Business Online / Cash-Management Portal — impact tolerance ≤ 4 hours — ITOL

Impact tolerance: ≤ 4 hours — during business hours, for > 10% of business-banking users, or any outage spanning an ACH/wire submission cutoff (illustrative default — trace the derivation, then replace with your own harm analysis)

Definition: Digital portal through which small-business customers initiate ACH (Automated Clearing House) and wire payments, manage cash positions, view balances, and administer sub-user entitlements such as dual control and transaction limits.

Why it is designated: Corporate Account Takeover guidance aligned with the FFIEC (Federal Financial Institutions Examination Council) treats small-business online banking as high-risk and business-critical. It demands layered controls and rapid incident response. The payment rails set the bound. Nacha's fixed same-day ACH submission windows and Fedwire's hard 19:00 ET close mean the portal must be back before the day's last cutoffs.