CRITICAL INFRASTRUCTURE BANKINGFINANCE SECTOR

1

• CRITICAL INFRASTRUCTURE BANKING/FINANCE SECTOR
• Mike Stamper, Bank Analyst
• Tracy Bergmann, Bank Examiner

2
CRITICAL INFRASTRUCTURE

• National Infrastructure Protection Plan

3
Business Continuity Plan

• Examiner Expectations
• Each institution should have a Business
  Continuity Program (BCP).
• Programs will vary based on the organizations
  size, complexity, and risk profile.

4
Business Continuity Plan

• An effective Business Continuity Plan (BCP) will
  include four elements
• Plan/Policy
• Training
• Testing
• Auditing

5
Business Continuity Plan

• Plan/Policy should address the following at a
  minimum
• Define clear lines of authority.
• Board and senior management oversight.
• Identify various threats presenting risk to the
  institution (e.g. - fire, flood, robbery, power
  disruption) along with reactionary procedures.
• Contact information for critical vendors,
  emergency personnel, regulators, and employees.
• Include a supply list.
• Back-up and restoration of critical systems.
• Testing, training, and auditing considerations.

6
Business Continuity Plan

• Training
• Should be performed on at least an annual basis
  to ensure employees know how to respond in the
  event of a threat occurring.
• Include all levels of staff.
• A current copy of the plan should be readily
  available to all employees.
• Members of senior management should maintain a
  copy of the plan offsite.

7
Business Continuity Plan

• Testing
• Should be performed on at least an annual basis
  to measure the overall effectiveness of the plan.
• This includes the testing of the backup tapes.
• Testing methods will range from table top
  discussions to walking through mock disaster
  situations.
• Management should also document any real life
  events that test the implementation and adequacy
  of the plan.
• Lessons learned should be incorporated into the
  plan.

8
Business Continuity Plan

• Auditing should address the following
• Assess the adequacy and accuracy of the
  information contained within the plan and
  attachments.
• Verify employees have access to the plan.
• Training has occurred and covers all departments
  and facets of the operation.
• Annual testing has been done and documented.
• Verify contracts have been established for backup
  arrangements.
• Ensure that the Board of Directors have
  reviewed/approved the plan, testing, training,
  and has been documented in the minutes.

9
Business Continuity Plan

• Reference Material
• FFIEC Business Continuity Planning (BCP) IT
  Examination Handbook March 2008
• www.ffiec.gov