In a recent joint advisory for company’s disaster recovery plan issued by the US Securities and Exchange Commission (SEC), the Financial Industry Regulatory Authority (FINRA) and the Commodity Futures Trading Commission’s (CFTC) Division of Swap Dealer and Intermediary Oversight it was recommended, among other things, that “firms should consider keeping their business continuity plans, contact lists and other necessary documents, procedures and manuals at the alternative site, ideally in paper form in the OKevent that electronic files cannot be accessed.”
“How important are paper-based business continuity plans?”
With more than 100 responses received, the results show that 54.4 percent of respondents believe that paper based disaster recovery plans are essential; 26.6 percent say that they are ‘quite important’; and 19.0 percent say that they are ‘not important’.
There is some variation of opinion depending on the size of the respondent’s organization. 54.5 percent of business continuity professionals in large organizations see paper-based BCPs as essential; this drops to 46.2 percent in medium-sized organizations and 50 percent in small organizations. However, 71.4 percent of those in micro organizations say that paper-based BCPs are essential.
How do you balance the disaster recovery plan risk and investment equation? Is the potential risk greater than the investment? Some facts:
- 43% of companies experiencing disasters never reopen, and 29% close within two years.
- 93% of businesses that lost their data center for 10 days went bankrupt within one year.
- 40% of all companies that experience a major disaster will go out of business if they cannot gain access to their data within 24 hours.
CIOs and Business Continuity Managers should plan for all situations in which normal operations are disrupted and have practices and technologies in place that enable them to deal with potential disruption from hostile, external actions as well as internal system failures.