BCP of Bangladesh Bank
Business Continuity and Disaster Recovery Plan
Business Continuity Plan (BCP) is required to cover operational risks and takes into account
the potential for wide area disasters, Data Center disasters and the recovery plan. The
primary objective of BCP is to enable a bank to survive a disaster and to reestablish normal
business operations. In order to survive, bank shall assure that critical operations can resume
normal processing within a reasonable time frame. The contingency plan shall cover the
business resumption planning and disaster recovery planning. BCP shall also address the
backup, recovery and restore process. Keeping this into consideration, this chapter covers
Business Continuity Plan (BCP), Disaster Recovery Plan (DRP) for centralized operation
and Backup and Restore Plan (BRP) for distributed operation.
7.1 Business Continuity Plan (BCP)
7.1.1 Bank must have a Business Continuity Plan addressing the recovery of disaster to
continue its operation.
7.1.2 Documents related to BCP must be kept in a secured offsite location. One copy shall
be stored in the office for ready reference.
7.1.3 BCP shall address the followings:
a) Action plan to restore business operations within the required time frame:
i) during office hour's disaster,
ii) outside office hour's disaster, and
iii) immediate and long term plan.
b) Emergency contacts, addresses and phone numbers including venders
c) Grab list of items such as backup tapes, laptops, flash drives etc.
d) Disaster recovery site map
7.1.4 BCP must be tested and reviewed regularly to ensure the effectiveness.
7.2 Disaster Recovery Plan (DRP)
7.2.1 A Disaster Recovery Site (DRS) must be in place replicating the Data Center
(Production Site).
7.2.2 DR site must be at a minimum of 10 kilometers (radius) of distance from the
production site.
7.2.3 DR site shall be equipped with compatible hardware and telecommunication
equipments to support the critical services of the business operation in the event of a
disaster.
7.2.4 Physical and environmental security of the DR site shall be maintained.
7.2.5 Information security shall be maintained properly throughout the recovery process.
7.2.6 An uptodate and tested copy of the DR plan shall be securely held offsite. DR plan
shall exist for all the critical services where DR requirement is approved by the business.
7.2.7 DR test shall be carried out successfully at least once a year.
7.2.8 DR test documentation shall include at a minimum:
a) Scope, b) Plan, and c) Test Result.
7.3 Backup and Restore Plan (BRP)
7.3.1 There shall be a documented backup procedure.
7.3.2 Bank shall ensure the safety and security of the backup copies of information from not
being damaged by natural calamities and theft (if possible to be sent at offsite location).
7.3.3 At least one copy of backup shall be kept onsite for the time critical delivery.
7.3.4 The backup shall be done periodically considering the cycle of:
a) Weekly, b) Monthly, c) Yearly or as required by regulatory authority.
7.3.5 The backup log sheet shall be maintained, checked & signed by supervisor.
7.3.6 The backup inventory shall be maintained, checked & signed by supervisor.
7.3.7 The ability to restore from backup media shall be tested at least quarterly.
7.3.8 Backup media must be labeled (soft/hard format) properly indicating contents, date
etc.
BCP of Islami Bank Bangladesh Limited
3.8 BCP Flow Chart
Figure: An Ideal Disaster Recovery Flowchart
3.9 BCP Update Management
The BCP is not a static document, it will change and evolve over time to reflect IT
infrastructure.
BCP update management is the process that is utilized to document Plan maintenance. Plan
maintenance is the ongoing activity that must occur to keep the BCP current and executable.
3.10 BCM Training
BCMT members are the key personnel to identify the exact problem and provide correct
solution immediately when any disaster occurs. BCM training is an ongoing process.
Current management and staff, along with new hires, must be kept up to date. All staffs must
have up-todate training to fulfill their responsibility towards support at recovery process.
IBBL always emphasis proper training for both local and foreign as required.
3.11 BCP Testing and R&D
Based on the training, BCMT members will be instructed to apply testing methodology and
schedules to prepare BCP tests along with post-testing plan and modification procedures.
All business shall be tested at least once in a year by BCMT.
