Business Continuity Management Framework

Executed Tests 1. Detailed results of all exercises and tests should be documented for future reference. The exercises/tests results should include, but not be limited to the following considerations: a. Confirm meeting the objectives of the exercised plan b. Confirm capabilities and readiness of recovery resources c. Document lessons learnt and the required improvements d. In case of failure, Capture the root-cause of the failure and remediation actions should be tracked to successful conclusion 2. Re-testing of the plan within the defined timelines in case of a failure, the timelines should not exceed the limit of three (3) months. 3. The Internal Audit of the Member Organization, or a qualified external auditor, should observe the business continuity and disaster recovery testing activities as an independent participant in order to provide a reasonable assurance on the executed activities, test results and to observe if the executed tests are meeting the Member Organization's overall Business Continuity program objectives. 4. All BCP and DRP tests results should be reported to the BCM committee, senior management and the board of directors. 2.10 Awareness and Training Principle The Member Organization should establish, Implement and maintain a training and awareness program that effectively supports the BCM objectives by developing the required competency among staff. Objective The Member Organization should ensure BCM integration into its day-to-day activities, through an ongoing awareness plan, which should be documented. Control considerations 1. The Member Organization and relevant third-parties, such as providers and suppliers should be: a. Familiar with relevant parts of business continuity policy and plans b. Contractually bound to provide their services or products within the agreed time, in case of disruptive event c. Familiar with their point of contact or their local BCM coordinator in the Member Organization d. Familiar with their roles and responsibilities during disruptive incidents 2. A training program should be provided once on an annual basis to employees involved in BCM to achieve the required level of experience, skills and competences. 3. The Member Organization should periodically measure the effectiveness of the training and awareness program. 2.11 Communication Principle The Member Organization should define, establish and maintain a communication process for periodic communications with SAMA on matters related to its BCM program. Objective To ensure that continuous communication is maintained with SAMA by defining, agreeing and adhering to communication protocol, frequency, and roles and responsibilities for communications Control considerations The Member Organization should report all disruptive incidents classified as "Medium" or "High" to SAMA "Banking IT Risk Supervision" immediately. A post-incident report should be communicated to SAMA after the Member Organization resumes to normal operations. The Member Organization should coordinate with SAMA Supervision when communicating with the media in case of incidents. Member Organizations should seek SAMA's approval when selecting a new site for its main or alternative data center, or when relocating the current main or alternative data center. The Member Organization should communicate the approved program for executing business continuity and disaster recovery tests, for the upcoming year, with SAMA "Banking IT Risk Supervision" by end of January of every year. Test results of business continuity and disaster recovery should be shared with SAMA within four weeks after the test The Member Organization should identify the improvements based on the test performed and provide an action plan to SAMA within two months after the submission of the test results.