<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

New BCP Guidance from the FFIEC

author Michael Berman
1 min read
Feb 26, 2015

In addition to the already existing 2008 Handbook on Business Continuity Planning (BCP), the FFIEC has just issued a 16 page addendum offering up new BCP Guidance. The addendum is aptly titled “Strengthening the Resilience of Outsourced Technology Services”.

It starts by emphasizing that outsourced relationships with third-party service providers (TSP's) are an efficient way for banks and other financial institutions to perform important procedures, such as ensuring the Board continues to watch over those relationships.

The addendum then focuses on 4 points of resiliency:

  • Managing the continuity risks of critical third-party relationships
  • Understanding the concentration risk when a third-party provides you with multiple services
  • Validating BCP’s with testing
  • Confirming that your BCP can deal with a disruption caused by a cyber-event

The relationship with third-party management begins in the due-diligence phase and long before engaging with the provider. At this point, financial institutions should do a comprehensive review of the effectiveness of a vendor’s BCP, and the oversight process the vendor has in place for managing its subcontractors.

Once a decision has been made to engage with the service provider, naturally, a contract is the best way to determine the accountabilities on each side. Business continuity requirements should change over time, which means consistent monitoring of this critical aspect of the management life-cycle.

The BCP guidance also requires institutions to think about the need to replace an important provider that may not be able to fulfill its obligations. This could happen over a period of time, but the institution must be ready to minimize any negative impact the declining service may have on being able to meet their internal recovery time objectives independently from the failed service provider. It's best to have a plan in place for switching to a new service provider, or move all of the operations in-house, quickly and efficiently.

Lastly, the guidance also addresses the importance of responding to a cyber-event. Since the cyber landscape continues to evolve, updating incident response plans in an essential key to maintaining resiliency and, in some cases, regulatory compliance.

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Business Continuity Third-Party Vendor Management Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings OCC Regulatory Compliance Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Artificial Intelligence Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Mortgage Lending Nboardportal Verify integrated risk management
Why Vendor BCP Matters: Texas Storm Knocks Massachusetts CU Offline
Risk & Compliance

Why Vendor BCP Matters: Texas Storm Knocks Massachusetts CU Offline

Feb 23, 2021 3 min read
Becoming Unbreakable: Why Business Continuity is Critical for FIs
Risk & Compliance

Becoming Unbreakable: Why Business Continuity is Critical for FIs

Feb 5, 2016 1 min read
Think Your BCP Hasn’t Changed Over the Past Year? Think Again.
Risk & Compliance

Think Your BCP Hasn’t Changed Over the Past Year? Think Again.

Feb 4, 2021 3 min read