Posts about:
On June 30, 2021, the Federal Financial Institutions Examination Council (FFIEC) released a new Architecture, Infrastructure, and Operations (AIO) booklet, as part of their IT Examination Handbook. This new booklet supersedes and replaces the previous Operations (OPS) booklet, incorporating and expanding on information technology topics in the context of enterprise goals and objectives.
In its simplest form, business continuity planning (sometimes referred to as business continuity management) is how you prepare for resilience of systems, business processes, and overall operations during adverse circumstances. Business continuity planning is a multi-faceted process, most often including these elements:
NOTE: This article may contain outdated information. See the updated article for details: Updated Ransomware Self-Assessment Tool (R-SAT 2.0).
If your organization operates in an area which could be affected by hurricanes, your Business Continuity Plan (BCP) should include steps to help your organization prepare for the time before, during, and after a hurricane.
In August 2020, the US-CERT Cybersecurity & Infrastructure Security Agency published an alert regarding a malicious actor using COVID-19 as an opportunity for phishing and compromising credentials. The bad actor was sending a phishing email with a link to a spoofed version of the COVID-19 loan relief webpage. As usual, malicious actors are ruthless but clever.
In July 2020, the National Credit Union Administration (NCUA) published their updated 2020 Supervisory Priorities. In the "Information Systems and Assurance (Cybersecurity)" section, the NCUA stated:
In the process of conducting a work from home risk assessment, once you have identified reasonably foreseeable threats to your organization and data, the next step is to evaluate and implement controls.
If you have decided to conduct a work from home risk assessment, the first step in the process is to identify reasonably foreseeable threats. In the context of a remote work environment, you should be evaluating people, process, and technology threats. The success of such a threat may result in the compromise of your customer, member, or organization data. Here are five threats to keep in mind, as you begin your risk assessment.
Securing customer, member, and organization data while employees work remotely is a timeless topic, but it takes on a unique angle when organizations are doing so out of an effort to continue operations amid a pandemic.
Yes, I was able to check the box on my audit that asked if we have a Business Continuity Plan (BCP). I was even able to say it was approved by our Board within the past 12 months. My compliance checklist is clean, but how do I know if the plan will really help during a disaster?