BCP evolution at the Colombian Central Bank

Transcription

1 BCP evolution at the Colombian Central Bank Fabio Mauricio Pinzón González. General Director Office of Technology Management CEMLA Santiago Chile 2011

2 AGENDA I. The Organization Evolution II. BCMS The present III. Lessons Learned so far IV. Next Challenges

3 Learning from the experience side Because of 1977 «Moles» stole money through a tunnel 1983 A white collar got some money with a Swift-Telex scam 1994 With inside cooperation burglars opened a vault and got a truck loaded with cash 1999 Armenia s earthquake (01/25, 13:30) We get Floating vaults Electronic Security Unit created Information Security Department created Setup Nationwide WAN for remote videosurveillance DRI and BCP required and supported by Governor s Office

4 Learnings from that earthquake Cash got buried - Twenty blocks were evacuated «Looters» came DR measures were taken (army, choppers) so cash came back to the streets 48 hours later. Mobile ATM s would have been handy. No info needed for operation should be placed exclusively inside one physical place

5 Year Some evolution from the IT perspective We set up 1996 Second Computer Center 500mts away, fiber-optic link 2001 BC starts as part of ITSecurity - Design of a better Alternate Computer Center at the Cash Distribution Complex Initial studies for placing a third site more than 300kms away 2005 ISO-9001 process certification: Change Management Incident/Problem Management 2006 Second Computer Center active-active 13kms away in Bogota. Barranquilla is chosen as the third site Continuity became an area independent of IT and reports directly to Top Managemengt 2010 First Test of the remote center with external customers

6 AGENDA I. The Organization Evolution II. BCMS The present III. Lessons Learned so far IV. Next Challenges

7 BCMS from the theoretical perspective Framework Integration BCMS Model Management Resources

8 So your BCMS checklist starts like? Process are defined Risk Analysis of process is a regular practice BIA comes after the RA The objectives and scope of your BCP are clear Process changes so you start the loop again

9 Risk and Process Mgmt Department Business Process Management System Main Processes Provide M.S Research,Design & Maintain Risk Management System Business Continuity Management System Advice and facilitate the implementation M.S Support and Awareness Monitor the M.S Measure and Analyze

10 The organization : Risk and Process Mgmt Governor s Office Operational Risk and Business Continuity Committee Office of the Deputy Executive Governor Operational Risk Management Division General Division of Corporate Service Gral.Office of Technology Management RPMD Director Technical Support Technology Services and Continuity Unit Leader BPMS Leader RMS Leader BCMS Engineers (3) Engineers (2) Statistician(1) Engineers (3) Information System Engineers (4)

11 The Organization: Process

12 Bcms - Model Cultura organizacional Understanding the Organization Exercising, Maintaining and Review Determining BCM Strategy Developing and implementing BCM Response

13 Understanding the Organization Priorities - Risk Analysis - BIA Review the critical processes (Every 5 years) Risk Analysis (RMS- Model) Review BIA (Every 3 years ) Interviews with a check list and the last BIA Recovery Time Objective (RTO) Between 30 min. and 2 hours Recovery Point Objective (RPO) Between on line data and a 6 hrs delay Minimum Acceptable Resources (MARC) Determine new strategies or update existing ones

14 Determining BCM Strategy Disaster Recovery Plan (IT) Alternate Site 1 Bogotá Distribution Cash Complex Distance: 15 km All our IS with it s data and IS RTO Between 30 min. and 2hrs. RPO 0~ On line (Synchronous) IT Mechanisms: Fiber optics connected Clusters Replication SW / SAN Storage Load balancing between sites Alternate Site 2 Barranquilla B.R. Branch Distance : 900 km Only critical IS with it s data RTO Between 6hrs.and 24hrs. RPO Min 10 min. to 1w. IT Mechanisms WAN link Asynchronous replication Tapes delivered weekly

15 Determining BCM Strategy Business Continuity Plan (BCP) Work Force Continuity Strategy 2 alternate operational sites Bogota (70 work stations) B/quilla ( 25 ws.) Well equipped (phones, printer, fax) Internet access procedures Secure / Easy Critical Suppliers BCP Contract clauses Test their BCP with us Crisis procedures How to purchase without Budget Guarantees Authorizations What if I can t pay to my employees Worst scenario strategies Manual strategies

16 Determaining BCM Strategy Businnes Continuity Plan (BCP) Resources People - (well trained backup personnel) Processes Updated documentation Tested Principles Prevention Every body knows what to do. Detection There are clear procedures to notify and delegate Response We practice what to do if Recover Alternate site is for critical services

17 Developing and implementing BCM Response Prevention and Response Emergency System Scenarios Medical emergencies, fire, earthquakes, internal floods and terrorism. Structure Emergency directors (by building) Basic emergency teams by building sectors Specialized emergency teams (First Aid, Fire Control, Rescue) Communications network Resources in site First aid elements Fire protection systems Training and exercising (periodic emergency evacuation drill) Working with local authorities (Police, Fire Dept., Emergency line)

18 Developing and implementing BCM - Response Crisis Management Crisis structure Alerts levels Command Center Crisis Room GOVERMENT Notification Activation & Deactivation Logistics For exceptions PROCEDURES Communication plan Trained spokespersons BCP on the web Crisis portal on the web Social Networks Fb: Banco de la Republica de Colombia Notification exercises Workshops General Mock COMUNICATION IN CRISIS TRAINING

19 Exercising, Maintaining and Review Exercising Measure capacity Verify documentation Practice roles Develop skills Develop coordination Recognition Continuous improvement

20 Exercising, Maintaining and Review Review and Maintaining The objective is to update and improve BCP s, DRP and ERP Check for changes in: environment, processes,policies, people, technology, etc. Establish activities actions for improvement Schedule activities with responsibles If no changes, periodic review of plans (annually)

21 EMBEDDING BCM INTO THE ORGANIZATION S CULTURE Culture Awareness Unconscious Ignorance Unconscious Knowledge We need a organization who trust Training Communication Workshops ROC Week Awareness Experience Allows to transform Information Knowledge Tests Unexpected ones Motivate and inspire the desire conduct : Attitude Values Behavior

22 AGENDA I. The Organization Evolution II. BCMS The present III. Lessons Learned so far IV. Next Challenges

23 LESSONS LEARNED Don t begin with the technology, without involving business areas If you don t work with your suppliers, business partners, clients and related institutions your BMCS will be a failure, no matter what you have worked on it Keep moving your testing plans toward normal operation scenarios The best way to generate Continuity Culture is through the experience involving people every body must be there

24 LESSONS LEARNED BCMS is a permanent journey Keep it simple! Testing a lot never will be enough People Promote the creativity and innovation Keep the motivation Creating Awareness Report to the Top Management Maturity Level Indicators

25 LESSONS LEARNED There are collateral benefits Develop skills to: Be adaptable Improvise Delegate Coordinate Negotiate Create Positive image Good response to suppliers Protected reputation Confidence

26 AGENDA I. The Organization Evolution II. BCMS The present III. Lessons Learned so far IV. Next Challenges

27 CHALLENGES Total integration with RMS and BPM Second Alternate Site Consolidation At least 2 mock crisis with the Top Management yearly Integrate the BCMS Government Agencies to ours BCMS certified (BS 25999)

28 Thanks Fabio Mauricio Pinzón

29 Bcms - Framework Board of Directors Committee (CROC) RPMD BCM Leaders Employees Responsibilities Align Strategic Planning Objectives Scope All the organization GOVERMENT POLICIES Objective Organizational resilience Scope Critical Processes RTO < 1w Support Processes Crisis OBJECTIVES & SCOPE Internal Operational Risk Regulation DRII BS25999 ISO (?) REGULATION & BEST PRACTICES

30 Integration Financial Sector Promoted the Committe at the Financial Bank Association. Share best practices Integrate their BCMS to our BCMS Among BCP s Security & Emergency Response DRP and BCP s Government Advice the BCMS Emergency Response Organisms Communication EXTERNAL INTERNAL

31 Strategic Operation Crisis management Government Legal advisory Senior management Corporate Communication Security DGRP Coordinator Management Operation Teams Support teams SPAE Technology Services Business Logistics Planning Finance Command Transport Legal Planning Acquisitions Procurement Insurance Sub-team Operation Sub-team Logístics Sub-team Planning Sub-team Finance H.R. Control Payments Alerts