing makes

A plan that has never been tested is not a plan

Most continuity plans are written during a quiet period by someone who understands the theory but has not stress-tested the practice. They describe what should happen — not what will happen when the people involved are under pressure, the systems they assumed would be available are not, and the steps that seemed straightforward on paper turn out to have dependencies no one anticipated.

The value of continuity planning is not the document. It is the discovery process. Finding where the plan breaks down before an incident occurs — so that the gaps can be closed while there is still time to close them.

At a leading UK fixed income manager, the firm-wide resilience and contingency platform was delivered under FCA operational resilience requirements — covering trade execution and fund management continuity during severe IT outages. Built, tested, and rehearsed across front office, risk, compliance, and operations. That discipline is the foundation for every DCP engagement.

Untested plan

A document that describes the recovery process in general terms. The people responsible for executing it have read it once. The systems it assumes will be available have never been confirmed. Dependencies on third parties have not been verified. It has never been run under simulated pressure.

Tested plan

A documented, rehearsed recovery capability. The people responsible for each step have practised their role. The alternative systems have been confirmed operational. Third-party dependencies have been documented and tested. The last exercise identified three gaps — all of which have been closed.

Ransomware — untested

The family office discovers its systems are encrypted. No one is clear on who to contact first, what the recovery sequence is, or whether the backups that exist are current and accessible.

Ransomware — tested

A documented incident response procedure is activated. Roles are clear. Backups have been tested within the last 30 days. A fallback trading capability exists. Principals are notified through a defined communication process. Recovery begins within hours, not days.

What Caelion delivers

Continuity that has been built, tested, and owned

Business impact assessment

A structured analysis of the family office's critical functions — investment operations, trading, reporting, data management — and the impact of each being unavailable for one hour, one day, one week. The foundation for every prioritisation decision that follows: what must recover first, and to what standard.

Threat and vulnerability assessment

Identifying the specific threats relevant to the family office's operational model — ransomware, key person dependency, technology failure, supplier failure, data breach — and the vulnerabilities in current infrastructure that each threat would exploit. The honest picture before the plan is written.

Disaster recovery plan

A documented recovery plan for each critical function — step by step, with named owners, fallback systems, alternative contacts, and recovery time objectives. Written to be executable under pressure, not read during a planning meeting. Covering the specific scenarios most likely to affect a family office of this scale and structure.

Anti-ransomware architecture

Designing the technical controls, backup strategy, network segmentation, and access governance that reduce ransomware risk and limit the impact when an attack succeeds. Including backup testing protocols — confirming that recovery data is current, accessible, and actually restores correctly. Prevention where possible; rapid recovery where not.

Tabletop exercise and testing

Running the continuity plan under simulated pressure — with the people responsible for each step, working through a realistic scenario in real time. The exercise that reveals what the document does not: where the plan assumes resources that are not available, where role clarity breaks down, and where dependencies were not anticipated. Every gap found in a tabletop exercise is one that does not have to be found during an actual incident.

Ongoing governance and review

A continuity plan that is written once and filed is not a continuity plan. Establishing the governance framework for ongoing review — triggered by organisational changes, system changes, and on a defined annual schedule — so that the plan remains current and the recovery capability remains real. The discipline applied at institutional level, proportionate to the family office context.

The threat landscape

Three categories of risk that every family office needs to plan for

Cyber

Cyber & Ransomware

Family offices are increasingly targeted precisely because they hold concentrated, sensitive financial data with less defensive infrastructure than institutional counterparts. Ransomware, phishing, and credential compromise are the most common vectors — and the recovery from each requires a prepared response, not an improvised one. Anti-ransomware architecture, backup testing, and incident response procedures are the three controls that matter most.

Ops

Operational Disruption

System outages, supplier failures, and key person unavailability are operationally equivalent in their impact — they all leave the family office unable to execute a critical function. The continuity plan must address all three with the same rigour: alternative systems confirmed, roles documented, third-party dependencies tested. Operational disruption is the most common category of incident, and the one most family offices are least prepared for.

Data

Data Integrity & Privacy

Data breach, corruption, or loss affects not just operations but the trust of principals, beneficiaries, and counterparties. The response to a data incident — who is notified, when, through what process — must be documented before the incident occurs. Recovery from data corruption requires tested backups. Recovery from a breach requires a communication process the principal has already approved.

Delivery experience

Built where operational failure is not acceptable

The continuity and resilience discipline underpinning this service was built at a Tier 1 fixed income house — one of the UK's largest fixed income managers — where regulatory requirements, client obligations, and operational scale make continuity planning a non-negotiable governance function, not an annual compliance exercise.

That institutional standard is what Caelion brings to the family office context — proportionate, practical, and tested. The goal is not a document that satisfies a checklist. It is a recovery capability that works when it is needed.

Read the case study

a major UK fixed income manager

Firm-wide FCA-aligned front-office resilience and continuity platform — delivered the solution that kept trading and fund management operational during severe IT outages. Built across front office, risk, compliance, and operations. Aligned to FCA operational resilience requirements under PS21/3. Tested, documented, and rehearsed — not filed and forgotten. This is the reference engagement for every DCP programme in the practice.

Regulatory framework

The FCA's operational resilience framework (PS21/3) — which requires firms to identify important business services, set impact tolerances, and test their ability to remain within those tolerances — provides the discipline model for family office continuity planning. The same rigour, applied proportionately to the family office context.

Asset class coverage

Continuity planning for a family office must cover the specific asset classes and operational processes in scope. With front-office delivery experience across fixed income, equities, FX, ETD, OTC derivatives, and multi-asset portfolios, the continuity plan is built around what the family office actually does — not a generic template.

Engagement model

Every engagement is led by a senior practitioner with direct accountability to the client. Scoped against defined outcomes — agreed before work begins.