10-Form J -BCDR Questionnaire v2.0.pdf

FORM J

BUSINESS CONTINUITY/DISASTER RECOVERY QUESTIONNAIRE

Page 1of 2 Form J – Business Continuity/Disaster Recovery Questionnaire

Revised March 2020

Respondent Name:

The following are standard questions for collecting Business Continuity/Disaster Recovery (BC/DR) information; they allow the OAG to evaluate a vendor’s internal recovery strategies, plans , and overall BC/DR program.

No. Question Answer Required Information

1 Is your organization’s BC/DR program regulated and/or audited by any regulatory agency (e.g., FFIEC, SEC, FINRA, OTS, OCC, State Regulators, etc.)?

☐ Yes

Provide regulatory agency name.

☐ No

Proceed to No. 3.

2 In your organization’s most recent exam, have the findings of any regulatory agency resulted in an overall “Unsatisfactory” or “Needs

Improvement” rating?

☐ Yes

Provide regulatory agency name and findings, and remedial action.

☐ No

Proceed to No. 3.

2a If so, have the findings been appropriately mitigated?

☐ Yes

☐ No

3 Within the past year, has your organization’s BC/DR program been evaluated by an internal audit and/or an independent external third party?

☐ Yes

☐ No

Proceed to No. 4.

3a If so, did any findings require corrective action?

☐ Yes

☐ No

Proceed to No. 4.

3b If so, have the corrective actions been implemented?

☐ Yes

☐ No

4 Does your organization have a written policy for BC/DR?

☐ Yes

☐ No

5 Does your organization’s BC/DR plan have senior management approval and sponsorship?

☐ Yes

☐ No

Explain.

6 Does your organization have a formal governance body for

BC/DR?

☐ Yes

☐ No

FORM J

BUSINESS CONTINUITY/DISASTER RECOVERY QUESTIONNAIRE

Page 2of 2 Form J – Business Continuity/Disaster Recovery Questionnaire

Revised March 2020

No. Question Answer Required Information

7 Does your organization have a designated individual or group responsible for oversight and administration of the BC/DR program?

☐ Yes

☐ No

8 Is your organization’s BC/DR plan reviewed and updated at least annually?

☐ Yes

☐ No

9 Does your organization conduct a periodic review of the BC/DR program with senior management to consider changes in organization, technology, processes, and environmental and regulatory factors?

☐ Yes

☐ No

10 Does your organization conduct a periodic review of the BC/DR program with senior management to consider the adequacy of support resources (people, technology, facilities, and funding)?

☐ Yes

☐ No

11 Are there provisions in your organization's BC/DR plan to ensure that critical third parties/suppliers performing under the contract are capable of supporting BC/DR plans and testing objectives?

☐ Yes

☐ No

12 Identify any business disruptions that your organization anticipates would cause an exception to your current planned recovery strategies (e.g., large scale regional flooding, large scale regional telecommunications failure affecting the internet)