US Regulatory Agencies Issue Business Continuity Advisory near the One Year Anniversary of Hurricane Sandy
One year ago today, Hurricane Sandy was tracking towards eventual landfall on the New Jersey coast. Despite the advance warning received, the storm produced significant loss of life and property damage. Sandy’s path took her over heavily populated areas, including New York City, which is the center of the financial markets and industry in the US. The storm caused equities and options markets in New York to close for two days (October 29-30, 2012) The Chicago Board Options Exchange (CBOE) was also closed during this time. In addition to the tragic loss of lives, the total economic impact of the storm damage in the US was estimated to be $65 Billion Dollars.
The closure of these exchanges, as well as the overall impact on business and banking, caused the following federal regulatory agencies to take note of the impact to financials firms and markets:
- Securities and Exchange Commission (SEC)
- Financial Industry Regulatory Authority (FINRA)
- Commodity Futures Trading Commission (CFTC)
After Hurricane Sandy, these agencies contacted financial firms with a significant market presence, to get an understanding of how these firms were impacted by the storm, and how their Business Continuity Plans fared under real world conditions. The group compiled the best practices and lessons learned, and published the “Business Continuity Planning” Report. Here is a summary of the group’s advice:
Prepare for Widespread Disruption
The size of Hurricane Sandy caused widespread destruction and disruption of telecommunications, transportation, electricity, fuel, water, and office space. This highlighted the need for remote access for employees, since many could not get to or communicate with their offices, and often the offices themselves were without the infrastructure we normally take for granted.
Plan Alternate Locations
When looking for alternate locations for operations, data center, and remote office locations, firms should consider geographically diverse locations to avoid the regional disruptions like those caused by Hurricane Sandy. These alternate sites should be evaluated for these additional criteria:
- Accessibility of key staff in the event of highway or transit system shutdown
- Generator Capacity to maintain critical functions, and how that capacity is allocated
- Adequate resources onsite for key staff to carry on critical functions, including workspace, supplies, network connectivity, phones, computers, etc..
- Ability to pre-arrange for hotel accommodations near the alternate locations
Evaluate Vendor Business Continuity Plan
The vendors that perform critical functions should be evaluated for their own Business Continuity Plans (BCP) as well, since in a regional event it is likely that they too will be impacted and if they are out of commission, it is likely that your company will be as well.
Evaluate Telecommunications and Technology
It is important to have backup services that failover when the primary service provider is not functioning. The technology that will be used by remote staff during an event should be planned out and communicated. The telecom & technology providers should also be evaluated for their BCP
Have a Comprehensive Communications Plan
Firms should create plans so that customers, trading partners, exchanges, regulatory bodies, and emergency officials can stay in communications during an event. Firms should also communicate their operational status and updated contact information through their website or other means.
Consider Regulatory Requirements
Firms should prioritize time sensitive reporting requirements, and make sure their BCP is in compliance with regulatory requirements.
Review and Testing of BCP
Firms should conduct full BCP tests and staff evaluations and training at least annually, and possibly more depending on the role of staff members. Firms also should consider incorporating “Stress Tests” into their BCPs, including their liquidity which may be impacted by the event.
The Midwest is not immune to regional weather disruptions, having a risk of heavy snowfall from Nov-April of each year. These events can cause hurricane-like disruptions to power supply, communications, transportation, and the ability for employees to get to work. These types of events can and do occur all over the US, making business continuity planning important regardless of the state in which you conduct business.
Hurricane Sandy provided the opportunity for financial firms and the agencies that regulate them to test their own Business Continuity Plans in the real world, and share the lessons learned to improve our ability to handle these events in the future.
First Communications has a Disaster Recovery Planning Template which is available for download on our website here: Disaster Recovery Planning Template Fillable PDF