The policy should include following topics:
- Objectives of the policy
- Scope of the policy
- the timeframe to be covered
- Criteria for activation and deactivation of the plans
The policy should also include:
- Governance and organization for implementing the policy, including roles and responsibilities
- Escalation procedures ensuring sufficient resources are available
The policy should take into account how ICT continuity plans align with other business continuity plans.
The policy must contain maximum recovery time for critical functions that must not be over two hours. It must take into account external links and interdependencies with financial industry infrastructure.
The policy must require arrangements for:
- Ensuring continuity of critical operations
- Maintaining secondary processing site capable of ensuring continuity
- Maintain or haver immediate access to secondary business site
- Consider need for additional processing sites
The ICT Business Continuity Policy must consider dependencies on users, critical service providers, other market infrastructures, and ensure that critical or important functions can be recovered within 2 hours. For trading venues, the policy must also ensure that trading can resume within or close to 2 hours of disruption, with minimal to zero data loss from any IT service.
