Security For Technological And Business Assets In The Caymans

by Toni Paolini, Caymannetnews

23 July 2001

This story is reproduced by kind permission of Cayman Net News at: http://www.caymannetnews.com

Time is long past since we had to protect our lives and only a few coconut trees from acts of God. It is said that we now have close to 600 billion Dollars in assets to protect and it would be a catastrophe to see all the efforts to bring the Cayman Islands to the point we are now vanish overnight for lack of a national prevention, recovery and continuity plan in case of a disaster hits our shores.

Most advanced countries demand that all financial institutions should have a disaster recovery/continuity plan in place and the plan is inspected by their Central Bank to check if it is sound and realistic. A lack of such preventive measures is heavily penalized.

In the Cayman Islands there is no such legislation and some financial institutions have their recovery plans in place guided by the common sense of their managers or forced by their own Auditors Department. In the United States the Federal Reserve issues norms and guidelines and they are updated from time to time depending on the advance of the technology. The disaster prevention and recovery programme of the pre-computer era of course was completely different from the actual speedy focused computer age.

The FEDs make sure that banks and key financial institutions have in place a Hot Site (for immediate or almost immediate operation); a Warm Site (some kind of arrangement with other institutions or remote site to recover data and resume operations) and a Cold Site (which is nothing more than a very resistant vault to store and protect documents and tapes).

Due to its size and being at almost sea level, our country is vulnerable to some specific phenomena and this peculiarity requires unique solutions. We need government regulations clarifying once and for all the legality of sending tapes with information off Islands where the data becomes vulnerable to the scrutiny of foreign governments.
Also we need to have realistic guidelines about the physical protection of information since most recovery plans are designed for airplanes evacuation of people and remote communications to transfer data to other locations off Islands.

According to Tony Paolini, Managing Director of Shelter Island Ltd., the first line of defense against any disaster such as vandalism, fire, flood, hurricane or earthquake has to be very simple and at a reasonable distance from the main place of business (Hot Site). If the company is located in Cayman Brac the first recovery site has to be in the Brac. If the main office is located in Grand Cayman, the first contingency plan has to be in Georgetown.

The reasons, he explained, are that most of the time nothing really happens. The majority of threats from hurricanes are thankfully never realized and people tend to become complacent. No manager will keep sending people, documents and tapes (sometimes computers) off island if he/she has to explain time and time again to the auditors the expenses incurred during such false alarms.

Also, in case of fire or vandalism, it is not realistic to move key personnel to a distant location since all documentation and vital physical files could still be accessed and recovered at the main building even if it out of commission for a regular work day.

Furthermore, a very sophisticate plan tends to confuse people who are already confused by the event. "If you where here, " he explained, "during hurricane Mitch you will understand what I am saying. It was a total chaos at the airport. Even if one had a ticket and a seat there was no guaranty that that person would fly out. There was one instance of a chartered plane that came to pickup somebody, flying back carrying somebody else that had offered double fare leaving a tearful and angry passenger behind."
Of course, he explained, there should be an alternative to a local solution (Warm Site) to recover from a catastrophe and that should include a contingency plan off island which he believes will more likely will never be used.

Shelter Island, he concluded, is being created to help Government and the business community in general to install their Hot Sites in George Town, at a walking distance from the financial center which will guaranty a continuity plan, in any event, without having to rely on sophisticated and sometimes dubious plans to save and recover data.

One last thought, he said, in our specific situation it is a necessary mandatory solution dictated by Government because the managers of financial institutions are temporary and will be called back home after a few years abroad. It is understandable that because of such turnover they have other priorities in mind and by the time that they are familiar with the Islands peculiarities and ready to implement changes it is time to go home and the cycle starts all over again leaving the solution to the next person.

We must stress the need for Government itself to check its contingency plans and make sure that Immigration, Police and financial records are safe and ready to be used in any event otherwise there will be irrecoverable damage to our islands.

Recommended