ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 9.2: Plan business continuity: identify critical services, set minimum service levels, tolerable disruption, RTOs and RPOs, prioritise systems, and maintain an IT BCP with a steering group

What does 9.2 require?

A business continuity framework identifies critical business services and functions and crisis roles, considering the impact on viability, customers and the financial ecosystem when each is unavailable through business impact analysis, dependencies and interconnections, and third parties involved in delivery. It defines minimum acceptable service levels as triggers for continuity measures, the maximum tolerable disruption per service which informs recovery time objectives, and recovery point objectives propagated into the data lifecycle framework; systems supporting the most critical services or with the shortest RTOs are prioritised with regard to resources and regulatory obligations. IT business continuity plans set activation and escalation protocols, roles and responsibilities and recovery metrics, and a steering group of suitably senior and expert personnel leads the response and keeps internal and external stakeholders informed, convened when defined thresholds are met.