BCP/DR Reporting Metrics
|
|
|
- Nicholas Mitchell
- 10 years ago
- Views:
Transcription
1 Session Agenda I. Introductions Telling Management the WHOLE Story Session D15 Joe Flach / Safe Harbor Consulting II. Reporting Requirements III. IV. V. The Adjusted Recovery Confidence Factor VI. Back Pocket Readiness VII. Questions and Answers Introductions Reporting Requirements Hello! General Requirements Foreign Corrupt Practices Act, 1977 Sarbanes-Oxley Act of 2002 The Occupational Safety and Health Act (OSHA) SEC Regulations NYSE Rule 446 NASD Rules 3510 & 3520
2 Industry Specific Requirements Reporting Requirements Industry Regulation Healthcare HIPPA of 1996 FDA Code of Federal Regulations Title XXI, 1999 Government FISMA 2002, Title III of the E Gov. Act COOP and COG Federal Prep Circular 69, 1999 NIST Self Publication , 2002 NIST , 2005 Finance FFIEC Handbook, Chapter 10, Basel II, 2002 Interagency Paper on Sound Practices, 2003 EFA Act, 1989 Utilities GASB Statement Number 34, 1999 NERC 1200 (1216.1), 2003 FERC RM Appendix G, 2003 RUS 7 CFR Part 1730, 2005 Typical duties of boards of directors include: governing the organization by establishing broad policies and objectives; selecting, appointing, supporting and reviewing the performance of the chief executive; ensuring the availability of adequate financial resources; approving annual budgets; accounting to the stakeholders for the organization's performance; setting the salaries and compensation of company management. From: Wikipedia: just one of many items on a full agenda limited to 15 minutes or less speaking to a room of people in which no one has a background in this field speaking to a room of people who have a limited interest in your topic speaking to people who are strategic planners not tactical thinkers standing in the way of a more interesting topic, lunch or liquid refreshments Board of Directors is responsible for ensuring the company has an adequate Business Continuity Program in place to protect the best interests of all corporate stakeholders. Business Continuity Planner is responsible for educating and informing Sr. Management on the business continuity posture, risks/threats and potential impacts from interruptions. The Business Continuity Planner is responsible for positioning the BOD to make informed and educated decisions regarding the Business Continuity Program. The worst thing that can happen to a Business Continuity Planner is to have Sr.
3 Do Not Report on Activity. Do Report on Recovery Posture. ARE WE RECOVERABLE? Are we recoverable? The Adjusted Recovery Confidence Factor ARCF = CBUTested/CBUTotal (CA) (DA) CBUTested = Number of Critical Business Units SUCCESSFULLY Tested CBUTotal = Number of Total Critical Business Units CA = Confidence Adjuster - % Confidence we have identified the right CBUs DA = Documentation Adjuster - % of our program that is adequately documented
4 CBUTested Emphasis on the word successfully. A critical business unit is successfully tested when it is validated that the business processes can be recovered within the established RTO. You will be unsuccessful The Confidence Adjuster Is a subjective measurement for how confident you are that your program has identified the right Critical Business Units. Supports the need for a Business Impact Analysis (BIA) to validate the CBUs. The Documentation Adjuster Measures what percentage of the program is supported by documented plans. Back Pocket Readiness The individual components of the ARCF allows you to tell the whole story and focus on those parts of the program that demand attention. Be prepared to answer these other questions: Are we compliant? How do we compare to our peers? What could possibly cause an interruption to our operations? And: What can/should we do to improve our ARCF?
5 Thank You
Continuity of operations for critical infrastructure. Disclosure of critical information to the government.
Regulatory compliance is a significant factor influencing the development of your business resilience strategy. Moreover, while Business Continuity or Disaster Recovery regulations may not apply in every
Regulatory Requirements for Disaster Recovery/Business Continuity Programs
Regulatory Requirements for Disaster Recovery/Business Continuity Programs Al Berman Business Continuity Planning Practice Post 9/11 Surge in Business Continuity Regulations and Standards Post 9-11 20
www.pwc.com Governance, Risk and Compliance Update & Hot Topics Pittsburgh Chapter IIA December 3, 2012
www.pwc.com Governance, Risk and Compliance Update & Hot Topics Pittsburgh Chapter IIA December 3, 2012 Agenda Introduction Mark Gibbons 12:00 12:05 Governance, Risk and Compliance Overview Mark Gibbons
Global Statement of Business Continuity
Business Continuity Management Version 1.0-2014 Date October 18, 2014 Status Author Business Continuity Management (BCM) Page 1 of 8 Table of Contents 1. Credit Suisse Business Continuity Statement 3 2.
The Role of Internal Audit In Business Continuity Planning
The Role of Internal Audit In Business Continuity Planning Dan Bailey, MBCP Page 0 Introduction Dan Bailey, MBCP Senior Manager Protiviti Inc. [email protected] Actively involved in the Information
SCAC Annual Conference. Cybersecurity Demystified
SCAC Annual Conference Cybersecurity Demystified Me Thomas Scott SC Deputy Chief Information Security Officer PMP, CISSP, CISA, GSLC, FEMA COOP Practitioner [email protected] 803-896-6395 What is Cyber
Guide to Business Continuity Management
Guide to Business Continuity Management Frequently Asked Questions Third Edition Contents Introduction.... v Business Continuity Basics...1 1. What is business continuity management (BCM)?...1 2. BCM seems
Securing your Corporate Infrastructure What is really needed to keep your assets protected
Securing your Corporate Infrastructure What is really needed to keep your assets protected Joseph Burkard CISA, CISSP October 3, 2002 1 Securing your Corporate Infrastructure Management Dilemma or Technical
An Introduction to RSA envision The Information Log Management Platform for Security and Compliance Success. September, 2009
An Introduction to RSA envision The Information Log Management Platform for Security and Compliance Success September, 2009 Changing Threats and More Demanding Regulations External attacks Malicious insiders
EPA Classification No.: CIO-2150.3-P-02.1 CIO Approval Date: 08/06/2012 CIO Transmittal No.: 12-003 Review Date: 08/06/2015
Issued by the EPA Chief Information Officer, Pursuant to Delegation 1-19, dated 07/07/2005 INFORMATION SECURITY INTERIM AWARENESS AND TRAINING PROCEDURES V3.1 JULY 18, 2012 1. PURPOSE The purpose of this
What are you trying to secure against Cyber Attack?
Cybersecurity Legal Landscape Bonnie Harrington Executive Counsel EHS and Product Safety & Cybersecurity GE Energy Management Imagination at work. What are you trying to secure against Cyber Attack? Personally
EVOGENE LTD. (THE COMPANY ) AUDIT COMMITTEE CHARTER
EVOGENE LTD. (THE COMPANY ) AUDIT COMMITTEE CHARTER The Board of Directors (the Board ) of the Company has constituted and established an Audit Committee (the Committee ) with the authority, responsibility
Virginia Commonwealth University School of Medicine Information Security Standard
Virginia Commonwealth University School of Medicine Information Security Standard Title: Scope: Business Continuity Management Standard for IT Systems This standard is applicable to all VCU School of Medicine
How To Manage Risk
Oracle Applications Day Zürich, 1. Juli 2009 Risk und Performance Management in Stürmischen Zeiten mit Oracle GRC Steven Hagner EMEA GRC Sales Organization 1 Safe Harbor Statement The following is intended
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session Three
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session Three Information Security- Perspective for Management Business Impact Analysis ( BIA ) and Business
National Patient Information Reporting System: National Data Warehouse. Service Level Agreement
National Patient Information Reporting System: Service Level Agreement Userpop/Workload Mart Version 3.0 June 2009 Department of Health and Human Services Indian Health Service Office of Information Technology
Review of the SEC s Systems Certification and Accreditation Process
Review of the SEC s Systems Certification and Accreditation Process March 27, 2013 Page i Should you have any questions regarding this report, please do not hesitate to contact me. We appreciate the courtesy
Health Insurance Portability and Accountability Act Enterprise Compliance Auditing & Reporting ECAR for HIPAA Technical Product Overview Whitepaper
Regulatory Compliance Solutions for Microsoft Windows IT Security Controls Supporting DHS HIPAA Final Security Rules Health Insurance Portability and Accountability Act Enterprise Compliance Auditing &
IT SECURITY EDUCATION AWARENESS TRAINING POLICY OCIO-6009-09 TABLE OF CONTENTS
OFFICE OF THE CHIEF INFORMATION OFFICER Date of Issuance: May 22, 2009 Effective Date: May 22, 2009 Review Date: Section I. PURPOSE II. AUTHORITY III. SCOPE IV. DEFINITIONS V. POLICY VI. RESPONSIBILITIES
retained in a form that accurately reflects the information in the contract or other record,
AL 2004 9 O OCC ADVISORY LETTER Comptroller of the Currency Administrator of National Banks Subject: Electronic Record Keeping TO: Chief Executive Officers of All National Banks, Federal Branches and Agencies,
Application / Hardware - Business Impact Analysis Template. MARC Configuration Requirements. Business Impact Analysis
Application / Hardware - Business Impact Analysis Template The single most important thing we can do is help you understand the criticality of each application, supporting hardware/server/pc and the required
Federal Financial Institutions Examination Council FFIEC. Business Continuity Planning BCP MARCH 2003 MARCH 2008 IT EXAMINATION
Federal Financial Institutions Examination Council FFIEC Business Continuity Planning MARCH 2003 MARCH 2008 BCP IT EXAMINATION H ANDBOOK TABLE OF CONTENTS INTRODUCTION... 1 BOARD AND SENIOR MANAGEMENT
AUDIT COMMITTEE OF THE TRUSTEES TEXAS PACIFIC LAND TRUST CHARTER
Amended and Restated: February 24, 2010 AUDIT COMMITTEE OF THE TRUSTEES OF TEXAS PACIFIC LAND TRUST CHARTER PURPOSE The primary function of the Committee is to assist the Trustees of the Trust in discharging
Charter of the Audit Committee of Asterias Biotherapeutics, Inc.
Charter of the Audit Committee of Asterias Biotherapeutics, Inc. This Charter was adopted by the Board of Directors (the Board ) of Asterias Biotherapeutics, Inc. (the Company ) on March 10, 2013. I. Purpose
2.0 ROLES AND RESPONSIBILITIES
2.0 ROLES AND RESPONSIBILITIES This handout describes applicable roles and responsibilities for the Capital Planning and Investment Process (CPIC) as presented in the NIST Integrating IT Security into
HOW CAN YOU ENSURE BUSINESS CONTINUITY? ISO 22301 AUDITS, CERTIFICATION AND TRAINING
HOW CAN YOU ENSURE BUSINESS CONTINUITY? ISO 22301 AUDITS, CERTIFICATION AND TRAINING ISO 22301 BUSINESS CONTINUITY MANAGEMENT SYSTEMS Most organisations will, at some point, be faced with having to respond
How to measure your business resiliency
How to measure your business resiliency Define the KPI s/kri s and scorecards to control your security and business continuity capabilities Krzysztof Pulkiewicz BCMLogic [email protected]
BOARD MANUAL. DATE: May 25, 2011 REVISED/REVIEWED: November 26, 2014
BOARD MANUAL SUBJECT: SECTION: Board Processes NUMBER: 2-D-18 APPROVED BY: Board of Directors DATE: May 25, 2011 REVISED/REVIEWED: Table of Contents 1. Recruitment and Selection of New Directors... 2 2.
Portal Storm: A Cyber/Business Continuity Exercise. Cyber Security Initiatives
Portal Storm: A Cyber/Business Continuity Exercise Cyber Security Initiatives Commonwealth of Pennsylvania Office of Administration Tony Encinias, Chief Information Officer Project Initiated: January 2013
Business Continuity Planning 101. +1 610 768-4120 (800) 634-2016 www.strohlsystems.com [email protected]
Business Continuity Planning 101 Presentation Overview What is business continuity planning Plan Development Plan Testing Plan Maintenance Future advancements in BCP Question & Answer What is a Disaster?
IT Security & Compliance Risk Assessment Capabilities
ATIBA Governance, Risk and Compliance ATIBA provides information security and risk management consulting services for the Banking, Financial Services, Insurance, Healthcare, Manufacturing, Government,
CRITERIA AND OPERATIONAL STANDARDS FOR WORKPLACE REHABILITATION PROVIDERS 2015
Safety, Rehabilitation and Compensation Act 1988 Sections 34D and 34E CRITERIA AND OPERATIONAL STANDARDS FOR WORKPLACE REHABILITATION PROVIDERS 2015 Pursuant to sections 34D and 34E of the Safety, Rehabilitation
SECURITY. Risk & Compliance Services
SECURITY Risk & Compliance s V1 8/2010 Risk & Compliances s Risk & compliance services Summary Summary Trace3 offers a full and complete line of security assessment services designed to help you minimize
Anti corruption and Anti money laundering A critical nexus
Anti corruption and Anti money laundering A critical nexus Counter Corruption Best Practices Increased Effectiveness through Interagency and Multi Sectoral Approaches Zagreb, Croatia 7 10 March 2011 Mr.
UNITED STATES DEPARTMENT OF AGRICULTURE FOOD SAFETY AND INSPECTION SERVICE WASHINGTON, DC INFORMATION SYSTEM CERTIFICATION AND ACCREDITATION (C&A)
UNITED STATES DEPARTMENT OF AGRICULTURE FOOD SAFETY AND INSPECTION SERVICE WASHINGTON, DC FSIS DIRECTIVE 1306.2 9/28/11 INFORMATION SYSTEM CERTIFICATION AND ACCREDITATION (C&A) I. PURPOSE This directive
Restaurant Brands International Inc. A corporation continued under the laws of Canada. Audit Committee Charter Originally adopted December 11, 2014
Overview Restaurant Brands International Inc. A corporation continued under the laws of Canada Audit Committee Charter Originally adopted December 11, 2014 Amended October 30, 2015 This Charter identifies
THE MANAGEMENT OF SICKNESS ABSENCE BY NHS TRUSTS IN WALES
THE MANAGEMENT OF SICKNESS ABSENCE BY NHS TRUSTS IN WALES Report by Auditor General for Wales, presented to the National Assembly on 30 January 2004 Executive Summary 1 The health and well being of the
NIST SP 800-34, Revision 1 Contingency Planning Guide for Federal Information Systems
NIST SP 800-34, Revision 1 Contingency Planning Guide for Federal Information Systems Marianne Swanson NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 1 Table Of Contents Introduction to NIST SP 800-34
Business Continuity Management and The Extended Enterprise
WHITE PAPER Business Continuity Business Continuity Management and The Extended Enterprise Continuous Availability in a Real-Time Economy Business Continuity is receiving a great deal of attention in the
Institute for Business Continuity Training 1623 Military Road, # 377 Niagara Falls, NY 14304-1745
ECP - 601: Effective Business Continuity Management: ISO 22301 This 3-day course provides an intensive, hands-on workshop covering all major aspects for the design of an effective Business Continuity Plan
The Procter & Gamble Company Board of Directors Compensation & Leadership Development Committee Charter
The Procter & Gamble Company Board of Directors Compensation & Leadership Development Committee Charter I. Purposes. The Compensation and Leadership Development Committee (the Committee ) is appointed
The Weill Cornell Medical College and Graduate School of Medical Sciences. Responsible Department: Information Technologies and Services (ITS)
Information Technology Disaster Recovery Policy Policy Statement This policy defines acceptable methods for disaster recovery planning, preparedness, management and mitigation of IT systems and services
6/8/2016 OVERVIEW. Page 1 of 9
OVERVIEW Attachment Supervisory Guidance for Assessing Risk Management at Supervised Institutions with Total Consolidated Assets Less than $50 Billion [Fotnote1 6/8/2016 Managing risks is fundamental to
Office of Finance Recruiting Process Guide for Hiring Managers
Office of Finance Recruiting Process Guide for Hiring Managers I. Recruiting Process Overview... 1 II. Step 1- Prepare to Hire... 1 III. Step 2- Strategy Session... 2 IV. Step 3- Position Posted and Candidates
Fundamentals of Risk Management Understanding, evaluating and implementing effective risk management
SECOND EDITION Fundamentals of Risk Management Understanding, evaluating and implementing effective risk management Paul Hopkin KoganPage LONDON PHILADELPHIA NEW DELHI CONTENTS List of figures xiv List
FFIEC Cybersecurity Assessment Tool Overview for Chief Executive Officers and Boards of Directors
Overview for Chief Executive Officers and Boards of Directors In light of the increasing volume and sophistication of cyber threats, the Federal Financial Institutions Examination Council 1 (FFIEC) developed
Service Organization Control (SOC) Reports Focus on SOC 2 Reporting Standard
Information Systems Audit and Controls Association Service Organization Control (SOC) Reports Focus on SOC 2 Reporting Standard February 4, 2014 Tom Haberman, Principal, Deloitte & Touche LLP Reema Singh,
FFIEC Cybersecurity Assessment Tool
Overview In light of the increasing volume and sophistication of cyber threats, the Federal Financial Institutions Examination Council 1 (FFIEC) developed the Cybersecurity Tool (), on behalf of its members,
,"ENT 0..- ~ -1-0. Q c. ;:* *1 ~ J U.S. DEPARTMENTOF HOUSINGAND URBAN DEVELOPMENT THEDEPUTYSECRETARY WASHINGTON, DC 20410-0050.
,"ENT 0..- ~ -1-0 Q c. ;:* *1 ~ J c.~.
The authority documents tracked by the UCF
audit standards are reasonable and customary standards in the industry. This safe harbor offers organizations the opportunity to reduce compliance risk by adopting the CobiT audit standards. However, there
I. The Role of the Board of Directors II. Director Qualifications III. Director Independence IV. Director Service on Other Public Company Boards
Corporate Governance Guidelines The Board of Directors (the Board ) of (the Corporation ) has adopted these governance guidelines. The guidelines, in conjunction with the Corporation s articles of incorporation,
VDC SLA Annex Additional Terms for Virtual Data Centre - SLAs
CONTENTS 1 Introduction... 2 2 Infrastructure Service Level Objectives... 2 2.1 Availability Calculation:... 2 3 Compute Platform... 2 3.1 Availability Service Level... 2 3.1.1 Availability Objectives...
Solihull Clinical Commissioning Group
Solihull Clinical Commissioning Group Business Continuity Policy Version v1 Ratified by SMT Date ratified 24 February 2014 Name of originator / author CSU Corporate Services Review date Annual Target audience
How To Manage A Disruption Event
BUSINESS CONTINUITY FRAMEWORK DOCUMENT INFORMATION DOCUMENT TYPE: DOCUMENT STATUS: POLICY OWNER POSITION: INTERNAL COMMITTEE ENDORSEMENT: APPROVED BY: Strategic document Approved Manager Organisational
VDC SLA Annex Additional Terms for Virtual Data Centre - SLAs
CONTENTS 1 Introduction... 2 2 Infrastructure Level Objectives... 2 2.1 Availability Calculation:... 2 3 Compute Platform... 2 3.1 Availability Level... 2 3.1.1 Availability Objectives... 2 3.1.2 Unavailability...
Personal Investment Services. Supported by an industry leader
Personal Investment Services Supported by an industry leader To respond to your changing investment needs, the financial services landscape is also changing. Investors like you are taking more responsibility
THE BOARD OF DIRECTORS OF THE DEPOSITORY TRUST & CLEARING CORPORATION MISSION STATEMENT
THE BOARD OF DIRECTORS OF THE DEPOSITORY TRUST & CLEARING CORPORATION MISSION STATEMENT The Board of Directors of The Depository Trust & Clearing Corporation ( DTCC or the Corporation ) is responsible
Review of Industry Trends & Forecasts
Review of Industry Trends & Forecasts!" # $% & ' ( ) "" (!% How many squares to you see? Answer? *+, -*./ *.0 #*12 Answer? *+, -*./ *.03 #*12 How many squares to you see? /4/5+.4.5/ 14152 +4+5+, Changing
Business Continuity Plan
Business Continuity Plan October 2007 Agenda Business continuity plan definition Evolution of the business continuity plan Business continuity plan life cycle FFIEC & Business continuity plan Questions
Best Practices in Disaster Recovery Planning and Testing
Best Practices in Disaster Recovery Planning and Testing axcient.com 2015. Axcient, Inc. All Rights Reserved. 1 Best Practices in Disaster Recovery Planning and Testing Disaster Recovery plans are widely
Birmingham CrossCity Clinical Commissioning Group. Business Continuity Management Policy
Birmingham CrossCity Clinical Commissioning Group Business Continuity Management Policy Version V1.0 Ratified by Operational Development Group Date ratified 6 th November 2014 Name of originator / author
BPA Policy 434-1 Cyber Security Program
B O N N E V I L L E P O W E R A D M I N I S T R A T I O N BPA Policy Table of Contents.1 Purpose & Background...2.2 Policy Owner... 2.3 Applicability... 2.4 Terms & Definitions... 2.5 Policy... 5.6 Policy
SAMPLE IT CONTINGENCY PLAN FORMAT
SAMPLE IT CONTINGENCY PLAN FORMAT This sample format provides a template for preparing an information technology (IT) contingency plan. The template is intended to be used as a guide, and the Contingency
Business Continuity Trends and Risk Considerations Financial Executives International Portland Chapter June 12 2013
Business Continuity Trends and Risk Considerations Financial Executives International Portland Chapter June 12 2013 Chitra Gopalakrishnan Director KPMG LLP Agenda Introduction Business Continuity / Disaster
Emergency Support Function 14 Long-Term Community Recovery and Mitigation
ESF Coordinator: Grant County Emergency Management Primary Agencies: Grant County Emergency Management Grant County Assessor s Office Grant County Public Works Grant County Building Department Support
Security Information Lifecycle
Security Information Lifecycle By Eric Ogren Security Analyst, April 2006 Copyright 2006. The, Inc. All Rights Reserved. Table of Contents Executive Summary...2 Figure 1... 2 The Compliance Climate...4
COMPENSATION AND CORPORATE GOVERNANCE COMMITTEE CHARTER
Name COMPENSATION AND CORPORATE GOVERNANCE COMMITTEE CHARTER There shall be a committee of the Board of Directors (the "Board") of Aurcana Corporation (the "Company") known as the Governance and Compensation
How to Design and Implement a Successful Disaster Recovery Plan
How to Design and Implement a Successful Disaster Recovery Plan Feb. 21 ASA Office-Administrative Section is Sponsored by Today s ASAPro Webinar is Brought to You by the How to Ask a Question Questions
Security Control Standard
Department of the Interior Security Control Standard Program Management April 2011 Version: 1.1 Signature Approval Page Designated Official Bernard J. Mazer, Department of the Interior, Chief Information
HIPAA COMPLIANCE AND DATA PROTECTION. [email protected] +39 030 201.08.25 Page 1
HIPAA COMPLIANCE AND DATA PROTECTION [email protected] +39 030 201.08.25 Page 1 CONTENTS Introduction..... 3 The HIPAA Security Rule... 4 The HIPAA Omnibus Rule... 6 HIPAA Compliance and EagleHeaps
SUPERVISORY AND REGULATORY GUIDELINES: PU19-0406 BUSINESS CONTINUITY GUIDELINES
SUPERVISORY AND REGULATORY GUIDELINES: PU19-0406 Business Continuity Issued: 1 st May, 2007 Revised: 14 th October 2008 BUSINESS CONTINUITY GUIDELINES I. INTRODUCTION The Central Bank of The Bahamas (
APPENDIX I. Best Practices: Ten design Principles for Performance Management 1 1) Reflect your company's performance values.
APPENDIX I Best Practices: Ten design Principles for Performance Management 1 1) Reflect your company's performance values. Identify the underlying priorities that should guide decisions about performance.