ESBD_365992_1719871044838_Attachment B- Business Continuity Disaster Recovery Questionnaire.pdf

Form I SAVNS RFO Page 1 of 10

FORM I

Respondent Business Continuity Disaster Recovery Questionnaire

Respondent Name:

Explanations

Business Continuity/Disaster Recovery (BC/DR) is one of the areas that is currently a part of the total award process for this solicitation. The questions below are standard for collecting BC/DR information from vendors in order for us to evaluate a vendor’s internal recovery strategies, plans and overall BC/DR program. The questionnaire has been developed based on regulatory requirements and business continuity best practices.

1.0 Overall Program Management, Policy, Strategy, and Governance

1.1 Is your BC program regulated and/or audited by any regulatory Agency?

(e.g., FFIEC, SEC, FINRA, OTS, OCC, State Regulators, etc.)

If No, go to question 1.3

1.2

1.2a

1.3 Has an “internal audit” type function and/or independent external third party evaluated your BC/DR Program within the past year?

1.3a If so, did Internal Audit have any findings requiring corrective action?

1.3b If so, have the corrective actions been implemented?

1.4 Does your organization have a written policy for business continuity and disaster recovery?

1.5 Does your business continuity plan have senior management approval and sponsorship?’

1.6 Does your organization have a formal governance body for business continuity?

SAVNS RFO Page 2 of 10

1.7 Is there a designated individual or group responsible for oversight and administration of the business continuity policy and program within your organization?

1.8 Is your BC/DR plan reviewed and updated at least annually?

1.9 Does your organization conduct a periodic review of the BC program with senior management to consider changes in organization, technology, processes, environmental, and regulatory factors on a periodic basis?

1.10 Does your organization conduct a periodic review of the BC program with senior management to consider the adequacy of resources (i.e., People, Technology, Facilities, and Funding) to support the BC/DR program?

1.11 Does your organization's BC/DR plan include provisions to ensure that the business continuity capabilities of your critical third parties / suppliers performing under the contract are strong enough to support your organization's BC/DR plans and testing objectives?

1.12 Please identify any business disruptions your organization anticipates would cause an exception to your current planned recovery strategies.

(E.g., “large scale regional flooding, large scale regional telecommunications failure affecting the internet”, etc.)

2.0 Business Impact Analysis

2.1 Does your company conduct a Business Impact Analysis?

If Yes, how often is the BIA conducted?

Does the Business Impact Analysis address the following:

SAVNS RFO Page 3 of 10

2.2 Business Process Criticality (e.g. High, Medium, Low or Numerical Rating) that distinguishes the relative importance of each process?

SAVNS RFO Page 4 of 10

2.3 Specification of Recovery Time Objective? If Yes, provide the RTO

2.4 Specification of Recovery Point Objective? If Yes, provide the RPO

2.5 Maximum allowable downtime?

2.6 Costs associated with downtime?

2.7 Recovery site capacity?

2.8 Impact to the clients?

3.0 Risk Assessments

3.1 Has a risk assessment been conducted within the last 12 months?

3.2 Does the risk assessment identify and prioritize potential disruptions based on severity of impact to your organization’s business processes and the ability to provide continuous support to your clients?

3.3 Does the risk assessment identify and prioritize potential disruptions based on severity of impact to your organization’s vendors?

3.4 Do you have mitigation strategies to address the risks identified in those assessments?

3.5 Is there a gap analysis comparing your existing BC/DR program capabilities versus high probability and high impact events?

3.6 Is there a gap analysis comparing your existing BC/DR program capabilities versus low probability but high impact events?

3.7 Does your company conduct risk assessments for processes to be included in the plan?

SAVNS RFO Page 5 of 10

Does the risk assessment process address all areas of risk, including:

3.8 Regulatory?

3.9 Operational?

3.10 Technological?

3.11 Legal?

3.12 Financial?

3.13 Information Security?

3.14 Physical Security?

3.15 Personnel?

4.0 Plan Development and Maintenance

Does your organization’s Business Continuity and/or Disaster Recovery plan address the following elements:

4.1 Conditions for activating the plan?

4.2 Procedures to relocate essential business activities?

4.3 A maintenance schedule that specifies how and when the plan is to be revised and tested?

4.4 Awareness and education activities?

4.5 Roles and responsibilities describing who is responsible for executing all aspects of the plan?

4.6 Identification of dependencies upon third parties including utilities that service your organization?

SAVNS RFO Page 6 of 10

4.7 Identification of escalation procedures for engaging your organizations critical vendors?

4.8 A change management process to ensure changes are replicated to contingency environments?

4.9 Identification of applications, equipment, facilities, personnel, supplies and vital records necessary for recovery?

4.10 Regular updates from the inventory of IT and telecom assets?

4.11 Recovery site capacity?

4.12 Is your organization's BC/DR sufficient to meet OAG requirements, while your organization is operating in a recovery mode?

4.13 Are BC/DR documents required to be available and accessible where and when needed including a scenario where the location and/or technology holding the primary copy is unavailable?

Are data and systems backups:

4.14 Stored offsite in a secure environmentally controlled facility?

4.15 Captured and taken offsite frequently enough to support the required recovery point objective (RPO)?

4.16 Routinely verified to be sound for recovery purposes?

4.17 Documented in procedures for ready access in an emergency?

SAVNS RFO Page 7 of 10

4.18 Do explicit instructions exist within your BC/DR Plan to address the notification and activation of recovery media and facilities that involve all of your organization's vendors including all required account information (e.g. contract numbers, types of supplies, etc.)?

4.19 Documented in procedures for ready access in an emergency?

If your organization has answered "No" for any questions 4.1 thru 4.19, please explain why it is not necessary for your organization.

5.0 Incident Management and Communications

NOTE: Standard OAG contract terms require OAG approval of news releases and outreach relevant to the contract resulting from this solicitation.

Does your organization's BC/DR Incident Management Plan include the following:

5.1 A strategy and a communications plan for disaster declaration, notification and escalation to your organization's clients and vendors/ suppliers?

5.2 Identified designated personnel and trained alternates who have the capability, responsibility and authority to invoke the plan?

5.3 Documented procedures, including client contact information and client escalation procedures for the staff members to use when communicating with your clients in a disaster situation?

5.4 A designated virtual or physical "command center" where management can meet, organize, and conduct emergency operations in a secure setting?

5.5 A "backup command center," if the primary command center is not available?

5.6 Alternate and diverse means of communications if the event includes general power outages, land line and cell phone outages or overloads, etc.?

SAVNS RFO Page 7 of 10

5.7 A well-outlined process for public media (TV, newspapers) control during an event?

5.8 Does the Business Continuity and/or Disaster Recovery plan address Customer notification when incidents occur?

5.9 Do you provide your clients with detailed contact information for use in emergencies?

5.10 How often is this information updated and distributed? Please describe -->>

5.11 Does your plan ensure that the key personnel (and alternates) contact information from your organization’s critical vendors and services are documented?

5.12 How often is this information collected and updated?

5.13 Does that contact information include the following:

5.13a Cell phone numbers?

5.13b Office phone numbers?

5.13c Off-hours phone numbers?

5.13d Primary and where available, alternate email addresses?

6.0 Testing and Reporting

6.1 How often does your organization test your BC/DR plans to ensure currency and effectiveness?

6.1a Systems & Technology Relocation

6.1b People / Work Relocation

SAVNS RFO Page 8 of 10

6.1c Facilities and Infrastructure testing

6.2 Does your company prepare an annual test plan?

6.3 Does your testing program include:

6.3a Evacuation drills?

6.3b Notification tests?

6.3c Tabletop exercises?

6.3d Application recovery tests?

6.3e Remote access tests?

6.3f Business relocation tests?

6.3g Data Center Failover test?

6.3h Critical vendors?

6.3i “Full scale” exercises?

* Full scale testing is defined as testing of several facets of the BC/DR program at the same time, e.g., a data failover test that involves your clients, or a full firm wide exercise that involves multiple recovery sites, both personnel and data processing.

Please describe -->>

6.3j Has anything been discovered as a result of testing that would impair your organization’s ability to recover?

Please explain -->>

7.0 Mass Absenteeism and/or Pandemic Planning

SAVNS RFO Page 9 of 10

NOTE: THIS PART OF THE QUESTIONNAIRE DRAWS UPON THE KEY ELEMENTS FOUND IN THE DECEMBER, 2007 FFIEC GUIDANCE AND THE MARCH, 2007 GAO REPORT. THESE REPORTS DEFINE ELEMENTS THAT EVERY PANDEMIC PROGRAM SHOULD HAVE AND INCLUDE THE FOLLOWING:

• A PREVENTATIVE PROGRAM,

• A FORMAL PLAN THAT INCLUDES ESCALATING RESPONSES TO PARTICULAR STAGES OF AN OUTBREAK,

• FACILITIES, SYSTEMS, AND/OR PROCEDURES THAT PROVIDE THE ORGANIZATION WITH THE CAPABILITY TO CONTINUE ITS CRITICAL OPERATIONS,

• A TESTING PROGRAM,

• OVERSIGHT OF THE PROGRAM

FOR DETAILS, PLEASE SEE THE ABOVE REFERENCED MATERIALS DIRECTLY.

7.1 Do you have a plan for a Pandemic or Mass Absentee situation?

(i.e., a scenario involving large scale* unavailability of staff over a protracted period of time that would have a large impact on your organization’s business performance)

7.2 Is the plan subject to review at least annually?

7.3 What is the maximum employee/contractor absentee rate considered in your plan? Please respond with percentage of absent staff.

7.4 Have you prioritized your business functions to determine what services you would continue during a Pandemic?

If YES, is that priority list available for review upon request?

7.5 Do you have a specific Pandemic/Mass Absentee Planning committee that performs oversight of your pandemic readiness program?

7.6 Does your plan include monitoring of pandemic situations elsewhere in the world?

7.7 Does your company’s periodic testing program include pandemic testing?

If YES please provide the date of either your last pandemic test or

7.8 For any entities providing critical services to you, do you verify that they have a similar plan in place?

7.9 Have you conducted a Business Impact Analysis covering a pandemic situation?

7.10 Does your strategy provide for a scaled response based upon the stages of a pandemic outbreak?

7.11 Please describe the strategies that you intend to utilize for this scaled response.

Comments here

SAVNS RFO Page 10 of 10

7.12 Does your strategy include use of a remote access/work-from-home capability?

If YES please provide details of how you will test this capability and what strategies you will employ if remote access is

Does your plan include the following? Please provide relevant details when answering.

7.13 Trigger point(s) for activating the plan? Please describe in detail

7.14 Implementation of travel and visitor restrictions? Please describe in detail

7.15 Increased cleaning and disinfecting protocols? Please describe in detail

7.16 Have you created pandemic specific HR policy and procedures? Please describe in detail

7.17 Specific "Social Distancing' criteria / techniques? Please describe in detail

7.17 Do you offer vaccinations to your employees?

7.19 Do you plan on implementing preventative measures to limit contamination between your employees? (e.g., distributing face masks, disposable latex or vinyl gloves, alcohol based hand sanitizers, etc.)?

Please describe in detail

7.20 Do you plan on implementing preventative measures within your building(s) to limit possible contamination? (e.g., special food handling procedures in cafeterias, hand sanitizer stations, etc.)

Please describe in detail