Laserfiche WebLink
resiliency planning and testing to ensure we can manage our risk and our clients <br />risk within a reasonable time period. <br />A summary overview of J.P. Morgan's CIB business resiliency planning is <br />provided for your review in Appendix 6. If you require more detail regarding our <br />business resiliency planning methodology, we will be pleased to arrange a <br />meeting for you with members of our business resiliency staff. <br />2. Where are off -site facilities located? How quickly can this facility be activated <br />in the event of an emergency? <br />Due to the sensitive nature of this information, J.P. Morgan does not release <br />specific details on the location of primary and backup data centers and <br />processing sites. <br />All backup sites and hot -site locations are in a separate zone or region depending <br />on the product and regulatory requirements of the country in which we are <br />operating. J.P. Morgan's corporate policies use the zone designation to measure <br />and depict local diversification of infrastructure and access. <br />To address wide -scale disruption, the term region, as a designation, is used to <br />measure and depict the susceptibility of multiple locations to the same wide -scale <br />disruption. An analysis to determine zone and region designation is performed by <br />our Corporate Real Estate /Corporate Security /Global Life Safety business units <br />with input from Corporate Technology and Corporate Resiliency Risk <br />Management. <br />Each J.P. Morgan business unit performs a formal Business Impact Analysis <br />(BIA) to assess the operational, financial and reputational impact of a service <br />disruption on clients and the firm. The results of the business impact analysis are <br />used to determine the criticality of the function and the corresponding recovery <br />time objective. <br />Recovery time objectives and service levels vary based on criticality of the specific <br />business function. For our most critical functions, we apply a 2-hour recovery <br />time objective for full resumption of normal operations. For other functions, we <br />apply recovery time objectives ranging from 4 -72 hours. For the least critical <br />functions, we apply a recovery time objective of 73 +, which results in those <br />business functions deferred and /or suspended. <br />Business and support group areas must identify their requirements based on <br />their process capacity needs to address a loss of an entire zone for a minimum of <br />3o days. This enables businesses and support groups to stage their recoverability <br />over that time period. <br />Page 82 J.P. Morgan <br />55E -177 <br />