Central Bank of Jordan Business Continuity Plan Instructions No. 7/2006

In the name of Allah, the Most Gracious, the Most Merciful

Central Bank of Jordan

No.: 3248 / 10
Date: 2/5/1427 AH
Corresponding to: 20/3/2006 AD

Instructions
Business Continuity Plan
No. (7/2006)
Issued by the Central Bank of Jordan pursuant to the provisions of Article (99/b) of the Banks Law

With the Central Bank of Jordan's keenness to ensure the continuity of work for banks in cases of emergencies, disruption, and interruption that may occur, I have decided the following:

Article No. (1): Definitions:
a. Business Continuity Plan is the plan that ensures the restart of the institution's operations, especially the sensitive ones, after an acceptable period of interruption. b. Disaster Recovery Plan is a part of the Business Continuity Plan which is activated in cases of major emergencies or disasters that result in high risks.
c. Business Impact Analysis is the mechanism through which the impact (results) of disruption and interruption on business is determined.

Article No. (2): All banks shall develop plans for business continuity with the necessity of adhering to the principles mentioned in Article No. (3) below.

---

Article No. (3): General Principles for Business Continuity Plans:
The following general principles that banks must adhere to to ensure the effectiveness of business continuity plans are listed below:

Principle One: Responsibilities of the Board of Directors and Senior Management: The responsibilities of the Board of Directors and Senior Management include the following matters:
a. Allocating sufficient resources, including qualified human resources capable of preparing and developing business continuity plans. b. Establishing policies related to the management and control of risks in this regard.
c. Reviewing the results of business continuity plan audits.
d. Approving business continuity plans and their amendments at least annually. e. Ensuring that business continuity plans are updated continuously whenever necessary, and that relevant human resources are qualified and trained to perform their assigned tasks regarding those plans.

Principle Two: Business Continuity Plan Lifecycle: Business continuity plans must include at least the following stages:
a. Business Impact Analysis
Business impact or loss analysis is the first step in developing business continuity plans and includes the following:

1. Determining the probabilities of impact (losses) resulting from various expected and unexpected incidents on operations and activities.
2. Taking all operations and activities into consideration when analyzing impact, and not limiting this to matters directly related to information technology and systems.
3. Estimating and calculating the acceptable and tolerable interruption time and the potential losses accompanying the interruption.

---

b. Risk Assessment
Risk assessment is the second step in the business continuity plan development process and includes the following:

1. Ranking operations and activities exposed to disruption and interruption according to their importance, taking into account the probability and frequency of occurrence of disruption and interruption.
2. Conducting a gap analysis by comparing the time required for restart as stated in business continuity plans with the requirements to achieve business objectives.
3. Identifying various potential threats and analyzing the impact of these threats in terms of risks that may occur and negatively affect the bank's revenues, activities, clients, and staff.

c. Business Continuity Plan Development
The plan must:

1. Be written and distributed to concerned parties to ensure their knowledge of the procedures to be followed in cases of various disruptions and interruptions.
2. Identify the situations requiring the activation of the plan at the required speed.
3. Identify the urgent steps and procedures to be followed to activate the plan in the event of disruption and interruption.
4. Possess the necessary flexibility to face unexpected threats or changes that may occur (Unanticipated threat Scenarios) in working conditions and mechanisms.
5. Focus on how to restart and continue business.
6. Be effective so as to reduce the impact of disruption and interruption and minimize losses to the lowest possible extent.

CENTRAL BANK OF JORDAN
Central Bank of Jordan

d. Continuous testing, reviewing and updating business continuity plan:
It must be ensured of the effectiveness of the business continuity plan by following the following matters:

1. Auditing the plan at least once a year.
2. Subjecting the plan to independent reviews by internal audit.
3. Continuously updating and amending the plan based on surrounding internal and external circumstances.

Principle Three: Other Policies:
The following policies must be taken into consideration:
a. Information technology systems and infrastructure life cycle
b. Change control policies
c. Data management and data retention procedures
d. Training plans
e. Insurance policies
f. Policies for communicating with state institutions such as Civil Defense, Police, and Public Security.

Governor
D. Amieh Touqan

Form (1/1/9)
4