Pub. 8 2013-2013 Issue 5

www.nebankers.org 16 Extraordinary Service for Extraordinary Members. How to Construct a Balanced Business Continuity Plan Leticia Saiid , CoNetrix Y our Business Continuity Plan (BCP) is your life raft for both expected and unexpected di- sasters. It is your road map to recovery. Illustrations aside, it’s very important, and your employees need to be able to read it. I’ve heard it said that even an unschooled person should be able to pick up a BCP and get the bank restored properly. While it is important to have a well-thought-out BCP, it’s not likely you will round up a team of unschooled persons to read and follow your BCP. It is more likely that restora- tion will be performed by you and your employees; better yet, these employees will have been handpicked as capable workers. I make note of this anecdote because banks often design business tion will be truly valuable to each situa- tion. Define recovery objectives that are detailed enough that the reader knows what to do, but not so exhaustive that they feel the need to speed-read your BCP because of its novel-like qualities. Knowing the software, supplies, vendors, and systems required to fully execute a process is essential informa- tion for restoration, but it’s okay to make some assumptions to reduce the level of granularity involved in your BCP. Remember you’re writing to a specific audience: your employees. In- stead of including every detail necessary to perform processes normally, focus on what is necessary for a restoration process. Encourage your employees to keep instruction manuals and proce- dures of their own (and you may find that many do). Then, their manuals and procedures can be referenced by the plan, and evenmade accessible with the plan, without having to be written out andmaintained directly in the plan. This will help you sustain a balance between availability of information and superfluous information, which can become obstructive to the efficiency of your business continuity goals. To nicely tie all the pieces together, you should have an administrator who oversees the entire BCP development process. This administrator is key in assuring a strong, succinct business continuity plan. One of the main re- quirements for business continuity planning is to continually update the plan to reflect the current operating environment. This is a completely at- tainable goal when the administrator only has to update the restoration con- cepts of your bank’s business processes and not every step and click for each employee’s daily tasks.  tech talk Leticia Saiid is a tandem software support specialist for CoNetrix. CoNetrix is a provider of information security consulting, IT/GLBA audits and security testing, and tandem—a security and compliance software suite designed to help financial institutions create and maintain their Information Security Programs. Visit CoNetrix at www.conetrix.com . continuity plans with every single step and click explained for every facet of the organization. As important as it is for your BCP to be thorough, it’s just as important for it to be user friendly. The sheer volume of data in a BCP can be very overwhelming to read, let alone build. If you focus on how achiev- able your BCP is while constructing it, you will find implementation of the BCP much more pleasant. With all the capabilities that technology allows, many organizations find themselves in data overload, keeping more data than is necessary just because they can. That mindset is a hindrance to a functional BCP. To maintain a practical style of documentation, consider what informa-