BlackRock’s Business Continuity Management (BCM) and technology Disaster Recovery (DR) programs support the recovery of BlackRock’s operations and supporting technology. These programs are a critical and fundamental part of BlackRock’s ability to fulfill its fiduciary responsibilities to clients. As such, significant resources and effort are dedicated to these programs.
BlackRock maintains business continuity and crisis response plans to facilitate the continuity of business in the event of a business disruption. BlackRock’s executive management is responsible for oversight and governance of the firm’s BCM program, supported by the Business Continuity Management team, which manages the program.
BlackRock maintains disaster recovery plans and procedures to affect a rapid response to an event impacting its technology and data. Redundancy is the strength of BlackRock’s DR program. Each data center is served by physically diverse circuits, secondary network and alternate power sources. Primary and secondary data centers are appropriately distanced, mitigating the impact of a regional event. Applications are maintained in both the primary and secondary data centers while data is replicated in near real time. BlackRock’s Technology and Risk Management executives provide oversight and governance to the DR program which is managed by the Disaster Recovery Management team.
BlackRock’s BCM/DR programs have several key elements, including:
BlackRock performs annual Site Risk Assessments for offices worldwide. The results of the assessment are used to drive risk mitigation activities, including enhanced site resilience, business continuity planning, and the deployment of additional recovery strategies where appropriate.
Additionally, a comprehensive weekly Risk Outlook is created that identifies potential threats to BlackRock staff and/or offices worldwide. Threats are reviewed, escalated and managed by senior-level staff, and disseminated for awareness and action as appropriate.
There are three main areas of focus that comprise the BCM/DR planning that BlackRock performs:
BlackRock’s Crisis Management program provides a global framework for responding to disruptive events, including:
BlackRock uses several methods to keep employees aware of the critical role they play in preparing for and responding to potential business disruptions. Methods used include:
BlackRock exercises its BCPs to ensure the procedures for recovering business operations are appropriate, and that key personnel are familiar with documented procedures. Each year, several exercises are performed:
BCM exercise results are documented and reviewed with all involved participants following each exercise. Recommendations for improvements to the recovery process are identified and any corrective actions clearly defined and assigned to the appropriate personnel.
BlackRock conducts an annual Disaster Recovery test for each of its production data centers. During the test, the data center is isolated from the BlackRock network to simulate a total loss of the facility. Applications are failed over to a secondary data center within the stated Recovery Time Objective (RTO) and the functionality is validated by qualified testers.
Following each DR test, the Recovery Manager provides a recap to Corporate Services, Technology and Risk Management executives. The recap includes an overview of the recovery times, a pass/fail assessment of all applications and a plan to remediate any issues discovered during the testing life cycle.
One of the key components of the BCM planning process is our supplier management framework, which includes periodic reviews of the business continuity programs for key service providers. Risk assessments are used to determine the criticality of each service provider. For the most critical service providers, BlackRock conducts targeted reviews and evaluations of BCM plans and, where appropriate, on-site visits.
Last Updated March 2016