The CFTC, SEC, and FINRA have issued an advisory following their joint investigation into firms’ business continuity and disaster recovery plans (“BCPs”) in the wake of Hurricane Sandy. The regulators encourage firms to consider implementing the best practices described, which the advisory groups into the following categories: (1) widespread disruption considerations, (2) alternative locations considerations, (3) vendor relationships, (4) telecommunications services and technology considerations, (5) communications plans, (6) regulatory and compliance considerations, and (7) review and testing. For example, the advisory encourages firms to consider their employees’ ability to work from home during a crisis, including consideration of their ability to work remotely when telephone and Internet service may be disrupted. It also lists a number of factors to consider in setting up back-up or alternative locations, suggests that firms consider the BCPs of their vendors, encourages firms to consider contracting with multiple telecommunications carriers in the event that one or more such carriers experiences a disruption, suggests that firms consider implementing a communication plan to allow communication and coordination with regulators, emergency officials, and others; urges firms to factor the time-sensitive nature of certain regulatory and exchange requirements into their BCPs; and encourages annual or more frequent BCP testing and training and the incorporation of stress testing into BCPs.
Alert August 20, 2013