Lack of Bank Involvement in Annual DR Testing
Severity Level: Priority 2
Category: Compliance / Business Contiunity
Description:
The bank conducts integrity tests and participates in ASI DR tests but lacks full involvement in server DR testing, missing opportunities to validate RTO, RPO, and procedures.
Impact:
- Unvalidated recovery processes may fail during real incidents.
- Non-compliance with DR testing standards.
- Outdated recovery scripts increase recovery time.
FFIEC Reference:
- FFIEC IT Examination Handbook (November 2016):
- "Institutions must test DR plans annually with stakeholder involvement." (p. 55)
- "Validated RTO/RPO ensures operational resilience." (p. 57)
Recommendations:
- Involve Bank Staff: Include bank personnel in annual server DR tests.
- Evolve Test Scripts: Update scripts based on test outcomes.
- Validate RTO/RPO: Measure and refine recovery metrics.
- Document Procedures: Maintain current DR documentation.