Business Continuity - WesPay · 2018-09-18 · Business continuity management includes three key layers and a crisis communication process. Business Resumption Planning The process

THE PAYMENTS INSTITUTE — July 22-25, 2018

Emory Conference Center Hotel, Emory University, Atlanta, Georgia

Nell Campbell-Drake, VPRetail Payments Office

Federal Reserve Bank of Atlanta

Business Continuity Are You in Shape to Handle that

Unexpected Event?

2017 Natural Disasters

California Wild Fires

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwiZgeOFgaDcAhUPm-AKHZR0Cb0QjRx6BAgBEAU&url=https://www.surreynowleader.com/news/b-c-hits-1003-wildfires-in-2017/&psig=AOvVaw1WvfHT5L1KlFhS0e28wYrO&ust=1531706265181003


Mexico Earthquakes

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=2ahUKEwil4M6Eg6DcAhXvY98KHczZCpAQjRx6BAgBEAU&url=https://ec.europa.eu/jrc/en/news/atlas-human-planet-2017-how-exposed-are-we-natural-hazards&psig=AOvVaw2mAxPw725pTTSqYd2Owkde&ust=1531706894420501


U.S. Hurricanes

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwiWqZ_KgqDcAhUONd8KHWBBCeoQjRx6BAgBEAU&url=https://www.forbes.com/sites/quora/2017/10/03/are-we-seeing-an-unusual-number-of-natural-disasters-in-2017/&psig=AOvVaw0Sr9FBi5mfaZ6pd-6J2Pj8&ust=1531706768232889


Metro City Flooding

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=2ahUKEwjio_eJhKDcAhUOZd8KHQgGAzcQjRx6BAgBEAU&url=http://safetysolutionsng.com/preparing-for-natural-disaster/&psig=AOvVaw0VxsnbQhej42XHeIZZp-ss&ust=1531707121701524

2017 Infrastructure Disasters

Mero Atlanta

Highway Collapse

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=2ahUKEwijxJCMhaDcAhVldt8KHbtDAn4QjRx6BAgBEAU&url=https://www.bizjournals.com/atlanta/news/2017/04/21/i-85-bridge-contractor-could-get-3-1-million-for.html&psig=AOvVaw0uMgew06G4bTEmrhX-pxCz&ust=1531707423385488

Malware found on servers that

processed payments mage at

onsite restaurants and bars

Weak point in website software

that exposed sensitive data of over

143M consumers (i.e. social

security numbers, drivers license

numbers

Exposed customer information

in plain text on website (i.e.

email addresses, phone

numbers, IP addresses

Phishing scam seeking to gain

access to accounts through a

third party app

IRS data retrieval tool hacked

impacting approximately 100K

taxpayers with personal

information potentially stolen

2017 Data Breaches

© 2018 - Materials are not to be used without consent. 7

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=2ahUKEwit987uh6DcAhXuRd8KHV0LBAYQjRx6BAgBEAU&url=http://www.brandsoftheworld.com/logo/equifax&psig=AOvVaw1shrAuVHL2ctjxgaHnC4Zn&ust=1531708201505589

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=2ahUKEwj6maSQiKDcAhWwneAKHUXMDYYQjRx6BAgBEAU&url=https://www.forbes.com/companies/intercontinental-hotels-group/&psig=AOvVaw0ULcimR1sX2PAaFZSc6IWB&ust=1531708270402354

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=2ahUKEwjTqJm9iKDcAhUISN8KHbxNDCkQjRx6BAgBEAU&url=https://commons.wikimedia.org/wiki/File:Saks_Fifth_Avenue_Logo.jpg&psig=AOvVaw2plU9AICYycMbjcTH_iKWQ&ust=1531708331559937

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=2ahUKEwic_IbciKDcAhUCVN8KHRyWBy0QjRx6BAgBEAU&url=http://www.ecschools.net/News/fafsa-deadline-extended&psig=AOvVaw0-yelLYzUjdE2eLF4vfSKN&ust=1531708431080834

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwiohI3diqDcAhXRTd8KHTuxDfEQjRx6BAgBEAU&url=http://logos.wikia.com/wiki/Gmail&psig=AOvVaw07pPRMqj_o4ODLTf1QC2FB&ust=1531708964084166

Make something happen

When an unexpected situation occurs, what

position do you want to be in?

Wait for something to happen

Wonder what happened


https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=0ahUKEwjz4Nn29drNAhWKVD4KHXc2AnIQjRwIBw&url=https://www.recruiter.com/i/when-it-isnt-smart-to-keep-someone-waiting-2/&psig=AFQjCNGAf7TkkYX6ewwCxFFPiZluXXPV6A&ust=1467759916965253

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjH6Z3n9trNAhUDWD4KHXIeCJ4QjRwIBw&url=http://www.dwconsultants.com/&bvm=bv.126130881,d.cWw&psig=AFQjCNFMzhhZ_c_3vCM43tel7HPEmwmNhg&ust=1467760147418499

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwikv6qx99rNAhUIyj4KHYEYBWQQjRwIBw&url=http://scottpublicrelations.com/ten-mind-blowing-statistics-that-will-change-how-you-sell/&bvm=bv.126130881,d.cWw&psig=AFQjCNF2U3aayTNzc4223mhilmzsOP4ibQ&ust=1467760252926173

• Business Continuity Management Process

• Components of Business Continuity Plan

• Getting Started

• Readiness Process

• Risk Assessment Process

• Key Indicators

• Social Media

Content


Business continuity management includes three

key layers and a crisis communication process.

Business Resumption Planning

The process initiated to resume

business operations to a level

consistent with the business

requirements.

IT Disaster Recovery Planning

The recovery of information

technology processes, systems,

applications, databases, and

network assets used to support

critical business processes.

Crisis Management:

A series of actions taken to gain control

of the event quickly to minimize the

affects of an interruption and prepare

for recovery.


Components of a Business Continuity Plan


So, what’s included in a business continuity plan?

© 2018 - Materials are not to be used without consent.

Overall ProgramBusiness Impact assessment

Threat and Risk Assessment

Documentation Update Schedule

Test/Training

Follow-up/Action Items

Business ResumptionBusiness Resumption Plans

Contact Lists

Mock Exercises

Alternate Site Contacts

Technology

IT Disaster RecoveryIT Recovery Plans

Contact Lists

Disaster Recovery Strategy

Disaster Recover Test Scripts

Crisis ManagementCrisis Management Team

Crisis Management Plan

Contact Lists

Mock Exercises

12

• Succession plan for senior executives

• Location of evacuation plans

• Alternate means of communication

• Partnerships with local emergency response teams

• List of critical equipment, vital records and back-up data location(s)

• List of vendors/suppliers, along with emergency contact information

A few supreme basics in a business continuity

plan


Getting a Business Continuity Plan Started


• Identifies the organization’s most crucial systems and process and the effect a service disruption will have on the business

Business Impact Analysis

• Defines the organization’s focus in handling key business matters during disruptions from man-made to natural disasters

Mission Statement

How to get started in creating a business

continuity plan


Business Impact

Analysis

THREE key steps in completing a Business Impact

Analysis

Step 1 Identify the business activities of your organization

Step 2 For each activity, assess what the realistic timeframe is before

there would be an impact if the activity could not be performed

Step 3 For each activity, assess what the realistic impact is against

prescribed factors if that activity could not be performed


Mission Statement

FOUR questions to help in creating a great Mission

Statement

1. What do we do?

2. How do we do it?

3. Whom do we do it for?

4. What value are we bringing?


Readiness and In Action


Planning People Partnerships Practice

Coordinator

Impact Analysis

Impact Needs

File Back-Up

Trigger Points

Communication

Employee Welfare

Education

Business Partner

Community

Partner

Test, Test, Test

The Four “P’s in a Pod to readiness


Planning

Network Recovery Timeline

Equipment

Alternate Location

Emergency Center

Work Area

Mobile Site

Recovery Time

Recovery Point

Readiness points for “Back in Action”


A Look into the Risk Assessment Process in

Creating a Business Continuity Plan


Potential Enterprise Risk Factors:

Operational risk

Revenue risk

Systemic risk

Technical risk

Reputational risk

Good will risk

Personal safety risk

Risk Factors


http://www.google.com/url?sa=i&rct=j&q=&esrc=s&frm=1&source=images&cd=&cad=rja&uact=8&ved=0CAcQjRw&url=http://www.talkoutloud.info/how-do-you-feel/anger.aspx&ei=gP-SVZuhHcuqgwS-s5HYBg&bvm=bv.96783405,d.eXY&psig=AFQjCNHsDKHpUBag67DI9bnUoyeTihj_fA&ust=1435783396766870

External factors that can potentially create “Enterprise Risks”:

Natural disasters

Failure of business partners

Vendor/supplier debacles

Public utility challenges

Transportation problems

Telecommunication challenges

Nooooooo….

Risk Factors


http://www.google.com/url?sa=i&rct=j&q=&esrc=s&frm=1&source=images&cd=&cad=rja&uact=8&ved=0CAcQjRw&url=http://learning4education.blogspot.com/2010/08/5-signs-you-can-not-control-anger.html&ei=sAOTVd7sL8yrNu-duqAC&bvm=bv.96783405,d.eXY&psig=AFQjCNEtkQPzdx7gKWWYIV2lP74HCN1u0g&ust=1435784482133987

Key Indicators and Their Importance in the

Planning Process


Performance and Risk indicators are key

components of business continuity

management processes to aid in

establishing specific metrics for analyzing a

credible business continuity/disaster

recovery plan.

Key Performance Indicators

(KPI) – measures how well

something is being done

Key Risk Indicators (KRI) –measures possibility of future

adverse impacts

KPI versus KRI


http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwitie2GiNvNAhWCWD4KHb-xCrIQjRwIBw&url=http://www.federalsignal-indust.com/products/status-indicators&bvm=bv.126130881,d.cWw&psig=AFQjCNHGKiD0GmMsGPzO1QzRyYVmYU6zYA&ust=1467764716757771

Key Risk Indicator - KRI

Categories

of Risks

Disruptors

Technology

Demographics

Regulatory

Operational

StrategicDemand shortfalls

Competition

Management change

Regulation

OperationalIT issues

Supply-chain issues

Employee fraud

Non-compliance

ExternalWeather issues

Partnership issues

Legal matters

Industry crises

FinancialAsset losses

Liquidity crises

High interest rates

Improper forecasting

Components of the KRI process


Objectives for testing the plan –

1. Familiarize staff with content of the plan

2. Evaluate the clarity of the plan

3. Ensure details of the plan are accurate

4. Identify any vulnerabilities

5. Ensure external stakeholders are familiar with components of the plan

6. Ensure resources stored off-site are accurate and sufficient

7. PRACTICE MAKES PERFECT!

People

Process

Technology

Is there really a need to test the plan?


Social Media Component


• Social Media Uses

– Marketing and advertising

– Customer support

– Press communications

– Employee communications

– Information gathering

• What to include

– Goals for social media

– Social media recovery guidelines

– Success measurements

Role of social media in business continuity

© 2018 - Materials are not to be used without consent.

29

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjmm__jidvNAhXLcD4KHTMaBQIQjRwIBw&url=http://www.flow20.com/importance-of-social-media-for-any-business/&bvm=bv.126130881,d.cWw&psig=AFQjCNHV55IRpOWZps4X0bVsm6yDpmDOkQ&ust=1467765204681074

• Identify community/platforms of interest

• Listen to the conversation

• Identify influencers, ambassadors and advocates

• Identify adversaries and critics

• Look for cycles, patterns and keywords

Key points for engagement in social media


Wrap-Up: Lifecycle


Here’s a LIFECYCLE to remember!

Know Your Business

Assessment

Develop Your Plan

Planning

Implement Your Plan

Execution

Maintain Your Plan

Practice


So, get ready to stay ready!

Make, Wait or Wonder – it’s your call!



http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwid5qa5obHUAhVn5oMKHaxEA_YQjRwIBw&url=http://www.desicomments.com/desi/thank-you/page/3/&psig=AFQjCNGk2OlBx-OQ1Gy1qnq4ej3eLbMWgg&ust=1497110175575079

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjHkOq9m5bSAhWI54MKHQ73A5kQjRwIBw&url=http://granitegrok.com/blog/2013/07/republican-vote-stealer/attachment/question-mark&psig=AFQjCNGnrGxX1zWkwplYVmj0Mj-V8d6FCg&ust=1487389406500228

Documents

Business Continuity - WesPay · 2018-09-18 · Business continuity management includes three key layers and a crisis communication process. Business Resumption Planning The process