Beazley Plc · LSE:BEZ

Beazley — Investor Presentation (December 2019)

69 slides from Beazley's investor presentation, Dec 4, 2019

Slide 1: Basics of Business Continuity Planning For Financial Institutions
Basics of Business Continuity Planning For Financial Institutions December 4, 2019
Slide 2: Beazley Breach Response (BBR) Services workshop program
Beazley Breach Response (BBR) Services workshop program • Basics of Business Continuity Planning • Eligibility for other workshops • To learn more o Visit the Workshops page by clicking on Services on beazleybreachsolutions.com o Email bbrservices@beazley.com
Slide 4: Today's Presenter
Today’s Presenter Troy Harris Senior Director, Risk Consulting • 16 years in RSM’s national Business Continuity Planning consulting practice • Over 20 years of BCP experience − Experienced in both information technology (IT) disaster recovery planning and operations/business resumption planning − Se
Slide 7: Business Continuity Plan (BCP) Definition
Business Continuity Plan (BCP) Definition • Documented and formal arrangements for resuming critical business operations in a timely manner following a disaster or other disruption − “Timely” may equal “Immediate” − Degraded operations may suffice temporarily − Focus is on sustaining the business −
Slide 8: BCP vs. Broader Risk Management
BCP vs. Broader Risk Management* • Business Continuity • Other Risk Management Planning Elements: Initiatives: − Crisis Management − Emergency Response Plans/Crisis Plans Communication Plans − Incident Response − IT Disaster Recovery Plans/Incident Action Plans (DR) Plans − Information Security − Bu
Slide 9: Basic BCP Concepts
Basic BCP Concepts • Functions and systems must be inventoried and prioritized for recovery • BCPs should primarily address your aggregate risks and scenarios • Recovery processes should leverage pre-established strategies for key requirements • The organization’s BCP is a collection of multiple “re
Slide 11: Ongoing BCP Program
Ongoing BCP Program • Should encompass all facets of the BCP Program, including: − BCP Policy and Program Charter − Business Impact Analysis (BIA) − Disaster Risk Assessment (DRA) − Recovery strategies − BCP − Testing Schedule and Procedures − Training Schedule and Procedures 11 ©2019 RSM US LLP. Al
Slide 12: Ongoing BCP Program continued
Ongoing BCP Program continued • Activities should be performed according to an established schedule and in response to designated “triggering” events: − Log activities and report progress to Steering Committee, etc. − Respond to organizational changes, test results, audits, etc. − Adjust schedule an
Slide 14: FFIEC BCP Handbook
FFIEC BCP Handbook • High-level guidance on best practices and regulatory requirements for a sound planning program • Follows closely with industry best practices • Aligns with the methodologies developed by RSM, Disaster Recovery Institute International (DRII), and other industry sources • Suppleme
Slide 15: FFIEC BCP Handbook – Key Focus Areas
FFIEC BCP Handbook – Key Focus Areas • Enterprisewide continuity planning • Management oversight and support – including formal and documented Board approval • Business impact analysis (BIA) and disaster risk assessment (DRA) • Strategic risk management • Adequate risk reduction strategies and recov
Slide 16: FFIEC BCP Handbook – Key Focus Areas continued
FFIEC BCP Handbook – Key Focus Areas continued • Ongoing testing and maintenance programs • Including logging (documentation) of activities and the associated results • IT disaster recovery and increased IT complexity • Integration with third-party service providers • Consideration of security 16 ©2
Slide 17: FFIEC BCP Handbook – "Recent" Additions
FFIEC BCP Handbook – “Recent” Additions • Pandemic Response Planning • Tiered regulatory assessment • Increased emphasis on previous guidance • Board and Senior Management involvement • Cyclical planning process • Business Impact Analysis (BIA) • Comprehensive assessment of third-party risks • Failu
Slide 21: BCP Policy and/or Charter
BCP Policy and/or Charter • Concise, but clear and definitive • Formally approved and properly adopted • Regularly reviewed and updated • Suggested topics: • Scope, objectives, and assumptions • Roles and responsibilities with clear accountability • General approach/methodology • Timeline and budget
Slide 22: BCP Roles
BCP Roles • Executive Sponsor • Steering Committee • Business Continuity Coordinator and/or Administrator(s) • Recovery Teams − Team Leaders − Alternate Team Leaders − Team Members (and Alternates) • Evaluators/Auditors • Liaisons 22 ©2019 RSM US LLP. All Rights Reserved.
Slide 23: BCP Software Tools
BCP Software Tools • Specialized tools for developing, maintaining and storing your BCP(s) and other related materials • Support consistent and effective planning • Relational databases to support data collection and maintenance • Specialized user interfaces and output reporting • User security, ext
Slide 27: Disaster Risk Assessment (DRA) Process
Disaster Risk Assessment (DRA) Process • Assemble a comprehensive library of risk factors • Collect and analyze data from multiple sources − Perceptions − Government and industry authorities − Historical experiences − Observation − Other research • Assign ratings for Probability and appropriate Impa
Slide 28: Custom Hazard Map
28 Custom Hazard Map onuanoaunaneosaSRSSSS Peak Ground Acceleration http:/Awww.usgs.gov/
Slide 30: Risk Mitigation
Risk Mitigation • Establish formal risk mitigation plans − Priorities correlated to risk assessment results − Objectives and tasks − Responsibilities − Timelines • Monitor progress and publish status reports • Periodically reevaluate both risks and mitigation 30 ©2019 RSM US LLP. All Rights Reserved
Slide 32: BIA Process
BIA Process • Establish the BIA “framework” − Impact categories − Impact rating criteria and thresholds • Assemble a comprehensive inventory of business functions • Assess each function using the established framework • Identify and evaluate technical requirements 32 ©2019 RSM US LLP. All Rights Res
Slide 34: Technical Requirements
Technical Requirements • Identify the key technical applications or services that are required to perform each function • Individually evaluate the criticality of each system • Determine the RTO of each system requirement • Validate the data loss tolerance or Recovery Point Objective (RPO) of each s
Slide 38: Recovery Strategy Coverage Areas
Recovery Strategy Coverage Areas • Technology − Hardware, software, and data − Voice and data communication − Third-party systems and interfaces • Facilities − Workspace − Data center(s) − Specialized sites (secure areas, lobbies, meeting rooms, etc.) • Specialized equipment and other resources • Op
Slide 39: Recovery Strategy Gap Analysis
Recovery Strategy Gap Analysis • Map BIA Requirements to Current/Planned Strategies • Determine Current/Planned Capabilities − Realistic/Valid Timelines • Timing From Initial Disruption System RTO Gaps • Foundation for Estimates − Interdependency Considerations 5 11 Gap • Predecessors Meet 40 • Rest
Slide 40: Basic Recovery Strategy Options
Basic Recovery Strategy Options • Internal Resources • Specialized Vendors/Services • Business Partners • Public Resources • Acquire/Address As Needed 40 ©2019 RSM US LLP. All Rights Reserved.
Slide 41: Vendor Continuity Management Program
Vendor Continuity Management Program • Risk-rate ALL suppliers and services-providers − Different than other vendor risk assessments − Rating based on their impact to the continuity of your operations − Consider criticality of product/service, portability, etc. − Include technology providers • Evalu
Slide 44: BCP Manual – Structure and Format
BCP Manual – Structure and Format • Defined, consistent, and logical • Should facilitate (or even mimic) a recovery effort • Supported by a detailed table of contents or even chapter summaries • Segregates administrative and overview sections from actionable recovery plans • Includes team-specific s
Slide 45: Recovery Coordination Teams
Recovery Coordination Teams • Discovery and notification • BCP activation − Broad disaster identification/detection options − Clear communication and escalation channels − Defined roles and alternates − Summary graphic and detailed narrative − Defined activation criteria − Correlation to other porti
Slide 46: Recovery Coordination Teams continued
Recovery Coordination Teams continued • Initial evaluation and escalation • Damage assessment • Internal and external communication • Coordination with external parties • Coordination with other internal processes • Priority determination • Strategy selection and allocation • Overall recovery coordi
Slide 47: Departmental Business Resumption Plans (BRPs)
Departmental Business Resumption Plans (BRPs) • Team/department overview − Ongoing (“normal”) responsibilities − Disaster responsibilities • Departmental recovery strategies − Facilities/workspace − Technology − Personnel − Other • Team assignments (including alternates) • Business functions and pri
Slide 48: Departmental BRPs continued
Departmental BRPs continued • Internal resources requirements − Quantity over time (schedule) − Source (including off-site storage) • Administrative/common recovery tasks • Custom recovery tasks • Reference materials − Contact lists − Standard Operating Procedures (SOPs) − Resource inventories − Con
Slide 49: Custom Recovery Tasks continued
Custom Recovery Tasks continued IT Backup IT Disaster Plan Recovery (DR) Plan RPO RTO Temporary Operating Procedures (TOPs) Restoration Activities 49 ©2019 RSM US LLP. All Rights Reserved.
Slide 50: IT Disaster Recovery Plans (DRPs)
IT Disaster Recovery Plans (DRPs) • Overview and scope • Team assignments (including alternates) • Recovery priorities and RTOs • Recovery strategy or strategies • Resource requirements − Quantity − Specs − Source − Location − Other 50 ©2019 RSM US LLP. All Rights Reserved.
Slide 51: IT DRPs continued
IT DRPs continued • Technical restoration tasks − Restoration − Configuration − Validation • Interdependencies and other considerations • Reference materials − Contact lists − Diagrams − Inventories − Addresses and settings − Administration and support procedures − Other 51 ©2019 RSM US LLP. All Rig
Slide 52: Pandemic Response Plans
Pandemic Response Plans “Recognized variation from traditional BCPs” • Little or no impact on facilities, technology, etc. • Major impacts on staffing, customers, vendors, etc. • Leverage and integrate with crisis management plans • Consider: − Prevention and containment − Monitoring − Escalation an
Slide 55: Testing & Training – Initial Activities
Testing & Training – Initial Activities • Train personnel on the overall BCP and their specific recovery roles • Implement recovery strategies • Perform initial testing—typically walk-through exercises: − Verify the BCP is accurate, adequate and usable − Validate effectiveness of recovery strategies
Slide 56: BCP Training Program
BCP Training Program • Key positions need to develop and maintain familiarity with their role and key BCP components − Document structure and navigation − Teams and responsibilities − Activation and escalation procedures − Recovery priorities and outage tolerances − Core recovery strategies • All st
Slide 57: BCP Testing Program – Best Practices
BCP Testing Program – Best Practices • Avoids repetition − Varies test type, scope, scenario, participants, timing, etc. • Considers realistic and unpredictable disaster circumstances − Adds realism to the events • Elevates complexity and expands scope over time • Evaluates and documents/reports all
Slide 58: Basic Test Schedule
Basic Test Schedule • Rolling 24-month calendar • Specific vs. approximate information − Timing − Test type − Participants • Gain approval and commitment • Maintain and adjust as needed 58 ©2019 RSM US LLP. All Rights Reserved.
Slide 59: Enhanced Test Schedule
Enhanced Test Schedule • Test scope and objectives to be achieved • BCP objectives to be exercised • Disaster scenario to be simulated − Type − Timing − Impact • Participant roles • Constraints or other variables 59 ©2019 RSM US LLP. All Rights Reserved.
Slide 60: Disaster Scenario
Disaster Scenario • Correlate to BCP objectives and test objectives • Outline realistic characteristics and circumstances • Derive from DRA, relevant research, etc. • Integrate unfolding circumstances • Vary type, timing, impact, duration, constraints, etc. 60 ©2019 RSM US LLP. All Rights Reserved.
Slide 62: Test Results and Actions
Test Results and Actions • Test evaluation − Pre-defined objectives − Feedback from participants, evaluators, etc. − Adherence to test plan − Adherence to BCP • Test reporting • Enhancement/remediation plan − Correlated to test results − Designated responsibilities − Defined timelines • Monitoring a
Slide 65: Key Elements of an Effective BCP Program
Key Elements of an Effective BCP Program • Solid organizational commitment − Management visibly endorses the risk mitigation and recovery planning initiative • Effective risk management − Disaster risks are identified and sound mitigation measures have been implemented • Thorough BIA − Disruption im
Slide 66: Key Elements of an Effective BCP Program continued
Key Elements of an Effective BCP Program continued • Viable recovery strategies − Techniques for achieving critical recovery objectives are defined and fully implemented • Documented recovery plan − Recovery processes are defined, responsibilities assigned and reference information is available • Ef
Slide 67: Key Elements of an Effective BCP Program continued
Key Elements of an Effective BCP Program continued • Plan testing and maintenance − Realistic exercises are conducted to confirm plan accuracy, prepare participants to respond and identify enhancement opportunities − The plan is updated on a defined schedule and whenever the organization, operation
Slide 68: Key Elements of an Efficient BCP Program
Key Elements of an Efficient BCP Program • Established goals and objectives • Clear roles and responsibilities • Defined standards, methodologies, and techniques • Ongoing and regular collaboration • Proficient resource utilization • Useful and productive tools • Formal reporting and monitoring • Re
Slide 69: RSM US LLP contact details
RSM US LLP One South Wacker Drive, Suite 800 Chicago, IL 60606 312.634.3400 +00 (1) 800 274 3978 www.rsmus.com This document contains general information, may be based on authorities that are subject to change, and is not a substitute for professional advice or services. This document does not const

Beazley — Investor Presentation (December 2019) on 6ix

Beazley — Investor Presentation (December 2019)

Slide 1: Basics of Business Continuity Planning For Financial Institutions

Slide 2: Beazley Breach Response (BBR) Services workshop program

Slide 3: Business Continuity Planning for Financial Institutions

Slide 4: Today's Presenter

Slide 5: Agenda

Slide 6: BCP Overview

Slide 7: Business Continuity Plan (BCP) Definition

Slide 8: BCP vs. Broader Risk Management

Slide 9: Basic BCP Concepts

Slide 10: RSM's Business Continuity Planning Methodology

Slide 11: Ongoing BCP Program

Slide 12: Ongoing BCP Program continued

Slide 13: FFIEC BCP Guidance

Slide 14: FFIEC BCP Handbook

Slide 15: FFIEC BCP Handbook – Key Focus Areas

Slide 16: FFIEC BCP Handbook – Key Focus Areas continued

Slide 17: FFIEC BCP Handbook – "Recent" Additions

Slide 18: RSM's 5-Phase BCP Methodology

Slide 19: Program Initiation

Slide 20: RSM's Business Continuity Planning Methodology

Slide 21: BCP Policy and/or Charter

Slide 22: BCP Roles

Slide 23: BCP Software Tools

Slide 24: Requirements Definition

Slide 25: RSM's Business Continuity Planning Methodology

Slide 26: Requirements Definition: Disaster Risk Assessment (DRA)

Slide 27: Disaster Risk Assessment (DRA) Process

Slide 28: Custom Hazard Map

Slide 29: DRA Sample

Slide 30: Risk Mitigation

Slide 31: Requirements Definition: Business Impact Analysis (BIA)

Slide 32: BIA Process

Slide 33: Business Impact Analysis—Recovery Time Objective (RTO)

Slide 34: Technical Requirements

Slide 35: BIA Sample

Slide 36: Strategy Determination

Slide 37: RSM's Business Continuity Planning Methodology

Slide 38: Recovery Strategy Coverage Areas

Slide 39: Recovery Strategy Gap Analysis

Slide 40: Basic Recovery Strategy Options

Slide 41: Vendor Continuity Management Program

Slide 42: Implementation and Documentation

Slide 43: RSM's Business Continuity Planning Methodology

Slide 44: BCP Manual – Structure and Format

Slide 45: Recovery Coordination Teams

Slide 46: Recovery Coordination Teams continued

Slide 47: Departmental Business Resumption Plans (BRPs)

Slide 48: Departmental BRPs continued

Slide 49: Custom Recovery Tasks continued

Slide 50: IT Disaster Recovery Plans (DRPs)

Slide 51: IT DRPs continued

Slide 52: Pandemic Response Plans

Slide 53: Program Management and Testing

Slide 54: RSM's Business Continuity Planning Methodology

Slide 55: Testing & Training – Initial Activities

Slide 56: BCP Training Program

Slide 57: BCP Testing Program – Best Practices

Slide 58: Basic Test Schedule

Slide 59: Enhanced Test Schedule

Slide 60: Disaster Scenario

Slide 61: Disaster Scenario – Timeline (Example)

Slide 62: Test Results and Actions

Slide 63: ©2019 RSM US LLP. All Rights Reserved.

Slide 64: Conclusions/Wrap-up

Slide 65: Key Elements of an Effective BCP Program

Slide 66: Key Elements of an Effective BCP Program continued

Slide 67: Key Elements of an Effective BCP Program continued

Slide 68: Key Elements of an Efficient BCP Program

Slide 69: RSM US LLP contact details