ASIC, Australia’s integrated corporate, markets, financial services and consumer credit regulator, has released a letter to market participants outlining technological and operational resilience guidance, clarifying how to identify critical business services, providing information on outsourcing critical business services, and confirming details of major event notification.
In terms of critical business services the guidance covers:
- Approach to identifying critical business services
- Improper exclusion of critical business services
- Documenting critical business services.
The guidance also warns organizations against relying on existing frameworks, such as business continuity or global risk frameworks.
“A market participant that assumes that existing frameworks satisfy the Resilience Rules risks failing to identify critical business services and contravening their obligations to have in place adequate arrangements to ensure their resilience, reliability, integrity and security,” says the guidance. It goes on to state that:
The scope of many business continuity plans are narrower than the critical business services definition in the Resilience Rules. The Resilience Rules focus on technological and operational resilience for the day-to-day running of participant operations and services and are not limited to business continuity events. Further, a participant should not consider that a function, infrastructure, process or system is not a critical business service solely because a failure of the operation or service would not trigger a business continuity event.
The Resilience Rules referred to above relate to Chapter 8B of the ASIC Market Integrity Rules (Securities Markets) 2017 and Chapter 8B of the ASIC Market Integrity Rules (Futures Markets) 2017.
