Circular regarding Business Continuity Plan Instructions No. (9943/1/10) dated 2014/8/17

In the Name of Allah, the Most Gracious, the Most Merciful

CENTRAL BANK OF JORDAN
البنك المركزي الأردني

No.: 1/10/9943
Date: 21/10/1435 AH
Corresponding to: 17/8/2014 AD

Circular to Licensed Banks

Subsequent to Business Continuity Plan Instructions No. (27/2006) dated 30/3/2006, and to our Circular No. (1/10/10740) dated 28/8/2013, whereby you were required to appoint your auditors to examine the reliability of the Business Continuity Plan for the Electronic Clearing Service, I hereby affirm the following:

1. Compliance with the provisions of Business Continuity Plan Instructions No. (27/2006) dated 30/3/2006, and reading the clauses below within the general understanding of the instructions' provisions.
2. Prioritizing the protection of banks' assets and operations based on their relative importance in planning to ensure the continuity of critical operations, foremost of which is preserving the safety of human resources within organized disaster recovery plans subject to continuous updating, examination, and training.
3. Allocating necessary budgets for the development, operation, examination, and sustainability of Business Continuity Plans within the framework of the banks' comprehensive strategic planning.
4. Documenting Business Continuity Plans, including decision-making mechanisms, incident classification rules, various options that may be followed as recovery strategies and their procedures, tasks of the various teams to be involved, telephone contact lists for team leaders, team members, employees, and service providers, and evacuation procedures, including the designation of assembly points.
5. Organizing Business Continuity Plans by establishing hierarchical organizational structures and steering committees, and including job description documents with specific responsibilities that ensure the sustainability, reliability, and validity of those plans, with a central entity (Risk Management and related Steering Committees) assuming final responsibility for issuing those plans in coordination and cooperation with all relevant organizational units.

CENTRAL BANK OF JORDAN
البنك المركزي الأردني

6. Including internal and external auditor programs with mechanisms that ensure continuous monitoring and follow-up of Business Continuity Plans.
7. Committing to disseminating awareness of the concepts and objectives of Business Continuity Plans within the framework of the general risk management culture, and continuously training all employees, and specifically individuals participating in recovery scenarios and strategies, on the duties and responsibilities assigned to them regarding those plans, ensuring that they achieve their objectives and reliability.
8. The targeted Recovery Time Objective (RTO) for critical services shall not exceed two hours, and providing the various original and alternative human and technological resources relied upon for operation and maintaining the availability of those services. Electronic Clearing Services and other similar services are considered critical services under Business Continuity Plans.
9. Developing strategies within the framework of a comprehensive disaster and incident recovery plan for Information and Communication Technology (ICT), meeting the Business Continuity Plan requirements regarding the Recovery Time Objective (RTO) for critical operations according to the Business Impact Analysis (BIA), including at least and specifically the following matters:
   a. Preparing an original site and an alternative site to operate ICT resources in a suitable location different in terms of the likelihood of being exposed to the same threats as the original site, including all necessary technological resources in the form of servers, software, data, information system protection solutions, communication means, and protection devices to guard against physical and environmental threats. b. Diversifying the use of communication lines and relying on more than one service provider for this purpose.
   c. Following sound practices and using appropriate solutions in backup procedures to maintain the confidentiality, integrity, and availability of such data, and examining them through retrieval to verify their reliability. It is necessary to follow sound practices regarding the transportation and storage of backup media, and activating necessary controls, including dual control and access procedures, while providing environmental protection requirements and diversifying storage and preservation locations.

CENTRAL BANK OF JORDAN
البنك المركزي الأردني

10. Developing scenarios for business continuity examinations, committing to conducting those examinations regularly, documenting those examinations, analyzing them, and taking feedback to improve the performance and reliability of plans, and training on their implementation and working to update them continuously.
11. Ensuring that agreements signed with external providers regarding technical support for services in general and critical services in particular include their responsibilities for providing the required support within supplementary agreement conditions (Service Level Agreement (SLA)) that ensure availability at the highest levels and details in all circumstances, commensurate with the banks' requirements according to their Business Continuity Plans in this regard.
12. Banks' outsourcing policies must consider the necessity of third parties having verified Business Continuity Plans, with independent periodic verification at least annually, ensuring the availability and confidentiality of banks' data and operations in the event of any emergency that may lead to the interruption of those services. This rule must be applied as an important criterion when selecting third-party service providers, and contracts and agreements signed with providers must reflect these requirements, and current providers must be contacted to regularize their status to comply with this.

Finally, I emphasize the necessity of taking the necessary measures to correct the weaknesses mentioned in your auditors' reports pursuant to our aforementioned circular, and that both the internal and external auditors undertake the task of continuous monitoring thereof within their regular periodic audit programs. Please note that we will take the necessary measures to ensure your compliance with our instructions and with the auditors' reports in this regard.

Please accept the highest respect and appreciation,

The Governor
Dr. Ziad Friez