WIXLIB

TheDefinitiveGuide forBanksMaintaining Operations Before, During, and After an Incident 2019 - Agility Recovery,All Rights Reserved.

Banks: Maintaining Operations Before, During, and After an IncidentTable of Contents1.How Safe is Your Bank?32.Assemble a Disaster Recovery Team43.Create Your Disaster Recovery Plan64.Test, Fine-tune, and Retest Your Disaster Recovery Plan75. 10 Ways a Disaster Recovery Solutions Provider CanHelp You With Testing96.What is a Go-Bag?107.Regulatory Compliance and Disaster Recovery118. Lessons From Major Hurricanes: How to Protect Yourselffrom the Next Weather Disaster129.13Testing and Preparedness are the Keys to SurvivalThe only integrated business continuity solution in the market that helps you Plan, Train, Test, Alert, and Recover—all in one.Copyright 2019 - Agility Recovery, All Rights Reserved.2

Banks: Maintaining Operations Before, During, and After an Incident1. How Safe is Your Bank?Think back to August 17th, 2017. That’s the dayHurricane Harvey first reached tropical stormstatus in the Atlantic and became the 8thnamed storm of the season. By the time it finallywas downgraded to a tropical depression onAugust 30th, it had spread devastation acrossTexas & Louisiana, rivaling the most costly stormin US history by accumulating an estimatedEstablish Disaster RecoveryProtocolsTo enable your bank to conduct critical businessfunctions before, during and after a disaster, establishthe following basic disaster recovery protocols:Assemble a disaster recovery team 190 billion in damage.Create a disaster recovery planHundreds of financial institutions were out of operationfor days, some of them weeks. If your bank came to ahalt as a result of a hurricane or any other disaster, yourealize the importance of business continuity. Beingable to maintain operations through any disruptionprovides uninterrupted service to your clients. If yourbank has never been stopped in its tracks by a majordisaster, or even a minor incident, you’re very fortunate.But what about the future?Test, fine-tune and retest your disasterrecovery planParticularly in today’s world of increased cybersecurityrisk, it is critical to identify the gaps in your businesscontinuity plan and determine how you can close thosegaps before a disaster strikes. In addition, SarbanesOxley requires business leaders to ensure that internalcontrols will protect the organization from fraud. If partsof your infrastructure are down, that can be a difficultpromise to fulfill.Regularly examining and testing your disaster readinesswill help your bank be prepared for any kind ofdisruption. It will also ensure that you can bring systemsback online quickly and efficiently.The only integrated business continuity solution in the market that helps you Plan, Train, Test, Alert, and Recover—all in one.Copyright 2019 - Agility Recovery, All Rights Reserved.3

Banks: Maintaining Operations Before, During, and After an Incident2. Assemble a DisasterRecovery TeamGet your employees involved in the disaster responseplanning process. Let them know you’re ready forwhatever crisis may occur and build buy-in to a cultureof preparedness. Together, you can design a planto accommodate challenges the team might facein a disaster.Responsibility of the Disaster Teamguidance, oversight and approval of Provideresources for the continuity program.the implementation and routine testing of Facilitatethe program.collaboration and buy-in across Ensureall departments. Execute the plan should the need arise.The only integrated business continuity solution in the market that helps you Plan, Train, Test, Alert, and Recover—all in one.Copyright 2019 - Agility Recovery, All Rights Reserved.4

Banks: Maintaining Operations Before, During, and After an IncidentThe following list of disaster recoveryresponsibilities will get you started in identifyingwho should be involved:ENSURING OFFICE & PERSONNELSAFETY AND SECURITYResponsibilities may include evaluatingbuilding integrity and safety, facilitatingcleanup, or stocking and carrying the“go bags.”DATA ACCESS AND INTEGRITYResponsibilities may include maintainingconnectivity to your core processor andensuring local server/cybersecurityprotection or activating redundantdata center.CRISIS COMMUNICATIONSResponsibilities may include initiating anemployee call chain or alert notificationprotocol, or communicating withstakeholders (e.g., leadership, partners,suppliers, members, and the media).When assembling your team, it’s important to includemembers from all departments of the organization.Downtime after a disaster affects departments invarious ways. Involving all teams allows for equalconsideration of priorities and critical tasks, as well asprotects any significant inter-dependencies.The first step is to invite every department head to aninitial meeting. At this discovery session, make a listof all the responsibilities needed to maintain criticalbusiness functions (activities that are vital to yourorganization’s survival) during a disaster. Do not attemptto incorporate all departmental functions, only thosemost significant to the tasks necessary following amajor event.Once you have established all the responsibilitiesrequired, assign each task to one or more employeesto create redundancy. For some technical tasks, suchas restoring access to data, responsibilities will closelymatch a person’s current title and job descriptionwithin the company. Other functions, such as beingpart of a call chain, can be assigned to a variety of staffmembers. Take the time to cross-train any personnelyou may rely on for alternative responsibilities in a crisis.FINANCIAL OVERSIGHTResponsibilities may include calculatinghow much cash will be needed forincreased transactions as well asincidentals like supplies, food/water,transportation, repairs, temporary lodgingand replacement assets.The only integrated business continuity solution in the market that helps you Plan, Train, Test, Alert, and Recover—all in one.Copyright 2019 - Agility Recovery, All Rights Reserved.5

Banks: Maintaining Operations Before, During, and After an Incident3. Create Your DisasterRecovery PlanOnce every responsibility is outlined, write a step-bystep disaster recovery plan. Your plan should spell outwho is in charge of different recovery processes, firstactions to consider, and how to quickly evaluate andescalate needs.Begin by considering the most important functionswithin your organization, and develop plans andstrategies for protecting each from the top risks posedto your organization. Discuss how to prevent failurein each area, or if that is not possible, what it wouldtake to bring each service or area back online quicklyand efficiently.A Good Disaster Recovery Plan Will:1. Establish who will be on the recovery team as wellas detailed descriptions of their responsibilities.Include at least two ways of contacting eachmember of the team.2. Demonstrate information on all exits and alternativeways of evacuating your building, procedures forsheltering-in-place, and the location of go-bags withdescription.3. Determine how your organization’s critical functionswill continue to operate immediately after anincident. This may include functioning with reducedstaff, replacing compromised systems, offeringpartial services, relocating staff and operations,communication protocols, and mitigation orrecovery procedures.4. Establish how actual recovery logistics will proceedin terms of precisely outlining and adhering totimelines, decision points and verified procedures.5. Detail the required resources needed for mitigationand recovery. You’ll want to consider what resourcesare required for restoration of basic services such as: Office Space Power Applications Data Unique assets IT network& hardware Employees/staff/partners/suppliers Communications(telephone, internet,fax, etc.) Other: Restroomfacilities, HVAC,food/water, etc.6. Outline the Emergency Plan procedure. Who hasthe ability to declare the disaster or put the planinto action?The only integrated business continuity solution in the market that helps you Plan, Train, Test, Alert, and Recover—all in one.Copyright 2019 - Agility Recovery, All Rights Reserved.6

Banks: Maintaining Operations Before, During, and After an Incident4. Test, Fine-tune, and Retest YourDisaster Recovery PlanTesting your disaster recovery plan is not only anessential part of planning, but a step that could meanthe difference between giving in to a crisis and survivingone. Testing or exercising your plan should be a gradualand continual process.A Good Test Will1. Use realistic scenarios based on identified risks toyour organization2. Meet compliance or regulatory requirements3. Increase employee, management, and communityconfidence in the plan This includes setting realistic expectations forresponse team members4. Expose holes, gaps, misperceptions, or otherpotential failures of the plan5. Be conducted both with and without notice Announced drills are learning exercises that allowemployees to walk through actions they are trainedand expected to take during an emergency Unannounced drills provide the most accurateindication of what will occur during actual crisisconditions (when performed safely!)6. Improve your overall readiness and reducerecovery timeThe only integrated business continuity solution in the market that helps you Plan, Train, Test, Alert, and Recover—all in one.Copyright 2019 - Agility Recovery, All Rights Reserved.7

Banks: Maintaining Operations Before, During, and After an IncidentHold regular walk-throughs of building emergencyexits, and conduct drills for both shelter-in-place andworkplace violence scenarios, as well as buildingevacuations. More elaborate and comprehensivetesting can be facilitated in one of three places: at yourfacility, at your off-site backup center, or at a disasterrecovery-partner testing site. You can choose to doa table-top meeting-style run through or a full-scalehands-on test, using canned or live data and a varietyof scenarios.Business continuity planning is an ongoing process,and testing is a critical step in continually assessingand improving the strategy as your organization growsand evolves. Your testing process should run in acontinual loop:When you’re running a test, make sure to take notesduring the exercise. What was the task or issue? Whenwas it started/identified? Was it resolved? How? Whatproblems arose? Review the findings with participantsand then update and distribute your written plan,making sure to write down notes for considerationon your next test.Remember: A successfultest is not necessarily onethat runs flawlessly, butan exercise that allowsyou to identify failuresand therefore improveyour plan and increaseyour ability to servemembers after a disaster.We recommend that you do a full-scale testannually for a wide range of critical functions,including access to electricity, water, gas, facilities,staffing, technology, telecommunications andmore, not only to survive, but to thrive in anyunexpected situation.The only integrated business continuity solution in the market that helps you Plan, Train, Test, Alert, and Recover—all in one.Copyright 2019 - Agility Recovery, All Rights Reserved.8

Banks: Maintaining Operations Before, During, and After an Incident5. 10 Ways a Disaster RecoverySolutions Provider Can HelpYou With TestingDetermine priorities and objectives and buildoutcomesSimulate real-time business transactionsResolve discrepanciesConduct a server rebuild and restorationTest all aspects of your recovery operationTest network connections, & buildredundancy in your systemsEvaluate how much generator poweris neededPractice reconnecting to your coreDetermine realistic recovery timeframesTest a mobile office setupThe only integrated business continuity solution in the market that helps you Plan, Train, Test, Alert, and Recover—all in one.Copyright 2019 - Agility Recovery, All Rights Reserved.9