Disaster Recovery Plan in Share Broking House - Case Study Example

Disaster Recovery Plan Business continuity plan or Disaster recovery plan Uncertainty in the environment caused by natural and man-made disasters, call for strategic management plan for business continuity and disaster recovery. An important lesson learned by the business and industrial organizations from the September, 11, 2001 terrorists’ attack on the USA made them to realize the need for contingency planning in the case of unexpected and uncertain events. “The stock markets in New York have reopened after their longest closure since 9/11due to the super storm Sandy... NYSE said it is using backup generators - for the first time - because power is out in much of downtown Manhattan.” (BBC News, 2012) The disasters in financial services industry create confidence crisis among the public and the industry needs to be prepared in all circumstances to avoid disasters and ready with business continuity plans. This paper discusses disaster recovery plan in respect of Share Broking House. Disaster recovery plan in Share Broking House The disaster causing damages in an environment may be either temporary as in the case of Sandy storm or permanent as in the case of attack on World Trade Center. The planning for the latter one involves substantial capital investment for establishing the required facilities for continuity of the business in an alternative site. The geographical locations should be dispersed with sufficient distance between the head office and the alternate site proposed for disaster recovery plan. Disasters may be categorized into two types at company level based on the nature of damages: disaster causing damages to the system and disaster causing damages to the entire facilities and properties. Establishing disaster recovery system at a different site will take care of both the types of disasters. Since the business of share broking house under study is spread all over the country, the disaster recovery site should be away by more than 300 kilo meters from the head office, in another city which is not prone to earth quakes. Goals The important goals in installing the disaster recovery plan are given below: 1. Training the employees in the recovery activities anticipated. 2. Testing the system for compatibility in real-life situations. 3. Establishing the necessary back-up facilities to provide the best services at all times. 4. Putting alternate communication system in place in the event of disaster. 5. Mitigating the effects of the impacts in the event of disaster. Objectives 1. Ensuring normalcy in clearing and settlement operations in the business without loss of time. 2. Ensuring accessibility to staff for disaster recovery process. 3. Assessment of the financial and operational support needed for reporting to the banks and financial institutions. 4. Making arrangements for survey by insurance companies. 5. Coordination with the service providers and vendors in recovery process. 6. Early resumption of the disrupted business operations. 7. Keeping the customers informed of the situation. 8. Keeping the regulatory and local authorities informed of the extent of disaster and the progress of recovery process. Overview of the organization The organization needs to be studied and analyzed with particular reference to disaster management. The structure has been designed to meet the needs of the industry where the business is carried out online. There are more than 100 branches which are connected to the head office. There are more than 1000 terminals in head office and branch offices. The company appointed dealers place orders into the system as per the instructions received over phone or internet from the customers. Also, some of these terminals are allocated to the day traders for day-trading. The important tasks involved in the day-to-day operations can be classified into: 1) Buying and selling of shares and Securities including Futures and Options, 2) Transfer of Securities to the depositories, depository participants and customers, 3) Settlement of payments arising out of transactions and Margin requirements including mark-to-market margins, 4) Customer service by way of giving inputs to the customers for trading, through research and 5) Back office operations to deal with the clients’ accounts or their requirements. This involves interaction between the customers, depository participants, banks, clearing corporations, stock exchanges and Securities and Exchange Commission, and all transaction are carried out electronically. Therefore, disruption in the services will cause severe damage to the various parties related to the transactions. Network Architecture Existing Corporate Headquarters is connected to Branch Offices and various other market participants like stock exchanges and other external bodies and the customers. (Annexure – I) Connectivity in all these cases is established through: 1. A dedicated network implemented over Leased-Lines and/or 2. A dedicated network implemented over VSAT. The Service providers include cable providers like Comcast, Fibre Optic, DSL and dial-up service providers like AT&T or Verizone and VSAT service provider like VSAT Systems. Normal disruptions for not exceeding few minutes could be managed without the issue being noticed at all through the back-up links provided through alternative lease lines/VSAT. Network Architecture Proposed The Disaster Recovery site proposed would be connected through multiple links to the main site. The back-up links will be provided through alternate lease lines/VSAT. (Annexure – II) It will be more or less similar to the existing network architecture in head office. Program for periodical testing of the system for compatibility in real-life situations has to be devised. This will avoid the down time on account of disasters completely. However, heavy load on continuous basis may give rise to certain operational issues which could be overcome through back-up facilities. These facilities could be installed additionally on real time basis by the internationally reputed service providers. Disaster Recovery Policy There is a time lag between the system failures on account of disasters and the recovery process. Disaster recovery planning ensures alertness among the personnel to minimize this time by undertaking appropriate actions at the time of disaster, and thereafter for recovery. Disaster declaration  It is like a First Information Report. The information to the key personnel at various levels internally within the organization and the external agencies is the first step. The content should be standardized and brief but with all the relevant details to avoid ambiguity and duplication. The list of such persons and authorities and their contact details should be readily available. Assessment of security  The issues in connection with the disaster involve not only damages to the personnel and property but also information security which is very vital in this organizational set-up. Therefore, the information to be passed on shared at this critical period should be only on ‘need to know’ basis. Potential disaster scenarios and methods of dealing with the disaster  It is necessary to ascertain whether the disaster is going to disrupt the activities for a day or longer duration. It is an important determinant factor in charting out the course of actions in a disaster recovery plan. Controlling, directing and monitoring of the operations during the period should be as per the guidelines issued in this regard. Evaluation of the risks involved in various course of actions and its impact on the operations and continuity of the business should be entrusted to the experienced personnel with clear cut directions from the disaster recovery team. Disaster recovery procedures  The disaster recovery plan envisages establishment of rules and procedures for timely movement of men and material for disaster recovery to ensures early resumption of the business. When disaster management involves movement of personnel to new site, there are certain problems associated with operating in a new system in a new place. The personnel should be trained by the incidence response team members for easy implementation of the recovery plan. “The Commission, Federal Reserve Board, and Comptroller of the Currency published an interagency White Paper emphasizing the importance of core clearing and settlement organizations and establishing guidelines for their capacity and ability to restore operations within a short time of a wide-scale disruption. Separately, the Commission also published a Policy Statement urging the organized securities markets to improve their business continuity arrangements, and encouraging SRO-operated markets and electronic communications networks, or ECNs to establish plans to enable the restoration of trading no later than the business day following a wide-scale disruption” (US Securities Exchange Commission, 2008). The disaster recovery plan consists of the procedures to be adopted in disaster management, which will vary according to the nature of the disaster. It involves emergency planning and security risk analysis. The disaster recovery procedures should clearly specify the duties and responsibilities of the personnel at different levels and the guidelines for execution of various activities in disaster management. Incident Response Team (IRT) Executive summary  Small incidents sometimes culminate into big disasters, if they remain neglected for long. Incident response team can be constituted headed by the Chief Systems Administrator reporting to the Board of Directors for entrusting the responsibility disaster management planning and control in addition to the day-to-day duties with regard to connectivity or communication failures. Anything abnormal in the environment needs to be carefully watched and monitored for analyzing its implications to the smooth flow of the business operations. Communication at all levels within the organization is very important in this respect. The incident response team to be constituted in the overall context of disaster recovery will be successful only when there is active cooperation from the employees. The difficulties associated with the disaster management should be understood by the employees. They have to be trained properly to rise up to the occasion at the time of recovery process. Mission statement  As in a warlike situation, disaster will be accorded priority and its impacts will be successfully mitigated through hard work and absolute dedication on the part of the all participants in the recovery process by contributing their best in solving the crisis in coordination with the disaster recovery team. Incident declaration  Only with the trained eyes and intuition certain signals which might lead to disruption in the functioning can be observed. The employees should be trained and advised to report the incidents, if necessary after consulting the systems administrator or network engineer to the IRT immediately. Organizational structure  A proper organization structure ensures allocation of responsibilities and communication without any overlapping and delay. Coordination of the activities of the disaster recovery team and ensuring backup facilities to face the situation confidently at the time of crisis are parts of the disaster management plan, and lack of proper structure will make the disaster recovery process very complex. Tittel & Koreic (2012) state, “Well‐prepared organizations establish plans, procedures and protocols to mitigate the effects any form of disaster may have on continuing operations and help facilitate a speedy return to working order”. Roles and responsibilities  Robb (2005) says “even companies with well-compiled plans can look foolish if nobody can find the plan when they need it.” Disaster recovery plan at the new site calls for movement of personnel to the disaster recovery site on temporary or semi permanent basis till the services are restored at the existing facilities. Roles and responsibilities in the event of disaster need to be finalized by the Incident Response Team and the consents from the respective employees and approval from the management obtained. Information flow and communication The incident response team needs to be fully prepared at all times to face the challenges brought with it by a disaster. All the team members should be reachable easily at a very short notice. Similarly, movement of people to the head office or disaster recover site should be very quick. The support services needed at the times of recovery should be notified without any loss of time. Therefore, verification of the addresses, phone numbers and mail addresses of all the personnel involved should be readily available for communication. Once, the problem is communicated, the people involved should be in a position to chart out their course of action based on the standard guidelines already issued to them to avoid delays in the process. All the branches and the external agencies related t the business including the customers should be notified for eliciting their cooperation in solving the crisis. Role of Incident Response Team   The personnel employed in various sections of the business should be in a position to reach the IRT members at all times. There is time schedule for every activity handled by them. They are responsible for training the people periodically in disaster management methods and techniques. It should be ensured that “All have rehearsed their responsibilities and are confident about their abilities to perform their designated tasks” (Lucey, 2011). Periodical test runs of disaster recovery system should be conducted to create awareness among the employees. IRT should be in touch with the services providers of various kinds with reference to periodical check-up of the systems and maintenance of the equipments. Authority and reporting procedures When the disaster management is underway, the complete authority rests with the incident response team to avoid overlapping of authorities in implementation of the plan. All the departmental heads should work in coordination with the team and ensure that their functioning is compatible with the steps taken in connection with disaster management. References BBC News (2012) Sandy: US stock exchanges reopen, Retrieved from: http://www.bbc.co.uk/news/business-20151276 Lucey, K. (2012) Signals of an Effective BC/DR Exercise Program, Executive Guide: How to Achieve True Enterprise Resiliency, Disaster Recovery Journal, Business Continuity Institute, Retrieved from: http://www.drj.com/images/exec-guides/2012ExecGuide.pdf . US Securities Exchange Commission (2008) Guide to Broker-Dealer Registration, Retrieved from: http://www.sec.gov/divisions/marketreg/bdguide.htm Robb, D. (2005) Disaster Recovery: Are you ready for trouble? Computerworld, Retrieved from: http://www.computerworld.com/s/article/101249/Ready_for_Trouble_ Tittel, E. & Koreic, J. (2012) Understanding the need for Business Continuity Management and Disaster Recovery Planning, American Institute of CPAs, Retrieved from: http://www.aicpa.org/interestareas/informationtechnology/resources/businesscontinuitymanagementanddisasterrecoveryplanning/downloadabledocuments/understanding_drp_bcm.pdf Appendices Annexure - I Network Architecture: Existing Server Farm Head Office __________________________________ Branche1 Branch 2 Branch 3 Annexure - II Network Architecture: Proposed Server Farm Head Office D.R. Site ____________________________ __________________________________ Branche1 Branch 2 Branch 3 Read More