J.P. MORGAN CHASE BANK, N.A. 1A - 2015

Home Browse Search

C0 N F I DE NT I AL Resiliency plans supporting critical business processes are updated annually or when there are significant changes in the environment. Plan maintenance sessions are typically one on one sessions, with the business unit, to formally review it[ aspects of the resiliency plan and make updates as necessary. Where applicable, we educate each shift of the general employee population on how to respond to an event at their facility, in addition to the employees that will be directly involved with a recovery effort. In addition, J.P. Morgan has a formal, centrally managed, validation process to evaluate the adequacy of security, disaster recovery and business continuity controls in place at critical vendors. A critical vendor is described as one who provides a unique, time critical service that is not easily reproduced or replaceable. Business Resiliency plans are subject to reviews by J.P. Morgan's Internal Audit Department and the Resiliency Risk Management group, which acts as the firm's governing body for Business Resiliency measures. The plans must address and comply with documented organizational requirements. All findings are escalated to the business units, Risk Management and division executive for review. Event Management, Escalation and Response J.P, Morgan has regional crisis management teams in place to address emerging risks and respond to actual recovery issues. Within each line of business, a crisis management framework is in place to manage business units and customers through a potential or actual business interruption event. This process is tested on a regular basis and has been successfully used to manage through a multitude of planned and unplanned events including hurricanes, floods, snowstorms, terrorist attacks, technology interruptions and power outages. The following areas are addressed: I Notification of employees and activation of the plan Damage assessment of facility, technology and work -in- progress Evaluation and impact of established service level agreements Communication with key support providers and customers Recovery of work-in- progress Recovery site activation Impact on support groups and interdependent processes Movement of work and people Business unit and technology recovery Restoration of the process back to the original production location J.P. Morgan is a large, geographically dispersed financial institution with the ability to manage complex events. Two -way pagers, e -mail, instant messaging, and teleconference bridge lines are used to communicate and coordinate activities across alt business units and support groups. In an actual business disruption, it can be critical to determine accurately the extent of damage and the resources required to resume and maintain operations. Damage Assessment is comprised of three components, coordinated by groups knowledgeable in their established discipline: the Facilities and Critical Infrastructure Group evaluates the facility and select supporting infrastructure; business unit management evaluates the impact of in- progress and expected workload and determines the appropriate level of response; Global Technology Infrastructure evaluates the impact on electronic equipment, including computers, network and servers. JTMorcran