J.P. MORGAN CHASE BANK-2016 - Laserfiche WebLink

Home Browse Search

a z w 0 LL Z 0 u v z a a LL r J u Testing, Training and Education All plans must comply with the Firms' Corporate Testing policy and test cycle. Each resiliency plan is tested annually, at a minimum. Exercises can include: • Notification Testing: Assure the accuracy and completeness of call tree information is maintained through organizational changes. • Walkthrough: Familiarize the business unit or support group staff with the plan and their role in its execution. This validates that the resiliency plan incorporates all critical processes and helps to identify gaps or other weaknesses requiring remediation. • Simulation Testing: Validate and share assumptions, including those related to dependencies, and the ability of support groups, third parties, and other vendors to provide support. A scenario -based exercise, simulation testing is an interactive session where participants are presented with a disruption and must react to one or more impacts and make critical decisions. ■ Full Physical: Validate the ability to recover business units, processes, applications, and infrastructure within the established recovery time objective without dependency on the primary location. Business management is aware of all activity leading up to the execution of the test. Post -test reports are reviewed with business management upon completion of the event. A central log is maintained of significant issues encountered during a test. Each month the list of issues, if any, is updated to reflect the current status, including actions taken, reviewed with business management and escalated as appropriate. Issues that arise during testing are retested within an appropriate timeframe. Resiliency plans supporting critical business processes are reviewed and updated annually or more frequently when there are significant changes in the environment. Plan maintenance sessions are typically comprised of a formal review of all aspects of the applicable resiliency plan and updates are contemporaeneously made, as necessary. Every J.P. Morgan employee is required to complete Business Resiliency training annually. The objective of this training is to provide an overview of the key components of business resiliency and illustrate how each individual employee can support and play a role in Business Resiliency. Core resiliency skills training is also available for Business Resiliency Professionals and Coordinators. In addition, J.P. Morgan has a formal, centrally managed, assessment process to evaluate the adequacy of security, disaster recovery and business continuity controls in place at critical third parties. A critical third party is an external entity, which provides a product or service that has client, revenue, regulatory or reputational impact to J.P. Morgan. Business Resiliency plans are subject to reviews by J.P. Morgan's Global Business Resiliency group, which acts as the Firm's governing body for Business Resiliency measures. The plans must address and comply with documented organizational requirements. All findings are escalated to the business units, Risk Management and division executive for review. Additionally, the Corporate ft Investment Bank line of business Quality Planning Program has been designed to assess, challenge and enhance all Corporate ft Investment Bank Business Impact Analysis and Business Resiliency Plans to ensure businesses develop recovery solutions that are specific to their needs taking into consideration the business model, location strategy, operating assumptions and key dependencies. The program stress tests existing J P.Morgan