J.P. MORGAN CHASE BANK, N.A. 1A - 2015

Home Browse Search

C ON FI DE. N T I At, Plan Development J.P. Morgan uses a formal Business Impact Analysis (BA) process and a standard tool to gather and analyze data with each business unit. For consistency of process and content, a Business Resiliency Analyst works with the business unit staff to conduct this assessment. The BIA measures the potential impact of disruption to clients, as well as legal, regulatory and financial impact to the firm if the business process is not able to function. The business unit then establishes a recovery window for processes and supporting infrastructure. The recovery window range begins with intraday recovery and extends out based on the criticality and time - sensitivity of the process. Output from the BiA is used to define and develop a preferred recovery strategy consistent with the specified recovery window. Standardized methodologies, templates and tools provide consistent reporting (mechanisms, helping to ensure that the selected strategy and the detailed plan address all relevant aspects of the FFIEC guidelines. Alt business continuity plans are required to incorporate and satisfy specific critical elements, including: • Recovery Strategy • Employee Calt Tree • Customers /Vendors • Recovery Time Objective • Damage Assessment • Equipment /Software • Emergency Notification • Recovery Procedures • Telecommunications Recovery site selection includes evaluation of sites that will not likely be impacted by the same event considering regional geography and critical infrastructure that supports the process. In many cases, alternate J.P. Morgan locations or sister sites are the primary recovery site. Select business units have established hot site locations for business and technology recovery while others have contracts with third party vendors to provide and support business and systems recovery. Where applicable, business resiliency plans reference command centers, assembly sites, offsite storage and recovery sites. A formal process to document and approve recovery sites is in place to help avoid the potential double- booking or business unit overlap at recovery sites. Additionally, support groups, such as Real Estate and Desktop Support, ensure recovery sites can be utilized effectively at the time of an interruption and that plans are established to provide required infrastructure within allowable timeframes. Testing, Training and Education Alt plans must comply with the firms' corporate testing policy and test cycle. Each resiliency plan is tested annually. Exercises can include: ,, Notification Procedures (i.e. Call Trees): An unplanned and unannounced exercise of a documented call tree. 0, Walkthrough of Resiliency Plans: An exercise that validates that the resiliency plan incorporates all critical processes and identifies gaps or other weaknesses requiring remediation. It also familiarizes the business unit or support group staff with the plan and their role in its execution. Walkthroughs can be combined with Table Top or full physical tests as part of test preparation. Table Top Testing: An exercise to validate a Resiliency Plan's assumptions including those related to dependencies, support groups', outside service providers' and vendors' ability to provide support are sound and known by the other parties. Full Physical Testing: An exercise that validates the Plan's ability to recover business units, processes, applications, and infrastructure within the established recovery time objective without dependency on the primary site.