Pandemic Exercise Report Released; Calls for Enhanced Preparations

Staffing, Supply Chain Among Issues That Still Need to be Addressed
Pandemic Exercise Report Released; Calls for Enhanced Preparations
A new report on last fall's national pandemic exercise reveals that financial institutions still have key areas to address in preparing for a global flu outbreak.

Workforce, supply chain and third-party service providers are among the issues targeted for further refinement in institutions' business continuity planning.

The report builds off initial test results released in October by the US Department of Treasury, the Financial Services Security Coordination Council for Critical Infrastructure Protection and Homeland Security (FSSCC) and the Financial and Banking Information Infrastructure Committee (FBIIC).

These agencies, as well as the Securities Industry and Financial Management Association (SIFMA), sponsored the pandemic event, which was conducted between September 24 and October 12, 2007. To date, this is the largest pandemic exercise ever held for financial services industry.

The new report compares the responses of more than 2700 participating firms and institutions on issues including plans for telecommuting, stockpiling personal protection equipment such as respirators and anti-viral medications and other continuity measures. The report also compares pandemic preparedness in large and small institutions.

"We would certainly like to see every institution take what was learned from the exercise, and use it as they develop their business continuity plans," says Jim Binder, spokesperson for the FSSCC.

Specifically, more work is necessary in bolstering the dependencies that institutions rely on in order to operate during a pandemic outbreak. "Given the wide area covered by the sector, in a lot of these areas there needs to be a better understanding of the dependencies the institutions will be facing," Binder says.

Among these key dependencies:

  • Telecommuting - Who comes to work, who stays home?
  • Transportation - How do urban employees get to work if public transportation is cancelled?
  • Training - Which staff members are cross-trained in which activities?
  • Third-party service providers - In terms of supply chain and vendors, what are items or services an institution needs to operate at even minimum levels?

Binder notes that institutions with supply chain and third party service provider questions will find them more easily answered by new guidelines being prepared by SIFMA. "This set of guidelines will set out clearly what they will need to know from their vendors," Binder says, including answers to questions such as 'Does the armored truck company have enough staff to deliver the money shipment, and will it have enough fuel for the trucks carrying the cash?'

These are the types of granular actions that institutions must consider when planning for a pandemic. "The level and involvement of institutions in the national test should help them in their efforts in complying with the regulatory guidance," Binder says, and also help bring to the surface underlying problems or shortcomings in their institution's pandemic plan.

Pandemic Preparation: One Institution's Experience
Among those institutions participating in last fall's exercise was a California credit union that - since the experience - has begun addressing several of the areas highlighted by the new report.

"What our credit union found from the test was that there are a number of areas within our organization where we would be adversely impacted," says Michael Luckin, Senior Vice President of Delivery Systems at Technology Credit Union (www.TechCU.com), San Jose, CA. "Principally the unknown of whether people would come to work or not during a pandemic. That's the big 'if' question for us."

Tech CU, listed as the nation's 75th largest credit union, with $1.4 billion in assets and 10 locations, has been involved in several pandemic exercises in the past (three exercises in the last year). "We've seen clearly the human resource question is going to be one of the biggest unknowns we face," Luckin says.

At a projected 25 percent absenteeism, Luckin says the credit union would be able to operate smoothly. "But if 50 percent absenteeism were to come to fruition, (the test topped its absenteeism rate at 49 percent) it's going to be a whole lot bigger issue for everyone," Luckin says.

Staffing for third-party service providers also came into question when the credit union recently interviewed prospective vendors for a disaster recovery site.

"We posed the question to one of the vendors and asked specifically, 'If a pandemic comes, do you have the resources to manage a service environment or a co-location or a data center?'" Luckin says. "This vendor was somewhat taken aback. They had not been asked this question before."


About the Author

Linda McGlasson

Linda McGlasson

Managing Editor

Linda McGlasson is a seasoned writer and editor with 20 years of experience in writing for corporations, business publications and newspapers. She has worked in the Financial Services industry for more than 12 years. Most recently Linda headed information security awareness and training and the Computer Incident Response Team for Securities Industry Automation Corporation (SIAC), a subsidiary of the NYSE Group (NYX). As part of her role she developed infosec policy, developed new awareness testing and led the company's incident response team. In the last two years she's been involved with the Financial Services Information Sharing Analysis Center (FS-ISAC), editing its quarterly member newsletter and identifying speakers for member meetings.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing cuinfosecurity.com, you agree to our use of cookies.