Back-Up Operation Centers and Data Recovery Sites

MEMORANDUM Series of 2004

TO           : Banks and Non-Bank Financial Institutions under BSP Supervision

Subject   : Back-up Operations Centers and Data Recovery Sites

Pursuant to Monetary Board Resolution No. 1736 dated 27 November 2003, the following revised general guidelines on the establishment of back-up operations centers (alternate crisis sites) and data recovery sites are hereby issued:

1.   The board of directors of the concerned institution shall ensure that the institution’s overall business continuity plans including the alternate crisis sites and data recovery sites are adequate, fully-capable and well-prepared to meet the contingencies arising from natural and man-made disasters in order to minimize potential business disruptions.

2.   Recognizing that case-by-case operational flexibility is unavoidable, there shall be no required minimum distance between the institution’s primary operations center and back-up operations center and data recovery site. However, there must be a well-defined internal process for periodically validating that existing arrangements are adequate.

3.   In establishing or selecting back-up operations centers and data recovery sites, the following minimum features should be considered:

a)   The sites shall have multiple access through major road networks to provide alternate approaches in case of closure of critical infrastructure.

b)   The building structure shall be durable, industry-grade and shall be equipped with reliable fire detection and suppression system. The premises shall, likewise, be adequately secured.

c)   There shall be stand-by power generator and Uninterruptible Power Supply (UPS) units capable to supply the requirements of the entire facility plus enough fuel capacity to ensure continuous operations for extended periods of time.

Banks and non-banks may engage the services of third party service providers for back-up and data recovery operations: Provided, That a copy of the service contract/agreement with the designated service provider setting forth the duties and responsibilities as well as rights and obligations of the contracting parties, which shall be approved by the board of directors of the institution concerned, shall be submitted to the appropriate supervising and examining department of the Bangko Sentral at least thirty (30) days prior to its execution to enable review of its compliance with existing regulations on outsourcing of banking activities.

Although the back-up operations center and data recovery site arrangements are the responsibility of the banks/NBFIs concerned and are not required to be approved by BSP, specific information thereon must be filed with BSP within thirty (30) days from effectivity of this Memorandum for notation by the Monetary Board.

Records/information on back-up operations centers and data recovery sites arrangements of banks/NBFIs shall also be made available to BSP examiners during regular examination for purposes of ascertaining that such arrangements are updated and effective.

This Memorandum shall take effect fifteen (15) days following its publication either in the Official Gazette or in any newspaper of general circulation.

FOR THE MONETARY BOARD:

RAFAEL B. BUENAVENTURA Governor