DTCC is continually strengthening its business continuity strategy, building on new technologies, lessons learned from experience and the most effective practices to manage new threats and stay ahead of an ever-shifting risk curve.
DTCC faced its most severe continuity test to date when Superstorm Sandy struck in late October 2012, flooding the company’s Lower Manhattan headquarters and rendering the site inaccessible for months afterwards. Thanks to the successful execution of well-tested business continuity plans, the company operated seamlessly throughout the storm and its aftermath.
Now, with the approval of DTCC’s Board of Directors, the company is looking ahead to further enhance its continuity strategy.
Planning into practice
DTCC’s resiliency capabilities include a number of facilities that operate on a daily basis from geographically dispersed locations, multiple technology redundancies and a dispersed, continuity-conscious employee population.
“Our comprehensive strategy enables us to stay operational under the most challenging of circumstances, as Superstorm Sandy demonstrated,” said Donna Milrod, DTCC Chief Administrative Officer. “This level of continuity is essential given DTCC’s role as a leading provider of critical infrastructure services for the global capital markets – and to maintain that high standard, we continually evaluate and strengthen our continuity planning.”
A Street- and risk-based focus
DTCC is now fortifying its business continuity with a program called Business Continuity Management (BCM) 3.0 that will be implemented between now and 2016.
BCM 3.0 will take individual continuity plans for people, places and things and integrate them into product-based plans, according to David LaFalce, DTCC Vice President, Global Head of Business Continuity and Crisis Management.
“In the past, our continuity plans operated out of cost centers, so we had a multitude of plans, which created the potential for gaps,” he said. “Now, we are building integrated plans in order to limit that potential.”
The new program moves beyond DTCC’s traditional focus on the continuity of core clearing and settlement. “DTCC’s business has expanded into new segments of the industry, and we want to be certain we are providing the right standard of resiliency across all the company’s product lines and services,” said LaFalce. “BCM 3.0 is based on the products we provide to the Street.” The program takes a “risk-based approach” to continuity that will utilize a risk assessment of each product area to determine the level of resiliency required.
“We’ll take a gradated approach and match the controls to the risk in order to deploy our resources appropriately,” he said. “If you need to safeguard a bar of aluminum, you may not need to put it in Fort Knox. Similarly, for BCM 3.0, the level of risk will drive the level of investment.” To execute this new risk-based approach, DTCC is using a business impact analysis program that tiers products based on their inherent risk of failure to the DTCC enterprise.
Rigorous testing is another piece of the equation. “We’ll be testing product lines from end-to-end,” LaFalce explained, “which will significantly strengthen the industry’s overall resiliency.”
BCM 3.0 is also expanding the universe of potential impacts for which DTCC will plan. Whereas in the past, the company’s main focus was planning for a catastrophe and/or pandemic disease, going forward it will encompass five different impacts:
- Loss of core technology
- Loss of a critical vendor
- Denial of physical access
- Pandemic/infectious disease
“We expanded the impact list to better reflect the ever-changing threats we need to manage,” LaFalce said. “In the world of BCM, we need to continually extend the parameters of preparedness.”
To have a better, comprehensive view of its BCM plan on an ongoing and real-time basis, DTCC will centralize it in a cloud-based tool. “The technology we’re deploying will give us the ability to look at our plan from many different perspectives,” LaFalce said. “For example, we can look at horizontal cuts across the plan to identify cross-dependencies, which will help us strengthen continuity and invest resources as efficiently as possible.” The deployment to the cloud also allows for accessibility of timely information when DTCC’s own infrastructure may be impacted.
What it means for clients
DTCC’s transition to BCM 3.0 will be transparent to clients, according to LaFalce, who noted that the measure of business continuity’s success is somewhat unconventional.
“In the world of BCM, success is limiting the impact,” he said. “No news is good news and, when things do happen, we want little-to-no impact on operations. That’s what we’re aiming to deliver for the industry with BCM 3.0.”