Mobile apps, browser extensions and third-party Microsoft Teams apps can support important business services while introducing permissions, software dependencies and data-handling questions of their own. This guide shows how to connect application findings to a financial firm’s existing operational-resilience and third-party risk process.
START WITH THE BUSINESS SERVICE
Map the application before interpreting the finding.
For firms within scope of its operational-resilience rules, the FCA requires mapping of the people, processes, technology, facilities and information needed to deliver each important business service. The FCA says this mapping should include third-party relationships that could affect a firm’s ability to remain within its impact tolerance.
- Name the application and owner. Record the mobile app, browser extension or Teams app, its publisher and the team accountable for its use.
- Connect it to the service. Identify the workflow it supports, the people who rely on it and whether disruption could affect an important business service.
- Record access and dependencies. Capture permissions, configured domains, software libraries, data types and relevant supplier relationships.
- Set the review trigger. Revisit the decision when the application, its permissions, its privacy policy, its use or the supporting service materially changes.
APPLICATION EVIDENCE
Bring technical and privacy findings into the same review.
MobSTR assesses and monitors iOS and Android applications, bringing together code, permissions, software dependencies and findings. Browser extension risk assessment supports review of Chrome and Microsoft Edge extensions.
OpenGates assesses third-party Microsoft Teams apps, including permissions, configured domains and security findings. InterroPol adds privacy-policy summaries, red flags and supporting technical evidence so privacy questions can be considered alongside security findings.
A rating or alert is evidence for review, not the decision itself. The firm still needs to interpret each finding against the application’s use, the information involved and the operational impact of restriction or failure.
A PRACTICAL EVIDENCE RECORD
Keep enough context to explain the decision later.
| Record | Question to answer |
|---|---|
| Business purpose | Which workflow and service does the application support? |
| Dependencies | Which publisher, libraries, domains and connected services does it rely on? |
| Security and privacy evidence | Which findings, permissions or policy questions need investigation? |
| Decision and conditions | Is the application approved, restricted, mitigated, rejected or awaiting supplier evidence? |
| Owner and review trigger | Who owns the decision, and what change or date will prompt reassessment? |
Linking the assessment to its owner, conditions and review trigger helps distinguish a point-in-time scan from an ongoing risk decision.
UK OPERATIONAL RESILIENCE CONTEXT
Use application evidence within the wider resilience programme.
The FCA says firms within scope of its rules had until 31 March 2025 to ensure they could operate important business services within their impact tolerances. Its March 2026 observations say mapping, testing and vulnerability remediation should continue to mature, with important business services, impact tolerances and mapping reviewed at least annually or after a material change.
The UK critical third parties regime does not transfer a financial firm’s responsibility for its own third-party arrangements. The FCA, PRA and Bank of England state that regulated firms remain responsible for due diligence, risk management and contingency planning.
Scope matters. MobSTR provides application security and privacy evidence. It does not identify a firm’s important business services, set impact tolerances, perform resilience scenario testing, provide regulatory assurance or establish compliance with FCA or PRA requirements.
FCA operational resilience overview · FCA mapping and third-party observations · FCA March 2026 good and poor practice · UK critical third parties update
CUSTOMER EVIDENCE
A clearer view of application risk at Astorg.
MobSTR’s published Astorg customer story describes how the private-equity firm used application testing, ratings and monitoring to gain a clearer view of the applications it deployed and the risks involved.
The interview concerned Astorg’s preparation for the EU’s DORA regime before it applied in January 2025. It is useful customer evidence about application visibility, not evidence of compliance with UK operational-resilience rules; its estate figures and quotations reflect the original interview.
DISCUSS YOUR PROCESS
See how application evidence could fit your risk workflow.
Bring an application list, a current supplier question or the review process your team wants to improve. We will show you how MobSTR organises security and privacy evidence for continuing oversight.