Vendor Resiliency Business Continuity Planning Questionnaire

Objective:
To learn about and understand the business continuity and IT disaster recovery plans of select vendors
used by xxxx, who are not covered by the xxx BCP Survey.
Scope:
xxx intends to distribute this survey to select vendors and business partners used by groups within the
Fir, who are critical to the operational readiness of xxx. It is anticipated soe vendors and business
partners will opt not to coplete this survey. In these instances, we ay extend an invitation to those
vendors to address !ey "uestions outlined in the survey by giving a presentation to ebers of the
xxxTas! Force, individual business groups and#or other support groups as needed.
The following tables outlines a series of "uestions that should help individual businesses assess the
resiliency of "ueried vendors.
General Vendor/Business Partner Resiliency Questionnaire:
A Business Continuity Strategy
$% In the event of a disaster or significant
disruption, does your organi&ation have
docuented plans for business continuity
and IT disaster recovery'
(es )))))))) or *o ))))))))
$+ If you answered ,(es- to .uestion /$%0,
what type of failure scenarios or outages
do you plan for'
)))))))))))))))))))))))))))))))))))))))))))
)))))))))))))))))))))))))))))))))))))))))))
)))))))))))))))))))))))))))))))))))))))))))
$1 If you answered ,(es- to .uestion /$%0,
what duration of tie is assued for each
type of failure scenario or outage you plan
for'
)))))))))))))))))))))))))))/please specify 2
and hours, days, wee!s, onths, etc. for each type0
$3 If you answered ,(es- to .uestion /$%0,
does the plan establish critical business
functions with recovery priorities'
(es )))))))) or *o ))))))))
$4 If you answered ,(es- to .uestion /$30,
what is the expected recovery tie for
your critical business functions'
5 6 3 hours )))))
3 6 7 hours )))))
8ithin one day )))))
% 6 + days )))))
9ore than + days )))))
:ther /please specify0 )))))
*#$ )))))
$; If you answered ,(es- to .uestion /$%0,
does the plan account for
interdependencies both internal and
external to your organi&ation'
(es )))))))) or *o ))))))))
Page % of 4
Vendor Resiliency Business Continuity Planning Questionnaire
$< If you answered ,(es- to .uestion /$%0,
does the plan cover soe, ost, or all
locations fro which you provide your
services'
Soe
9ost
$ll
:ther /please specify0
*#$
$7 If you answered ,(es- to .uestion /$%0,
what percentage of ,business as usual-
servicing capability is the plan designed to
address'
% 6 %5= )))))
%% 6 +5= )))))
+% 6 15= )))))
1% 6 45= )))))
4% 6 <4= )))))
<; 6 >>= )))))
%55= )))))
$> ?o you have a dedicated tea of
professionals focused on business
continuity and#or IT disaster recovery'
(es )))))))) or *o ))))))))
$%5 If you answered ,*o- to .uestion /$>0, do
you use an external BCP#?@ service
provider to handle your planning needs'
(es )))))))) or *o ))))))))
$%% Is your ain IT facility or data center
located in the sae building or office
coplex occupied by your ain business
or operations staff'
(es )))))))) or *o ))))))))
$%+ Please provide an illustration or scheatic
of how your organi&ationAs priary,
secondary, and#or tertiary servicing
centers are setup to provide redundant
services to custoers.
)))))))))))))))))))))))))))))))))))))))))))
)))))))))))))))))))))))))))))))))))))))))))
B Crisis Counication
B% ?o you have a docuented crisis
anageent process within your
organi&ation'
(es )))))))) or *o ))))))))
B+ If you answered ,(es- to .uestion /B%0,
does this process cover internal and
external counications during a crisis
event'
(es )))))))) or *o ))))))))
B1 Bow would you notify xxx of an outage' )))))))))))))))))))))))))))))))))))))))))))
)))))))))))))))))))))))))))))))))))))))))))
B3 ?o you provide xxx with detailed contact
inforation in the event of an outage or
eergency'
(es )))))))) or *o ))))))))
B4 Please describe how you notify your tea
of an incident and direct the through the
recovery.
)))))))))))))))))))))))))))))))))))))))))))
)))))))))))))))))))))))))))))))))))))))))))
C Bac! "p #acilities
Page + of 4
Vendor Resiliency Business Continuity Planning Questionnaire
C% ?oes your organi&ation have an alternate
site location for data center recovery
purposes'
(es )))))))) or *o ))))))))
C+ If you answered ,(es- to .uestion /C%0,
what is the approx. distance between your
production /priary0 site and alternate
/secondary0 site for data center recovery
purposes'
)))))))))))))))))))))))))) /please specify 2 and
!iloeters, iles, city bloc!s, etc.0
C1
?oes your organi&ation have an alternate
site location for wor! area recovery
purposes'
(es )))))))) or *o ))))))))
C3 If you answered ,(es- to .uestion C10,
what is the approx. distance between your
production /priary0 site and alternate
/secondary0 site for wor! area recovery
purposes'
))))))))))))))))))))))))))) /please specify 2
and !iloeters, iles, city bloc!s, etc.0
C4 ?o you use an external BCP#?@ service
provider for your data center recovery
needs'
(es )))))))) or *o ))))))))
C; ?o you use an external BCP#?@ service
provider for your wor! area recovery
needs'
(es )))))))) or *o ))))))))
C< If you answered ,(es- to .uestion /C;0, is
your contract with your BCP#?@ service
provider honored on a firstCcoe#firstC
served basis'
(es )))))))) or *o ))))))))
C7 8hat recovery strategy does your
organi&ation use for ainfrae systes' $ctive#$ctive )))))))
$ctive#Bac!Cup )))))))
Dendor Supplied )))))))
:ther )))))))
*#$ )))))))
C> 8hat type of recovery strategy does your
organi&ation use for distributed systes'
$ctive#$ctive )))))))
$ctive#Bac!Cup )))))))
Dendor Supplied )))))))
:ther )))))))
*#$ )))))))
C%5 Is the processing capacity of your bac!Cup
facility e"ual to that of your priary
facility'
(es )))))))) or *o ))))))))
Page 1 of 4
Vendor Resiliency Business Continuity Planning Questionnaire
C%% If you answered ,*o- to .uestion /C%50,
what is the capacity ratio of your bac! up
to your priary facility'
% 6 %5= )))))
%% 6 +5= )))))
+% 6 15= )))))
1% 6 45= )))))
4% 6 <4= )))))
<; 6 >>= )))))
%55= )))))
*#$ )))))
C%+ Is it feasible to run fro you bac!Cup
facility for an extended period' /e.g. at
least six wee!s0
(es )))))))) or *o ))))))))
$ %esting
?% If you answered ,(es- to .uestion /$%0, is
the plan periodically tested' (es )))))))) or *o ))))))))
?+ If you answered E(esE to .uestion /?%0,
how fre"uently is the plan tested' $nnually )))))
SeiCannually )))))
:ther /please specify0 )))))))))))))))))))))))))
?1 ?o you have BCP test dates scheduled
over the next %+C%7 onths' (es )))))))) or *o ))))))))
?3 If you answered E(esE to .uestion /?10,
please list those dates )))))))
)))))))
)))))))
)))))))
)))))))
?4 If you answered E(esE to .uestion /?%0,
do you involve IT staff, business unit or
operations staff or both in your internal
BCP#?@ tests'
IT staff only )))))
Business Fnit or :perations Staff only )))))
Both IT and Business Fnit or :perations Staff))))))
?; If you answered E(esE to .uestion /?%0,
would you involve xxx in your external
BCP#?@ tests'
(es )))))))) or *o ))))))))
?< If you answered E(esE to .uestion /?%0,
do internal or external auditors review
your BCP#?@ tests'
(es )))))))) or *o ))))))))
Page 3 of 4
Vendor Resiliency Business Continuity Planning Questionnaire
?7 If you answered ,(es- to .uestion /?%0
what coponents of your systes and
infrastructure are tested'
$pplications ))))))
9iddleware ))))))
?atabases ))))))
?ata networ!s ))))))
/internal and external0
Doice networ!s ))))))
/internal and external0
?es!top ))))))
Facilities ))))))
Doice e"uipent ))))))
& Septeber ''
t(
G% ?id your organi&ation invo!e its business
continuity or IT disaster recovery plan/s0
as a result of the Septeber %% tragedy'
(es )))))))) or *o ))))))))
G+ Bas your organi&ation enhanced its
business continuity planning initiative, or is
in the process of enhancing its plans in
light of Septeber %%'
(es )))))))) or *o ))))))))
# BCP Support
F% Please provide priary and alternate
contact inforation for counication
during an eergency.
)))))))))))))))))))))))))))))))))))))))))))
)))))))))))))))))))))))))))))))))))))))))))
Page 4 of 4