. Financial institutions could improve their cyber resilience by proactively developing cyber incident management plans. Important during the development of these incident response plans is recognizing the multiple facets of dealing with cyber incidents; for example, impact on business operations, legal requirements, communication to stakeholders, and human resources. Recently observed attack vectors like those of crypto-ransomware or fraudulent wholesale payments, form a good basis for scenario-driven testing of the incident response plans. 19. Additional key areas to
-mail: publications@imf.org www.imfbookstore.org www.elibrary.imf.org Contents I. Introduction II. BCP within an Operational Risk Management Framework III. The Evolving Nature of Threats and Solutions for Cash and Debt Management IV. A Practical Approach to Developing a Business Continuity Plan V. Conclusion Annexes Annex I. BCP Template Annex II. Business Impact Analysis Methodology Annex III. Process Analysis Template/Example Annex IV. Incident Management Team Annex V. Pocket Card Annex VI. Scenario and Simulated Live Tests References
procedures to minimize or where possible eliminate the risk of disruption. Transference , where risks are passed to third parties by taking out insurance and/or reinsurance, outsourcing or devolving critical activities to third parties, and establishing facilities to provide financial resources in the event of a major incident. 18 Containment , where the potential impact of an event occurring is limited in the early stages using controls or other techniques and putting in place escalation procedures including an Incident Management Team (IMT) to manage major incidents
prolonged disruption; and (iii) return to normal operations as quickly as possible. An important part of the DRP is the structure of incident management and recovery teams along with the administration and IT support. An example of a command center structure is provided as Figure 5 . Figure 5: DRP Command Center Structure Step 4: Implement the BCP/DRP Once the BCP/DRP has been approved, the risk champion or risk management unit can oversee the implementation of the BCP/DRP and incorporate it into the wider ORM monitoring and control policies and