Disaster Recovery Policy

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Disaster Recovery Policy"

Transcription

1 Disaster Recovery Policy Organizational Functional Area: Policy for: Executive Division Bank Disaster Recovery Program Board Reviewed: September 14, 2011 Department/Individual Responsible for Maintaining/Updating Procedures: Milad Doueihi REGULATORY RISK ISSUE(S) The regulatory agencies have alerted all financial institutions to the importance of contingency planning for banking operations, including data processing support, by issuing an interagency statement on this topic. While these procedures address many broad issues, management will be responsible for developing specific emergency and disaster recovery plans, which should keep disruption of operations to a minimum. Failure to address these issues may result in significant risks to the organization, including compliance risk, reputation risk, transaction risk, and strategic risk. MAJOR PROCEDURAL ELEMENTS Description of the bank s emergency procedures established to protect personnel and property during emergencies Description of backup considerations Guidelines for disaster recovery planning Standards for testing the disaster recovery plan

2 These areas are covered extensively in the Disaster Recovery Procedural Manual. The Manual is on-site at the Main Bank and copies are distributed on disk to all committee members and also at our Northpoint location, where the Disaster Recovery site resides. OTHER RISK CONSIDERATIONS In addition to banking operations, there are other significant elements to consider, including: External data processing disaster recovery planning Financial institution operational disaster recovery planning Customer service support Affiliate/holding company support (if appropriate) 2

3 STATEMENT OF NEEDS AND PURPOSE The board of directors and senior management of South Side Trust & Savings Bank recognize the need to establish comprehensive emergency and disaster recovery procedures and plans to protect employees during emergencies and to provide for the continuity of operations. Furthermore, the purpose of these procedures is to ensure that the organization is operating under established guidelines to assure the support for the safety and soundness of all financial institution operations as well as the protection of bank staff and assets. It is very important that senior management be informed of all bank disaster recovery plans, procedures, and guidelines. SPECIFIC GOALS Establish overall authority and responsibility in the development, implementation, and maintenance of the disaster recovery program including recovery and business resumption procedures and plans, and related testing. Provide a written reference that can be updated. Document specific planned backup initiatives. Outline strategies for disaster recovery efforts and business resumption. Establish requirements for periodic testing of the adequacy of the recovery plans. ELEMENTS Authority Senior Management will approve the selection of a Disaster Recovery Coordinator who is already an officer of the bank and whose responsibilities will be balanced with that of managing the disaster recovery function. 3

4 To assist the Disaster Recovery Coordinator, management authorizes the Disaster Recovery Coordinator to select a Disaster Recovery Committee to assist in the design, development, drafting, and finalization of a formal disaster recovery program. The Disaster Recovery Committee will assist in the development of the program as well as provide ongoing management of the process, including implementing the program and serving in a leadership role during a disaster. The Disaster Recovery Coordinator will serve as chairperson and primary contact. At least three members of this committee shall be managing officers of the bank and shall also serve as designated Disaster Recovery Committee leaders per the disaster recovery plan. (See Attachment A for a list of committee members.) Responsibility The Disaster Recovery Committee shall be centered on developing a proactive document; it is important that each department or functional area provide input, be encouraged to participate in a forum for discussing contingency planning and disaster recovery issues, and understand the ownership that each department or functional area has in the ultimate program. The Disaster Recovery Committee will meet as needed to accomplish the following: 1. Determine any needed changes to the program and report them to management. 2. Review, discuss, and as appropriate, act upon comments and recommendations provided by various departments. 3. Provide, on no less than an annual basis, a review of the existing program; provide copies of plan revisions for director review; and report on testing efforts and training initiatives. 4. Update, as necessary, procedures to relocate at the off-site location and assure the necessary supplies are in storage at that location. 5. Assure management that all necessary media are backed up and stored off-site to enable reconstruction of all files presently used by the bank. 4

5 Committee members are responsible for ensuring that all employees understand their individual obligations in this regard; the Disaster Recovery Committee must implement guidelines and procedures, and practice to enforce these consistently. South Side Bank management will be required to assist in implementing an ongoing training program to ensure cross-training of employees to reduce or eliminate the threat of loss that arises from the absence of key personnel. The Disaster Recovery Committee must be provided with information on an ongoing basis regarding equipment acquisitions, personnel changes, and off-site preparation in order to update the plan. The committee also will be responsible for establishing long-term goals for their objectives and making sure they are implemented. If the committee follows the guidelines set forth in the policy, it should be able to ensure the bank is operating in a safe manner. During this period, the Disaster Recovery Committee will talk with each department or functional area to: 1. Discuss and recommend needed changes in contingency planning procedures, forms, etc. 2. Provide Senior Management with an annual statement of the disaster recovery program from a department or functional area perspective. The comments will include all areas of concern, including contingency plan testing related to information services, training, location of contingency planning manuals at the bank, and backup site support. Other ongoing responsibilities of the Disaster Recovery Committee include: 1. Continue to provide feedback and reminders to all senior bank management, as necessary, to relocate to the off-site location all critical documents, forms, procedures, data, etc. and to assure the necessary supplies are in storage at that location. 2. Inform respective management teams regarding aspects of the disaster recovery program. 5

6 Services In the event of an area-wide disaster, the bank may offer certain free services to customers and noncustomers to help in the recovery process. Office Locations If one or more offices are severely damaged and not available for banking business within five business days, the Disaster Recovery Coordinator, in cooperation with other team members, will estimate the length of office closure and the timeline for setting up a temporary office, and will evaluate the cost/benefits. Media will be used to redirect customers to other convenient locations. Employee Support The bank will also assist employees to help ease the stress of working through a disaster. This will be assessed at the time of the disaster in accordance with the extent of damage. Training All senior management. managers, and staff are required to receive periodic training regarding disaster recovery procedures within their appropriate location or department. The Branch and/or Department will be responsible for emergency procedures review with their employees at least annually. Risk Management In addressing disaster recovery planning risks, the South Side Bank s senior management must be aware of the potential risks that may arise. Disruption to operations, whether due to internal problems (e.g., a fire) or external problems (e.g., loss of power due to storm damage), impact the organization both in the short term as well as in the future. Different types of emergency and disaster issues should be considered, and appropriate types of planning should be performed. Various risks need to be evaluated. These risks, and their related management techniques include: 6

7 Compliance Risk. Maintaining legal compliance with various appropriate regulations as well as compliance with the organization s emergency and disaster recovery program. Transaction Risk. Impacting earnings or capital due to problems with service or product delivery. Transaction (or operational) risk occurs in the delivery of all products and services. It may be assessed through consideration of all operational aspects including data input, data processing, and data output. People, equipment, forms, data files, and other significant elements of data processing to ensure the restoration of data processing within a short time frame are critical to customers of the organization and the viability of the institution. Strategic Risk. Addressing the potential adverse business impact to the organization, both internally and externally, that may occur if the institution is unable to restore data processing operations and related functions within an acceptable time frame. If the strategic risks related to data processing disaster recovery are not understood, addressed, and managed in terms of preparedness, the institution may not be able in the short term to address the risks and related solutions, resulting in economic and market losses. Reputation Risk. Retaining marketplace confidence by handling customers financial transactions in an appropriate manner and within an acceptable time frame, after a disaster, as well as meeting the emerging needs of the customer base and community are important to protecting the safety and soundness of the institution. Other Risk Considerations After review of internal issues, management has concluded that the following represent procedural considerations that could represent risk to one or more areas of the bank s main office or a branch. Fire / Tornado / Electrical South Side Bank has established various functional area, branch office, and department emergency procedures to provide for the protection of personnel and property during an emergency. The safety of all personnel is first and foremost in any emergency. 7

8 Following the initial review to assure all personnel are safe, the security of the premises, protections of assets and information, and if necessary, removal of any critical, nonreplaceable materials should be considered in an emergency. Emergency phone number for key functional area/branch office/department personnel are maintained in the disaster recovery procedure manual. 8

9 Backup Considerations Disaster recovery planning and procedures for South Side Bank shall include backup plans for key elements within each department/branch and contingency plans or strategies for recovery of operations. The Disaster Recovery Committee has specific responsibilities for developing, implementing, and maintaining the disaster recovery program, including the plan and related disaster recovery procedures. The South Side Bank has made provisions for backup related to hardware, programs, documentation, procedures, and data files. This is described further in the Disaster Recovery Procedures Manual. Standards for Testing Disaster Recovery Plan An annual test of the disaster recovery program is required. Segments of this test process are staged throughout the year to minimize disruption and yet facilitate testing of the disaster recovery program, plan, and procedures. General objectives for the test include determining the overall feasibility of the recovery strategies, verifying compatibility of backup systems and facilities, identifying deficiencies in the plan, providing training for employees involved in disaster recovery, and providing a mechanism for maintaining and updating the plan. Procedures Manual South Side Bank has developed an extensive disaster recovery procedural manual detailing every aspect of a possible disaster. 9

10 Attachment A List of Committee Members Disaster Recovery Committee Members 1. Chief Information Officer 2. Data Processing Officer 3. Deposit Operations Officer 4. Electronic Banking Officer 5. BSA Officer 6. Branch Manager 7. Loan Officer 8. Senior Management 9. Trust Officer 10

Business Continuity Planning and Disaster Recovery Planning

Business Continuity Planning and Disaster Recovery Planning 4 Business Continuity Planning and Disaster Recovery Planning Basic Concepts 1. Business Continuity Management: Business Continuity means maintaining the uninterrupted availability of all key business

More information

85-01-55 Overview of Business Continuity Planning Sally Meglathery Payoff

85-01-55 Overview of Business Continuity Planning Sally Meglathery Payoff 85-01-55 Overview of Business Continuity Planning Sally Meglathery Payoff Because a business continuity plan affects all functional units within the organization, each functional unit must participate

More information

TO: Chief Executive Officers of National Banks, Federal Branches and Data-Processing Centers, Department and Division Heads, and Examining Personnel

TO: Chief Executive Officers of National Banks, Federal Branches and Data-Processing Centers, Department and Division Heads, and Examining Personnel AL 2000 12 O OCC ADVISORY LETTER Comptroller of the Currency Administrator of National Banks Subject: Risk Management of Outsourcing Technology Services TO: Chief Executive Officers of National Banks,

More information

GUIDANCE FOR MANAGING THIRD-PARTY RISK

GUIDANCE FOR MANAGING THIRD-PARTY RISK GUIDANCE FOR MANAGING THIRD-PARTY RISK Introduction An institution s board of directors and senior management are ultimately responsible for managing activities conducted through third-party relationships,

More information

THE CAPITAL MARKETS DISASTER RECOVERY GUIDELINES

THE CAPITAL MARKETS DISASTER RECOVERY GUIDELINES THE CAPITAL MARKETS DISASTER RECOVERY GUIDELINES Guideline PART I PRELIMINARY 1. Title 2. Application 3. Definition of disaster recovery for purposes of these Guidelines 4. Background to Guidelines 5.

More information

PPSADOPTED: OCT. 2012 BACKGROUND POLICY STATEMENT PHYSICAL FACILITIES. PROFESSIONAL PRACTICE STATEMENT Developing a Business Continuity Plan

PPSADOPTED: OCT. 2012 BACKGROUND POLICY STATEMENT PHYSICAL FACILITIES. PROFESSIONAL PRACTICE STATEMENT Developing a Business Continuity Plan PROFESSIONAL PRACTICE STATEMENT Developing a Business Continuity Plan OCT. 2012 PPSADOPTED: What is a professional practice statement? Professional Practice developed by the Association Forum of Chicagoland

More information

Virginia Commonwealth University School of Medicine Information Security Standard

Virginia Commonwealth University School of Medicine Information Security Standard Virginia Commonwealth University School of Medicine Information Security Standard Title: Scope: Business Continuity Management Standard for IT Systems This standard is applicable to all VCU School of Medicine

More information

Data Center Assistance Group, Inc. DCAG Contact: Tom Bronack Phone: (718) 591-5553 Email: bronackt@dcag.com Fax: (718) 380-7322

Data Center Assistance Group, Inc. DCAG Contact: Tom Bronack Phone: (718) 591-5553 Email: bronackt@dcag.com Fax: (718) 380-7322 Business Continuity and Disaster Recovery Job Descriptions Table of Contents Business Continuity Services Organization Chart... 2 Director Business Continuity Services Group... 3 Manager of Business Recovery

More information

Business Continuity Management Group Policy

Business Continuity Management Group Policy THE WAREHOUSE GROUP LIMITED ( the Company ) 1. Purpose of Policy This policy is to communicate The Warehouse Group Limited ( TWG ) governance requirements and arrangements for developing and sustaining

More information

Risk Management of Outsourced Technology Services. November 28, 2000

Risk Management of Outsourced Technology Services. November 28, 2000 Risk Management of Outsourced Technology Services November 28, 2000 Purpose and Background This statement focuses on the risk management process of identifying, measuring, monitoring, and controlling the

More information

BNA FEDERAL CREDIT UNION DISASTER RECOVERY PLAN

BNA FEDERAL CREDIT UNION DISASTER RECOVERY PLAN BNA FEDERAL CREDIT UNION DISASTER RECOVERY PLAN INTRODUCTION The need for a contingency plan for business interruptions is vital to the operations of the BNA Federal Credit Union. Without such a plan,

More information

Disaster Recovery. Stanley Lopez Premier Field Engineer Premier Field Engineering Southeast Asia Customer Services and Support

Disaster Recovery. Stanley Lopez Premier Field Engineer Premier Field Engineering Southeast Asia Customer Services and Support Disaster Recovery Stanley Lopez Premier Field Engineer Premier Field Engineering Southeast Asia Customer Services and Support Categories of Risk Financial Operational Reputational Market share Revenue

More information

Business Continuity Planning

Business Continuity Planning Information Systems Audit and Control Association www.isaca.org Business Continuity Planning AUDIT PROGRAM & INTERNAL CONTROL QUESTIONNAIRE The Information Systems Audit and Control Association With more

More information

Identify and Protect Your Vital Records

Identify and Protect Your Vital Records Identify and Protect Your Vital Records INTRODUCTION The Federal Emergency Management Agency s Federal Preparedness Circular 65 states The protection and ready availability of electronic and hardcopy documents,

More information

Disaster Preparedness & Response

Disaster Preparedness & Response 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 A B C E INTRODUCTION AND PURPOSE REVIEW ELEMENTS ABBREVIATIONS NCUA REFERENCES EXTERNAL REFERENCES Planning - Ensuring

More information

The PNC Financial Services Group, Inc. Business Continuity Program

The PNC Financial Services Group, Inc. Business Continuity Program The PNC Financial Services Group, Inc. Business Continuity Program 1 Content Overview A. Introduction Page 3 B. Governance Model Page 4 C. Program Components Page 4 Business Impact Analysis (BIA) Page

More information

Consider the cash demands of a financial institution's customers; Anticipate funding needs in late 1999 and early 2000;

Consider the cash demands of a financial institution's customers; Anticipate funding needs in late 1999 and early 2000; AL 98-18 Subject: Year 2000 Q&A Guidance Date: December 10, 1998 TO: hief Executive Officers of National Banks, Federal Branches, Service Providers, Software Vendors, Department and Division Heads, and

More information

PAPER-6 PART-1 OF 5 CA A.RAFEQ, FCA

PAPER-6 PART-1 OF 5 CA A.RAFEQ, FCA 1 Chapter-4: Business Continuity Planning and Disaster Recovery Planning PAPER-6 PART-1 OF 5 CA A.RAFEQ, FCA Learning Objectives 2 To understand the concept of Business Continuity Management To understand

More information

Unit Guide to Business Continuity/Resumption Planning

Unit Guide to Business Continuity/Resumption Planning Unit Guide to Business Continuity/Resumption Planning (February 2009) Revised June 2011 Executive Summary... 3 Purpose and Scope for a Unit Business Continuity Plan(BCP)... 3 Resumption Planning... 4 Assumptions

More information

Disaster Recovery and Business Continuity Plan

Disaster Recovery and Business Continuity Plan Disaster Recovery and Business Continuity Plan Table of Contents 1. Introduction... 3 2. Objectives... 3 3. Risks... 3 4. Steps of Disaster Recovery Plan formulation... 3 5. Audit Procedure.... 5 Appendix

More information

SUPERVISORY AND REGULATORY GUIDELINES: PU19-0406 BUSINESS CONTINUITY GUIDELINES

SUPERVISORY AND REGULATORY GUIDELINES: PU19-0406 BUSINESS CONTINUITY GUIDELINES SUPERVISORY AND REGULATORY GUIDELINES: PU19-0406 Business Continuity Issued: 1 st May, 2007 Revised: 14 th October 2008 BUSINESS CONTINUITY GUIDELINES I. INTRODUCTION The Central Bank of The Bahamas (

More information

SAMPLE IT CONTINGENCY PLAN FORMAT

SAMPLE IT CONTINGENCY PLAN FORMAT SAMPLE IT CONTINGENCY PLAN FORMAT This sample format provides a template for preparing an information technology (IT) contingency plan. The template is intended to be used as a guide, and the Contingency

More information

Disaster Recovery Planning Process

Disaster Recovery Planning Process Disaster Recovery Planning Process By Geoffrey H. Wold Part I of III This is the first of a three-part series that describes the planning process related to disaster recovery. Based on the various considerations

More information

Does it state the management commitment and set out the organizational approach to managing information security?

Does it state the management commitment and set out the organizational approach to managing information security? Risk Assessment Check List Information Security Policy 1. Information security policy document Does an Information security policy exist, which is approved by the management, published and communicated

More information

Business Unit CONTINGENCY PLAN

Business Unit CONTINGENCY PLAN Contingency Plan Template Business Unit CONTINGENCY PLAN Version 1.0 (Date submitted) Submitted By: Business Unit Date Version 1.0 Page 1 1 Plan Review and Updates... 3 2 Introduction... 3 2.1 Purpose...

More information

NCUA LETTER TO CREDIT UNIONS

NCUA LETTER TO CREDIT UNIONS NCUA LETTER TO CREDIT UNIONS NATIONAL CREDIT UNION ADMINISTRATION 1775 Duke Street, Alexandria, VA 22314 DATE: December 2001 LETTER NO.: 01-CU-21 TO: SUBJ: ENCL: All Federally Insured Credit Unions Disaster

More information

CENTRAL BANK OF KENYA (CBK) PRUDENTIAL GUIDELINE ON BUSINESS CONTINUITY MANAGEMENT (BCM) FOR INSTITUTIONS LICENSED UNDER THE BANKING ACT

CENTRAL BANK OF KENYA (CBK) PRUDENTIAL GUIDELINE ON BUSINESS CONTINUITY MANAGEMENT (BCM) FOR INSTITUTIONS LICENSED UNDER THE BANKING ACT CENTRAL BANK OF KENYA (CBK) PRUDENTIAL GUIDELINE ON BUSINESS CONTINUITY MANAGEMENT (BCM) FOR INSTITUTIONS LICENSED UNDER THE BANKING ACT JANUARY 2008 GUIDELINE ON BUSINESS CONTINUITY GUIDELINE CBK/PG/14

More information

The PNC Financial Services Group, Inc. Business Continuity Program

The PNC Financial Services Group, Inc. Business Continuity Program The PNC Financial Services Group, Inc. Business Continuity Program subsidiaries) 1 Content Overview A. Introduction Page 3 B. Governance Model Page 4 C. Program Components Page 4 Business Impact Analysis

More information

TO CREDIT UNIONS DATE: June 10, 1998

TO CREDIT UNIONS DATE: June 10, 1998 NATIONAL CREDIT UNION ADMINISTRATION NATIONAL CREDIT UNION SHARE INSURANCE FUND LETTER LETTER NO.: 98-CU-12 TO CREDIT UNIONS DATE: June 10, 1998 SUBJECT: Business Resumption Contingency Planning Letter

More information

Federal Financial Institutions Examination Council FFIEC. Business Continuity Planning BCP MARCH 2003 MARCH 2008 IT EXAMINATION

Federal Financial Institutions Examination Council FFIEC. Business Continuity Planning BCP MARCH 2003 MARCH 2008 IT EXAMINATION Federal Financial Institutions Examination Council FFIEC Business Continuity Planning MARCH 2003 MARCH 2008 BCP IT EXAMINATION H ANDBOOK TABLE OF CONTENTS INTRODUCTION... 1 BOARD AND SENIOR MANAGEMENT

More information

B U S I N E S S C O N T I N U I T Y P L A N

B U S I N E S S C O N T I N U I T Y P L A N B U S I N E S S C O N T I N U I T Y P L A N 1 Last Review / Update: December 9, 2015 Table of Contents Purpose...3 Background...3 Books and Records Back-up and Recovery...4 Mission Critical Systems...

More information

Information Privacy and Security Program Title:

Information Privacy and Security Program Title: Page: 1 of 11 I. PURPOSE: The purpose of this standard is to protect the safety of our workforce members and mitigate potential risk(s) that could materially affect the ability of the facility to remain

More information

The Technology Trilogy:

The Technology Trilogy: The Technology Trilogy: Security, Disaster Recovery, & Business Continuity Information Technology Services for Colleges and Universities www.thinkeduserve.com The Technology Trilogy: Security, Disaster

More information

Resource Ordering and Status System. User Business Resumption Plan

Resource Ordering and Status System. User Business Resumption Plan Resource Ordering and Status System User Business Resumption Plan I. INTRODUCTION This document is the disaster preparedness and recovery plan for users of the Resource Ordering and Statusing System (ROSS).

More information

Table of Contents... 1

Table of Contents... 1 ... 1 Chapter 1 Introduction... 4 1.1 Executive Summary... 4 1.2 Goals and Objectives... 5 1.3 Senior Management and Board of Directors Responsibilities... 5 1.4 Business Continuity Planning Processes...

More information

Business Continuity Planning 101. +1 610 768-4120 (800) 634-2016 www.strohlsystems.com info@strohlsystems.com

Business Continuity Planning 101. +1 610 768-4120 (800) 634-2016 www.strohlsystems.com info@strohlsystems.com Business Continuity Planning 101 Presentation Overview What is business continuity planning Plan Development Plan Testing Plan Maintenance Future advancements in BCP Question & Answer What is a Disaster?

More information

Business Continuity Plan

Business Continuity Plan Business Continuity Plan Revision as of 03.25.13 Continuum Wealth Advisors, LLC 18 Division St.; Suite 207B Saratoga Springs, NY 12866 Introduction Recent events have brought the importance of creating

More information

Hanh Do, Director, Information System Audit Division, GAA. SUBJECT: Review of HUD s Information Technology Contingency Planning and Preparedness

Hanh Do, Director, Information System Audit Division, GAA. SUBJECT: Review of HUD s Information Technology Contingency Planning and Preparedness Issue Date: August 31, 2006 Audit Report Number 2006-DP-0005 TO: Lisa Schlosser, Chief Information Officer, A FROM: Hanh Do, Director, Information System Audit Division, GAA SUBJECT: Review of HUD s Information

More information

Information Security Handbook

Information Security Handbook Information Security Handbook Adopted 6/4/14 Page 0 Page 1 1. Introduction... 5 1.1. Executive Summary... 5 1.2. Governance... 5 1.3. Scope and Application... 5 1.4. Biennial Review... 5 2. Definitions...

More information

INFORMATION TECHNOLOGY SECURITY STANDARDS

INFORMATION TECHNOLOGY SECURITY STANDARDS INFORMATION TECHNOLOGY SECURITY STANDARDS Version 2.0 December 2013 Table of Contents 1 OVERVIEW 3 2 SCOPE 4 3 STRUCTURE 5 4 ASSET MANAGEMENT 6 5 HUMAN RESOURCES SECURITY 7 6 PHYSICAL AND ENVIRONMENTAL

More information

Application / Hardware - Business Impact Analysis Template. MARC Configuration Requirements. Business Impact Analysis

Application / Hardware - Business Impact Analysis Template. MARC Configuration Requirements. Business Impact Analysis Application / Hardware - Business Impact Analysis Template The single most important thing we can do is help you understand the criticality of each application, supporting hardware/server/pc and the required

More information

AUDIT REPORT INTERNAL AUDIT DIVISION. Audit of business continuity and disaster recovery planning at UNON

AUDIT REPORT INTERNAL AUDIT DIVISION. Audit of business continuity and disaster recovery planning at UNON INTERNAL AUDIT DIVISION AUDIT REPORT Audit of business continuity and disaster recovery planning at UNON Overall results relating to business continuity and disaster recovery planning at UNON were initially

More information

Education and Workforce Development Cabinet POLICY/PROCEDURE. Policy Number: EDU-06 Effective Date: April 15, 2006 Revision Date: December 20, 2012

Education and Workforce Development Cabinet POLICY/PROCEDURE. Policy Number: EDU-06 Effective Date: April 15, 2006 Revision Date: December 20, 2012 Education and Workforce Development Cabinet POLICY/PROCEDURE Policy Number: EDU-06 Effective Date: April 15, 2006 Revision Date: December 20, 2012 Subject: Backup Procedures Tower and Server Farms Policy:

More information

Business continuity plan

Business continuity plan Business continuity plan CONTENTS INTRODUCTION 2 - Scope - Components BUSINESS IMPACT ANALYSIS 3 - Business Affairs - Information Technology RISK ASSESSMENT 5 - Broad Categories of Hazards - Hazard Table

More information

FINAL AUDIT REPORT WITH RECOMENDATIONS Information Technology No. 11-001

FINAL AUDIT REPORT WITH RECOMENDATIONS Information Technology No. 11-001 FINAL AUDIT REPORT WITH RECOMENDATIONS Information Technology No. 11-001 SUBJECT: Review of Emergency Plans DATE: September 24, 2010 for Critical Information Technology Operations and Financial Systems

More information

BUSINESS CONTINUITY PLANNING

BUSINESS CONTINUITY PLANNING Policy 8.3.2 Business Responsible Party: President s Office BUSINESS CONTINUITY PLANNING Overview The UT Health Science Center at San Antonio (Health Science Center) is committed to its employees, students,

More information

Continuity of Operations Planning. A step by step guide for business

Continuity of Operations Planning. A step by step guide for business What is a COOP? Continuity of Operations Planning A step by step guide for business A Continuity Of Operations Plan (COOP) is a MANAGEMENT APPROVED set of agreed-to preparations and sufficient procedures

More information

Subject: Internal Audit of Information Technology Disaster Recovery Plan

Subject: Internal Audit of Information Technology Disaster Recovery Plan RIVERSIDE: AUDIT & ADVISORY SERVICES June 30, 2009 To: Charles Rowley, Associate Vice Chancellor Computing & Communications Subject: Internal Audit of Information Technology Disaster Recovery Plan Ref:

More information

Clovis Municipal School District Information Technology (IT) Disaster Recovery Plan

Clovis Municipal School District Information Technology (IT) Disaster Recovery Plan Clovis Municipal School District Information Technology (IT) Disaster Recovery Plan Revision History REVISION DATE NAME DESCRIPTION Draft 1.0 Eric Wimbish IT Backup Disaster Table of Contents Information

More information

BUSINESS CONTINUITY PLAN OVERVIEW

BUSINESS CONTINUITY PLAN OVERVIEW BUSINESS CONTINUITY PLAN OVERVIEW INTRODUCTION The purpose of this document is to provide Loomis customers with an overview of the company s Business Continuity Plan (BCP). Because of the specific and

More information

Statement of Guidance

Statement of Guidance Statement of Guidance Business Continuity Management All Licensees 1. Statement of Objectives 1.1. To enhance the resilience of the financial sector and to minimise the potential impact of a major operational

More information

SCOPE; ENFORCEMENT; AUTHORITY; EXCEPTIONS

SCOPE; ENFORCEMENT; AUTHORITY; EXCEPTIONS Title: DRAFT USG Continuity of Operation Plan Policy Policy Number: 2009-Julian Date Topical Security Area: Document Type: Standard Pages: Words: Lines: 5 1,387 182 Issue Date: May-09 Effective Date: Immediately

More information

GUIDELINES FOR ELECTRONIC BANKING

GUIDELINES FOR ELECTRONIC BANKING SUPERVISORY AND REGULATORY GUIDELINES: PU23-0506 6 th June, 2006 GUIDELINES FOR ELECTRONIC BANKING I. INTRODUCTION The Central Bank of The Bahamas ( the Central Bank ) is responsible for the licensing,

More information

Hospital Emergency Operations Plan

Hospital Emergency Operations Plan Hospital Emergency Operations Plan I-1 Emergency Management Plan I PURPOSE The mission of University Hospital of Brooklyn (UHB) is to improve the health of the people of Kings County by providing cost-effective,

More information

Offsite Disaster Recovery Plan

Offsite Disaster Recovery Plan 1 Offsite Disaster Recovery Plan Offsite Disaster Recovery Plan Presented By: Natan Verkhovsky President Disty Portal Inc. 2 Offsite Disaster Recovery Plan Introduction This document is a comprehensive

More information

PAPER-6 PART-3 OF 5 CA A.RAFEQ, FCA

PAPER-6 PART-3 OF 5 CA A.RAFEQ, FCA Chapter-4: Business Continuity Planning and Disaster Recovery Planning PAPER-6 PART-3 OF 5 CA A.RAFEQ, FCA Learning Objectives 2 To understand the concept of Business Continuity Management To understand

More information

GUIDELINES FOR THE MANAGEMENT OF OPERATIONAL RISK FOR CREDIT UNIONS

GUIDELINES FOR THE MANAGEMENT OF OPERATIONAL RISK FOR CREDIT UNIONS SUPERVISORY AND REGULATORY GUIDELINES Guidelines Issued: 22 December 2015 GUIDELINES FOR THE MANAGEMENT OF OPERATIONAL RISK FOR CREDIT UNIONS 1. INTRODUCTION 1.1 The Central Bank of The Bahamas ( the Central

More information

Continuity Plan Testing Flowchart

Continuity Plan Testing Flowchart Building an effective Tabletop Exercise Presented by: Ken M. Shaurette, CISSP, CISA, CISM, CRISC FIPCO Director IT Services 3/26/2013 #1 Continuity Plan Testing Flowchart 3/26/2013 #2 1 Ongoing Multi-Year

More information

Business Continuity and Disaster Recovery Planning

Business Continuity and Disaster Recovery Planning Business Continuity and Disaster Recovery Planning Jennifer Brandt, CISA A p r i l 16, 2015 HISTORY OF STINNETT & ASSOCIATES Stinnett & Associates (Stinnett) is a professional advisory firm offering services

More information

Interagency Statement on Pandemic Planning

Interagency Statement on Pandemic Planning Interagency Statement on Pandemic Planning PURPOSE The FFIEC agencies 1 are jointly issuing guidance to remind financial institutions that business continuity plans should address the threat of a pandemic

More information

FACT SHEET: Ransomware and HIPAA

FACT SHEET: Ransomware and HIPAA FACT SHEET: Ransomware and HIPAA A recent U.S. Government interagency report indicates that, on average, there have been 4,000 daily ransomware attacks since early 2016 (a 300% increase over the 1,000

More information

DOCUMENT NUMBER: IT-0514

DOCUMENT NUMBER: IT-0514 SUBJECT: Disaster Recovery Plan EFFECTIVE DATE: 04/15/05 PAGE 1 OF 6 OFFICE OF MIS: DATE: SECRETARY OF DHHR: DATE: 1.0 PURPOSE The purpose of this policy is to specify requirements and responsibilities

More information

Contingency Planning and Disaster Recovery Internal Control Questionnaire

Contingency Planning and Disaster Recovery Internal Control Questionnaire Contingency Planning and Disaster Recovery Internal Control Questionnaire [Institution s name] [Departments under review] [Heads of departments under review] A. POLICY AND SUPERVISION REVIEW 1. Was the

More information

Committed to Environment, Health, & Safety

Committed to Environment, Health, & Safety Committed to Environment, Health, & Safety Environment, Health, and Safety Management System and Policy of W.R. Grace & Co. January 1, 2015 The Grace Environment, Health, and Safety Management System,

More information

MANAGEMENT AUDIT REPORT DISASTER RECOVERY PLAN DEPARTMENT OF FINANCE AND ADMINISTRATIVE SERVICES INFORMATION TECHNOLOGY SERVICES DIVISION

MANAGEMENT AUDIT REPORT DISASTER RECOVERY PLAN DEPARTMENT OF FINANCE AND ADMINISTRATIVE SERVICES INFORMATION TECHNOLOGY SERVICES DIVISION MANAGEMENT AUDIT REPORT OF DISASTER RECOVERY PLAN DEPARTMENT OF FINANCE AND ADMINISTRATIVE SERVICES INFORMATION TECHNOLOGY SERVICES DIVISION REPORT NO. 13-101 City of Albuquerque Office of Internal Audit

More information

IT Disaster Recovery Plan Template

IT Disaster Recovery Plan Template HOPONE INTERNET CORP IT Disaster Recovery Plan Template Compliments of: Tim Sexton 1/1/2015 An information technology (IT) disaster recovery (DR) plan provides a structured approach for responding to unplanned

More information

<Client Name> IT Disaster Recovery Plan Template. By Paul Kirvan, CISA, CISSP, FBCI, CBCP

<Client Name> IT Disaster Recovery Plan Template. By Paul Kirvan, CISA, CISSP, FBCI, CBCP IT Disaster Recovery Plan Template By Paul Kirvan, CISA, CISSP, FBCI, CBCP Revision History REVISION DATE NAME DESCRIPTION Original 1.0 2 Table of Contents Information Technology Statement

More information

Risk Management Programme Guidelines

Risk Management Programme Guidelines Risk Management Programme Guidelines Submissions are invited on these draft Reserve Bank risk management programme guidelines for non-bank deposit takers. Submissions should be made by 29 June 2009 and

More information

Business Continuity Planning for Schools, Departments & Support Units

Business Continuity Planning for Schools, Departments & Support Units Business Continuity Planning for Schools, Departments & Support Units 1 What is Business Continuity Planning? Examples Planning for an adverse, major or catastrophic event that would cause a disruption

More information

Business Continuity and Disaster Recovery Plan

Business Continuity and Disaster Recovery Plan Business Continuity and Disaster Recovery Plan EFA BUSINESS CONTINUITY PLAN This EFA Business Continuity Plan is designed to provide all personnel with guidelines to be followed in the event of a Major

More information

Business Continuity Planning and Disaster Recovery Planning. Ed Crowley IAM/IEM

Business Continuity Planning and Disaster Recovery Planning. Ed Crowley IAM/IEM Business Continuity Planning and Disaster Recovery Planning Ed Crowley IAM/IEM 1 Goals Compare and contrast aspects of business continuity Execute disaster recovery plans and procedures 2 Topics Business

More information

Business Continuity Management Policy

Business Continuity Management Policy Governance 1 Purpose The purpose of this policy is to communicate Business Continuity Management (BCM) framework, responsibilities and guiding principles for Victoria to effectively prepare for and achieve

More information

SECTION 15 INFORMATION TECHNOLOGY

SECTION 15 INFORMATION TECHNOLOGY SECTION 15 INFORMATION TECHNOLOGY 15.1 Purpose 15.2 Authorization 15.3 Internal Controls 15.4 Computer Resources 15.5 Network/Systems Access 15.6 Disaster Recovery Plan (DRP) 15.1 PURPOSE The Navajo County

More information

July 30, 2009. Internal Audit Report 2009-08 Information Technology Business Continuity Plan Information Technology Department

July 30, 2009. Internal Audit Report 2009-08 Information Technology Business Continuity Plan Information Technology Department Internal Audit Report 2009-08 Introduction. The Municipality depends heavily on technology and automated information systems, and their disruption for even a few days could have a severe impact on critical

More information

This document contains the text of Secretary of the State regulations concerning

This document contains the text of Secretary of the State regulations concerning 1 This document contains the text of Secretary of the State regulations concerning Emergency Contingency Model Plan for Elections (Sections 9-174a-1 to 9-174a-34) This document was created by the Office

More information

EMERGENCY RESPONSE PLAN. This Emergency Response Plan describes the functions and procedures of USA Track & Field,

EMERGENCY RESPONSE PLAN. This Emergency Response Plan describes the functions and procedures of USA Track & Field, EMERGENCY RESPONSE PLAN This Emergency Response Plan describes the functions and procedures of USA Track & Field, Inc. ( USATF ) and sets forth the principles that will guide USATF s actions in response

More information

ISO 27001 Controls and Objectives

ISO 27001 Controls and Objectives ISO 27001 s and Objectives A.5 Security policy A.5.1 Information security policy Objective: To provide management direction and support for information security in accordance with business requirements

More information

PAPER-6 PART-5 OF 5 CA A.RAFEQ, FCA

PAPER-6 PART-5 OF 5 CA A.RAFEQ, FCA Chapter-4: Business Continuity Planning and Disaster Recovery Planning PAPER-6 PART-5 OF 5 CA A.RAFEQ, FCA Learning Objectives 2 To understand the concept of Business Continuity Management To understand

More information

Business Continuity Management Policy

Business Continuity Management Policy Business Continuity Management Policy Business Continuity Policy Version 1.0 1 Version control Version Date Changes Author 0.1 April 13 1 st draft PH 0.2 June 13 Amendments in line with guidance PH 0.3

More information

CISM Certified Information Security Manager

CISM Certified Information Security Manager CISM Certified Information Security Manager Firebrand Custom Designed Courseware Chapter 4 Information Security Incident Management Exam Relevance Ensure that the CISM candidate Establish an effective

More information

IT Service Management

IT Service Management IT Service Management Service Continuity Methods (Disaster Recovery Planning) White Paper Prepared by: Rick Leopoldi May 25, 2002 Copyright 2001. All rights reserved. Duplication of this document or extraction

More information

The Disaster Recovery Self-Assessment Guide and Validation Model. Jim Kates Cognizant Technology Solutions Jim.Kates@cognizant.com

The Disaster Recovery Self-Assessment Guide and Validation Model. Jim Kates Cognizant Technology Solutions Jim.Kates@cognizant.com The Disaster Recovery Self-Assessment Guide and Validation Model Jim Kates Cognizant Technology Solutions Jim.Kates@cognizant.com How Would You Evaluate Your DRP? (Is it a Disaster Recovery Plan or a Dilbert

More information

CHAPTER 11 COMPUTER SYSTEMS INFORMATION TECHNOLOGY SERVICES CONTROLS

CHAPTER 11 COMPUTER SYSTEMS INFORMATION TECHNOLOGY SERVICES CONTROLS 11-1 CHAPTER 11 COMPUTER SYSTEMS INFORMATION TECHNOLOGY SERVICES CONTROLS INTRODUCTION The State Board of Accounts, in accordance with State statutes and the Statements on Auditing Standards Numbers 78

More information

Business Continuity Information Gathering Template

Business Continuity Information Gathering Template Business Continuity Information Gathering Template August 2009 Introduction Our organization has begun an intensive effort to document Business Continuity Plans for all departments and s. The Department

More information

ASX CLEAR (FUTURES) OPERATING RULES Guidance Note 10

ASX CLEAR (FUTURES) OPERATING RULES Guidance Note 10 BUSINESS CONTINUITY AND DISASTER RECOVERY The purpose of this Guidance Note The main points it covers To assist participants to understand the disaster recovery and business continuity arrangements they

More information

How to Prepare for an Emergency: A Disaster and Business Recovery Plan

How to Prepare for an Emergency: A Disaster and Business Recovery Plan How to Prepare for an Emergency: A Disaster and Business Recovery Plan Chapter 1: Overview of the Disaster and Business Recovery Plan Purpose: To develop and establish a comprehensive Disaster and Business

More information

EASY FOREX TRADING LTD DISCLOSURE AND MARKET DISCIPLINE IN ACCORDANCE WITH CAPITAL ADEQUACY AND THE REQUIREMENTS ON RISK MANAGEMENT

EASY FOREX TRADING LTD DISCLOSURE AND MARKET DISCIPLINE IN ACCORDANCE WITH CAPITAL ADEQUACY AND THE REQUIREMENTS ON RISK MANAGEMENT EASY FOREX TRADING LTD DISCLOSURE AND MARKET DISCIPLINE IN ACCORDANCE WITH CAPITAL ADEQUACY AND THE REQUIREMENTS ON RISK MANAGEMENT 31 st December 2012 Introduction For the purposes of Directive DI144-2007-05

More information

Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session Four

Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session Four Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session Four Data Handling in University Business Impact Analysis ( BIA ) Agenda Overview Terminologies Performing

More information

Guidance to Licenceholders and Potential Licenceholders regarding Internet/E-business Developments. Appendix H

Guidance to Licenceholders and Potential Licenceholders regarding Internet/E-business Developments. Appendix H Guidance to Licenceholders and Potential Licenceholders regarding Internet/E-business Developments Page 1 of 10 Page 2 of 10 1. INTRODUCTION 1.1 Background to these Guidance Notes The Isle of Man Financial

More information

Data Privacy Framework

Data Privacy Framework Data Privacy Framework Table of Contents 1. INTRODUCTION...4 2. SCOPE & DEFINITIONS...4 2.1 SCOPE OF THE DATA PRIVACY FRAMEWORK...4 2.2 DEFINITIONS...4 3. SECURITY ORGANIZATION & RESPONSIBILITIES...4 3.1

More information

DCU BULLETIN Division of Credit Unions Washington State Department of Financial Institutions Phone: (360) 902-8718 FAX: (360) 704-6991

DCU BULLETIN Division of Credit Unions Washington State Department of Financial Institutions Phone: (360) 902-8718 FAX: (360) 704-6991 DCU BULLETIN Division of Credit Unions Washington State Department of Financial Institutions Phone: (360) 902-8718 FAX: (360) 704-6991 August 30, 1999 No. B-99-12 Year 2000 Reporting by September 30, 1999;

More information

The Weill Cornell Medical College and Graduate School of Medical Sciences. Responsible Department: Information Technologies and Services (ITS)

The Weill Cornell Medical College and Graduate School of Medical Sciences. Responsible Department: Information Technologies and Services (ITS) Information Technology Disaster Recovery Policy Policy Statement This policy defines acceptable methods for disaster recovery planning, preparedness, management and mitigation of IT systems and services

More information

Official Audit Report Issued July 14, 2011

Official Audit Report Issued July 14, 2011 Official Audit Report Issued July 14, 2011 Information Technology Controls Pertaining to Business Continuity Planning for the Office of the State Treasurer and Receiver General For the period January 1,

More information

PRACTICE ADVISORIES FOR INTERNAL AUDIT

PRACTICE ADVISORIES FOR INTERNAL AUDIT Société Française de Réalisation, d'etudes et de Conseil Economics and Public Management Department PRACTICE ADVISORIES FOR INTERNAL AUDIT Tehnical Assistance to the Ministry of Finance for Development

More information

OCC 98-3 OCC BULLETIN

OCC 98-3 OCC BULLETIN To: Chief Executive Officers and Chief Information Officers of all National Banks, General Managers of Federal Branches and Agencies, Deputy Comptrollers, Department and Division Heads, and Examining Personnel

More information

By. Mr. Chomnaphas Tangsook Business Director BSI Group ( Thailand) Co., Ltd

By. Mr. Chomnaphas Tangsook Business Director BSI Group ( Thailand) Co., Ltd BS 25999 Business Continuity Management By. Mr. Chomnaphas Tangsook Business Director BSI Group ( Thailand) Co., Ltd 1 Contents slide BSI British Standards 2006 BS 25999(Business Continuity) 2002 BS 15000

More information

Business Continuity Management in Local Government

Business Continuity Management in Local Government Business Continuity Management in Local Government Victorian Auditor-General s Report September 2010 2010-11:6 V I C T O R I A Victorian Auditor-General Business Continuity Management in Local Government

More information

GAO. Year 2000 Computing Crisis: Business Continuity and Contingency Planning

GAO. Year 2000 Computing Crisis: Business Continuity and Contingency Planning GAO United States General Accounting Office Accounting and Information Management Division August 1998 Year 2000 Computing Crisis: Business Continuity and Contingency Planning GAO/AIMD-10.1.19 Preface

More information

Business Continuity Plan

Business Continuity Plan Business Continuity Plan October 2007 Agenda Business continuity plan definition Evolution of the business continuity plan Business continuity plan life cycle FFIEC & Business continuity plan Questions

More information

An organization properly establishes and operates its control over risks regarding the information system to fulfill the following objectives:

An organization properly establishes and operates its control over risks regarding the information system to fulfill the following objectives: p. 1 System Management Standards Proposed on October 8, 2004 Preface Today, the information system of an organization works as an important infrastructure of the organization to implement its management

More information