Title VI – Business continuity management

Institutions should establish a sound business continuity management and recovery plan to ensure their ability to operate on an ongoing basis and to limit losses in the event of severe business disruption.

Institutions may establish a specific independent business continuity function, e.g. as part of the RMF⁴⁷ .

⁴⁷ Please refer also to Article 312 of Regulation (EU) No 575/2013.

An institution ’s business relies on several critical reso urces (e.g. IT systems, including cloud services, communication systems, core staff and buildings). The purpose of business continuity management is to reduce the operational, financial, legal, reputational and other material consequences arising from a disaster or extended interruption to these resources and consequent disruption to the institution ’s ordinary business procedures. Other risk management measures might be intended to reduce the probability of such incidents or to transfer their financial impact to third parties (e.g. through insurance).

In order to establish a sound business continuity management plan, an institution should carefully analyse risk factors for and its exposure to severe business disruptions and assess (quantitatively and qualitatively) their potential impact, using internal and/or external data and scenario analysis. This analysis should cover all business lines and internal units, including the RMF, and should take into account their interdependency. The results of the analysis should contribute to defining the institution ’s reco very priorities and objectives.

On the basis of the abovementioned analysis, an institution should put in place:

• a. contingency and business continuity plans to ensure that the institution reacts appropriately to emergencies and is able to maintain its most important business activities if there is disruption to its ordinary business procedures; and
• b. recovery plans for critical resources to enable the institution to return to ordinary business procedures in an appropriate timeframe. Any residual risk from potential business disruptions should be consistent with the institution ’s risk appetite.

Contingency, business continuity and recovery plans should be documented and carefully implemented. The documentation should be available within the business lines, internal units and RMF, and should be stored on systems that are physically separated and readily accessible in case of contingency. Appropriate training should be provided. Plans should be regularly tested and updated. Any challenges or failures occurring in the tests should be documented and analysed, with the plans reviewed accordingly.