Assessing Your Disaster. Andrews Hooper Pavlik PLC. Andrews Hooper Pavlik PLC

Transcription

1 Assessing Your Disaster Recovery Plans Gregory H. Soule, CPA, CISA, CISSP, CFE Andrews Hooper Pavlik PLC Andrews Hooper Pavlik PLC

2 Agenda Business Continuity Concepts Impact Analysis Risk Assessment Risk Management Testing Annual Review Resources

3 Agenda Business Continuity Concepts

4 Concepts Business Continuity vs. Disaster Recovery Broader than just technology Emergency response planning Crisis management Pandemic planning Incident response planning

5 Concepts Sources: Federal Financial Institution Examination Council (FFIEC) Business Continuity Planning Booklet National Institute of Standards and Technology (NIST) SP rev 1 Contingency Planning Guide

6 Concepts FFIEC BCP Booklet Specifies a cyclical, process-oriented approach to Business Continuity Planning Business Impact Analysis Risk Assessment Risk Management Risk Monitoring and Testing

7 Concepts NIST SP rev 1 Specifies a seven-step lifecycle Develop contingency planning policy statement Conduct business impact analysis Identify preventative controls Create contingency strategies Develop an info system contingency plan Ensure plan testing, training, and exercises Ensure plan maintenance

8 Concepts Business Impact Analysis Risk Assessment Risk Management Interdependencies BCP Components Plan Testing Annual Review

9 Agenda Business Impact Analysis \

10 Business Impact Analysis Purpose: Determine the impact that t a disruptive event would have on the bank. Goals: Determine Criticality Estimate Maximum Downtime Evaluate Resource Requirements

11 Business Impact Analysis Determine Criticality: Inventory of business functions and processes Assign priority ratings to business functions and processes Identify interdependencies among processes Identify the impact of non-specific disruptions on business processes Consider legal and regulatory requirements

12 Business Impact Analysis Estimate Maximum Downtime Maximum tolerable downtime while still maintaining viability How long can the business process be disrupted before recovery becomes impossible? Consider dependencies and critical path Recovery Time Objectives (RTOs) Recovery Point Objectives (RPOs)

13 Business Impact Analysis Evaluate Resource Requirements What is required to resume critical operations (and interdependencies) Facilities Personnel Equipment Software / Data Files Third Parties

14 Business Impact Analysis Four Cyclical Steps Gather information Perform vulnerability assessment Analyze information Document results

15 Business Impact Analysis Gather Information Who does what and how? Departmental and Enterprise-wide Interrelationships Critical operations / processes Start to establish processing priorities Start to establish alternate procedures

16 Business Impact Analysis Vulnerability Assessment Potential impact of disruptive events Loss criteria: Quantitative or Qualitative Identify internal and external threats Estimate likelihood Assess impact Assess internal and external resources available to handle the threatst

17 Business Impact Analysis Analysis Consider all information gathered Estimate max downtime for each function/process Nonessential 30 days Normal 7 days Important 72 hours Urgent 24 hours Critical minutes to hours

18 Business Impact Analysis Analysis Identify highest priority business functions Establish RTOs and RPOs Establish recovery priorities Consider the impact of an event, rather than an event itself

19 Business Impact Analysis Results Summarize all activity performed Report to board and senior management

20 Agenda Risk Assessment \

21 Risk Assessment Evaluate BIA assumptions against various threats Assess impact and probability Assess resulting severity Align assessed threats with prioritized business processes Perform gap analysis for recovery Current state vs. needed state

22 Risk Assessment Threat Categories Malicious activity Fraud, theft, blackmail, sabotage, vandalism, terrorism Natural disasters Fire, floods, water damage, weather, air contaminants, hazardous spill

23 Risk Assessment Threat Categories Technical disasters Communications failure, customers, employees, electronic payment system providers, third parties, affiliates, power failure, equipment and software failure, transportation system disruptions, water system disruptions

24 Agenda Risk Management \

25 Risk Management Develop, implement, maintain the BCP Critical BCP success factors: Based on BIA and risk assessment Documented in a written program Reviewed by board and management annually Disseminated to applicable employees Specific implementation parameters Focused on impact vs. specific events

26 Risk Management Example of impact vs. specific events Citi Critical personnel are not available and cannot be contacted vs. airplane crash Buildings are not accessible vs. tornado Equipment has malfunctioned vs. flood damage Utilities are not available vs. ice storm Assumptions Access to buildings, personnel, technical staff, communication systems

27 Risk Management External Components Heightened importance Reliance on third parties Coordination Mitigation Strategies Redundancy, backups, alternate power sources Additional inventory supplies, equipment, etc

28 Interdependencies Telecommunications Single point of failure (SPOF) Multiple vendors, subcontract Vendor reliance Vendor BCP Contracted BCP Staffing, supplies Facilities, hardware, software

29 Interdependencies Internal Dependencies Departments t and processes Workflow analysis Technology dependencies Network Database Personnel Records and data

30 Agenda BCP Components \

31 BCP Components Strategy definition Personnel, Communication, Technology, Facilities, Liquidity, etc Identify goals of BCP Short term vs. long term BCP goals

32 BCP Components Personnel Preparing employees Management decision making Employee / family matters Communications / contact trees Vendor contact Security

33 BCP Components Personnel Employee training i documentation ti Staffing Creation of BCP Teams Communication Communication systems redundancy External communications Media relations

34 BCP Components Technology Hardware, Software, Data files, operations equipment Split operations (active/active) Hot site (mirroring) Virtualization Warm site Cold site Tertiary (back up of the back up)

35 BCP Components Technology Service bureaus Consider ability to provide services during widespread disasters dsases Reciprocal agreements Due diligence

36 BCP Components Technology Backups Structure t and strategy t Network data Core files Operating system software, application software Databases, utilities Primary location vs. branch locations Documented procedures and testing Off-site storage

37 BCP Components Facilities Relocate employees and workspaces Electronic banking systems Internet banking, cash management, mobile Off-site storage Purchase authority Manual procedures

38 Agenda Testing \

39 Plan Testing Board and Senior Management involvement Departmental testing Department managers Information technology Facilities Crisis management Continuous cycle Planned vs. Unplanned

40 Plan Testing Testing strategy and plan Staffing Succession Technology Backup integrity it System restoration Facilities Power, HVAC, relocation

41 Plan Testing Communications Test scripts Assumptions Staff availability Objectives Procedures

42 Plan Testing Types of tests Tabletop exercise Simulation test Parallel test Full-scale test Documentation!

43 Agenda Annual Review \

44 Annual Review At least annually Based on test results, changes to environment Issue tracking Changes to BCP and test program Distribution

45 Agenda Resources \

46 Resources National Institute of Standards and Technology Computer Security Resource Center Federal Emergency Management Agency

47 Resources Ready Campaign FFIEC

48 Questions? \

49 Contact Information Gregory H. Soule CPA, CISA, CISSP, CFE Senior Manager Andrews Hooper Pavlik PLC 691 N. Squirrel Road, Suite 280 Auburn Hills, MI p: f: e: com

50 Thank You \ This presentation was produced in connection with an educational and informational program. It represents the statements and views of the author(s) alone and does not necessarily represent the official policies or positions of Andrews Hooper Pavlik PLC, its partners, or any sponsor of this program. This presentation is not intended to be, nor should it be construed as constituting tax, accounting, auditing, security, or consulting advice with regard to specific cases, transactions, or situations used by the author(s). Any specific products, services, or organizations mentioned are provided purely for example purposes and do not represent specific endorsement. As required by IRS rules although this presentation may address certain tax issues the presenter did not intend nor design the As required by IRS rules, although this presentation may address certain tax issues, the presenter did not intend nor design the advice to be used to avoid any penalty imposed by a taxing authority, nor may the user/recipient of this presentation use this presentation s tax advice for that purpose. Nor may it be used to promote, market or recommend to another party any transaction or matter addressed herein.