Outsourcing Disaster Recovery Should Protect the Continuity of Your Business!

Vendors / Providers of Critical Services Beware!

I recently read an article that was written by Colin Roe, MBCI that was published on the Continuity Central Website (http://www.continuitycentral.com/feature0628.html) that got me thinking about what this year has taught us about outsourcing critical services.

As VP, of Business Continuity Practices for IT-Lifeline, I consistently work with those whose responsibility is Vendor Management.  In March of 2008, the FFIEC, a regulatory group that oversees business continuity practices for the financial institutions issued specific guidelines that pertain to 3^rd party providers of services to banks and credit unions.  Those of you in other industries should take note!

In summary, the financial institutions were directed to hold 3^rd party providers of key services to the same standards for the development and maintenance of their business continuity planning process that are expected of the institutions themselves.  Specifically, the professional practices that pertain to business continuity planning;

 

·         Process Management

·         Risk Management & Evaluation

·         Business Impact Analysis

·         Defined Recovery Strategies

·         Defined & Documented Plan Procedures

·         Training & Awareness

·         Plan Testing & Exercises

·         Audit, Maintenance & Certification

 

If you are a provider of services to financial institutions you need to be aware of the above.  The financial institutions have been given a directive to inquire as to your efforts regarding these practices.  The options they have been given to your response are 1) accept the provider’s position, 2) Encourage the provider to develop / complete the planning process, or 3) Seek another provider for the service.  I can tell you from firsthand experience that I have seen all of the above options exercised by our bank and credit union clientele.

If you provide key / critical services to other industries you can expect this standard to rapidly become a professional best practice regardless of industry. Your clients will be asking how you approached your business continuity planning process.