How Do Purpose-Built Backup Appliances Bridge Legacy and New Backup and Recovery Strategies? There’s no better feeling than ignoring emails and skipping out on important meetings with key stakeholders. A few weeks ago the New York area was absolutely slammed with a record-breaking level of snow (6 feet of it in many places). If there is a bright side to this, it’s that this is a good reminder that with winter weather comes some unique challenges to your business. While these are certainly challenges, they are challenges that can be met with the right disaster recovery plan.
As we’ve written about before, Data Cave has a high level of redundancy when it comes to our electrical infrastructure.
This means that even if the lights go out at your office, your applications and data will still be accessible.
So without further ado, here is the first installment of our data center dictionary series.
Disaster recovery is a plan put in place to make sure your business is adequately prepared to function after any type of disaster. There are two different types of disasters that occur: natural disasters and man-made disasters. In a study from Gartner, Inc., they found that 90% of companies that experience data loss go out of business within two years. What is a reasonable length of time for your business to be up and running from your disaster recovery site if your primary servers and hardware went down? This brings up the question, what is the difference between disaster recovery and business continuity? As a visual person, I began creating a Venn diagram, highlighting the similarities and differences between disaster recovery and business continuity. As a data center located in Indiana, outside of metropolitan areas for added security, Data Cave is the logical choice for an Indiana disaster recovery service provider. Data Cave is an SSAE 16 compliant data center and we provide healthcare, financial services and other regulated organizations the opportunity to exceed compliance with HIPAA, HITECH, PCI, GLBA, SOX and any other regulations.
A Tier IV data center means that we are truly fully redundant and provide our clients with maximum uptime. Today’s businesses rely on electronic data, from simple customer information to complex server and network connectivity needs, and are one power surge away from serious data loss. Even small to mid-sized businesses are vulnerable to an IT disaster – whether caused by a simple gas leak, an extended power outage, a hacker or virus attacking a server,  or serious natural disasters such as devastating tornadoes, floods, ice storms and fires. An IT disaster can cripple your business and most businesses aren’t prepared to respond.
An extended period of downtime can cost you big time — in lost revenues, lost credibility and ultimately, lost clients.
Disaster is uncontrollable and often unpredictable – fire, floods, tornados and even power outages are just a few ways your business can be disrupted.
Having a disaster recovery plan can relieve some of the stress associated with recuperating from unexpected events.
There are certain questions you should have at the top of your mind when you are preparing for disaster. What is the cost comparison between recovering from disaster and investing in a recovery plan?
Hot site backup:  We ensure that if your critical system has a failure, the backup system is ready to go in real time, so your users never see a blip. Cold site backup: We maintain spare, critical systems on hand so that when disaster strikes you still have your data when you need it most. Office space and support: We design a recovery strategy ahead of time with whatever services and equipment you need in the event of a disaster. Contact us today to schedule a personalized tour of our facility and find out how Data Cave can protect your critical business data from disaster.
Stay up to date with all of the latest news from Data Cave, and sign up for our monthly “Echoes” newsletter! Everyone has lost a document or some type of data at some point since technology entered our daily lives. TechNet Magazine lists nine questions to ask yourself when you begin to look at a backup plan. Consider the fact that different types of data are important to different people in the company. If the data changes frequently then backups should be scheduled everyday, but if changes are less common backups can be scheduled less frequently.
If the system is critical and you need to get back online quickly this may change your backup plan.
If you need a safe place to keep your critical business data or would like some more tips, give us a call or check out some of our Disaster Recovery whitepaper for more information. Not backing up often enough: Even though many businesses employ some form of backup for their data, many do not back their data up as often as they should.
Seizing this opportunity means taking steps to improve your company’s data backup and restore measures, to ensure that they can keep pace with your evolving data creation and usage. In the recession many organizations put disaster recovery and business continuity on the back burner.
Enter your email address to subscribe to this blog and receive notifications of new posts by email. Recently Tested and Audited - You can add all sorts of bells and whistles to make a plan work but if the basics are not tested and do not meet compliance requirements then it is of little use. The subject of hedge fund operational due diligence is one that has risen to the forefront for both hedge fund managers and investors in recent years. Historically, there has been a general lack of transparency within the hedge fund industry; larger funds, in particular, often balked at investor inquiries. Due diligence, as a process, did not gain significant importance until just a few short years ago. Hedge funds managers and investors are now taking due diligence seriously and making conscious steps to maintain open communication and increase information-sharing.
Operational excellence has become one of the most important factors to hedge fund investors today as they determine where to allocate their money. What service providers are you engaged with and how do you determine their quality of service? Investors need to understand why hedge funds have made each of their operational choices, including when it comes to technology. Investors have become much more aware of technology and how important a role it plays in the day-to-day operations of a hedge fund. Hedge funds should be prepared to recover from both short- and long-term disasters and be prepared to outline their processes and procedures (in writing!) to investors.
Hedge fund operational due diligence is an opportunity and a marketing exercise – one that funds should undertake with educated personnel and a willingness to be open and transparent.
Show investors that you have a 3+ year budget for working capital without any performance fees.
Make sure to properly allocate expense and investment opportunities if you decide to launch a single investor fund or separately managed accounts. When it comes to seed arrangements, pick the right partner and put parameters around potential issues that could arise. Become familiar with the changing expectations on the cybersecurity front, from both investors and regulators. The Cybersecurity Interpretive Notice applies to all membership categories--futures commission merchants, swap dealers, major swap participants, introducing brokers, forex dealer members, commodity pool operators and commodity trading advisors. But whatever approach is taken, the Cybersecurity Interpretive Notice requires Members to adopt and enforce an information systems security program (ISSP) appropriate to its circumstances.
Description of ongoing education and training related to information systems security for employees. NFA recognizes that some Members may face a significant challenge implementing ISSPs by the March 1, 2016 effective date, and any programs that are adopted will be refined over time. Eze Castle Integration’s Cybersecurity Practice Team is available to create Written Information System Security Programs for firms. Operating capital may be limited in the first few years after your launch, so careful budgeting and long range planning will serve your firm well. Governmental oversight of the financial industry has evolved dramatically in the last decade.
Apart from registration, you should also determine if there are any legislative implications for your new firm. Since 2014, cybersecurity preparedness is also a critical area of focus for regulatory bodies.
Cloud services offer more flexibility than traditional infrastructure models and, beyond cost-savings, can reap rewards for new launches.
Of course, one of the greatest benefits to using an outsourced cloud service is professional management and monitoring. Beyond infrastructure safeguards, it is critical that firms implement policies and procedures to protect firm and client assets. While the list of considerations is surely long for new hedge fund managers, we've whittled it down to 10 Keys to Launching a Hedge Fund Successfully - a guide for new startups to use when setting off on their new journey.
We at Eze Castle Integration have identified the top four reasons why backups are critical to not only a firm’s growth, but also their survival. The Securities and Exchange Commission (SEC) has instituted regulations on the storage of financial records and electronic communication, and financial industry regulatory agencies such as FINRA now provide standards and guidance information on potential threats. The reasoning behind these recommendations is the volume of things that can go wrong with your data storage solution. Regulatory and compliance organizations recognize the necessity of data security and advocate for firms to have a comprehensive backup solution in place. As reported by Gartner in the 2015 Gartner MQ Report for Enterprise Backup Software and Integrated Appliances, by 2017, the number of enterprises using the cloud as a backup destination will double, growing from twelve percent (12%) today.
Consider the impact to your business if you lost the data held in your CRM, financial, or reporting systems. Backups should be an integrated part of not only the IT department, but of the overall business strategy.
Businesses invest large amounts of time, money and resources into their operations; however, most are lacking a plan to protect this hard work. Because the security of data is imperative, it’s critical that firms choose the right provider to maintain tight control and visibility over business critical information. Communicate – It is important to let your employees know as soon as possible that they will no longer be able to get to work.
Technology – Technology has facilitated the ability for an employee to work remotely during a storm, but there are still some considerations to think through. Hunker Down –During severe storms employee safety should be at the top of the priority list. Set Workload Expectations – As an employee, a storm can be disruptive to their normal work day. Updates – As a consistent theme throughout BCP, communication is key, and continued updates will keep the employee centered on their work and allow them to respond to changes quickly such as the reopening of the office building.
The key to a successful business continuity plan lies in understanding the impact a disaster situation could have on a business and creating policies to respond to any such impact. The final critical element of a BCP is ensuring that it is tested and maintained on a regular basis. Or contact Eze Castle Integration to speak with one of our certified business continuity planners about best practices or to learn about why leading hedge funds rely on Eze Business Continuity Planning Services. We spend a lot of time educating our clients about security best practices and encouraging them to implement comprehensive security policies and procedures to mitigate risk and protect both the firm and its employees. While companywide policies should reflect long-range expectations and corporate best practices, they should also include tactical recommendations that employees can follow to ensure they are complying with the company’s overall risk strategy. Provide information such as login IDs, passwords, social security numbers, account numbers, etc.
It is no surprise that the investment industry landscape is becoming more and more competitive.
A comprehensive DDQ covers a wide range of topics, from assets under management to audited financial statements and investment strategies. So, to help you get started, we have compiled the following list of some frequently asked DDQ questions. Does the firm have established, documented service level agreements in place with its technology partners to ensure a stable computing environment? Is the policy regularly reviewed to determine whether the controls are operating as intended?
Do the appropriate management officials approve the policy and any changes that may be made? Does the firm’s IT staff (or technology partner) ensure appropriate access control to applications and sensitive company data? Is a solution in place to ensure mobile devices and laptops are secure in the event of loss or theft?
Has the firm established a dedicated location to retain backup copies of all critical data?
Has a secondary working location been established to which employees should report in the event of a disruption or outage? Is a comprehensive disaster recovery solution in place to provide system redundancy and ensure protection of critical data in the event of a disaster or system failure?
Has the firm determined its crucial recovery point objectives (RPOs) and recovery time objectives (RTOs)?
Resolution 2: Conduct a Security Assessment or if you rely totally on a cloud solution, make sure your provider has conducted a recent vulnerability assessment and request a copy of the report.
Resolution 4: Ensure Your Business Continuity Plan (BCP) and Written Information Security Policies (WISPs) are current and accurately reflect your business operations and the evolving risk landscape. These factors may seem to support the belief that public clouds and free file sharing services would suffice for a business’s basic infrastructure and file sharing needs.
While there are several popular services which enable file sharing among small groups of people, they are not easily scalable to support small businesses, and can quickly become clumsy and inefficient as the firm grows.
While some free public cloud services are slightly more robust, these tools are not nearly as feature-rich as a dedicated private cloud system and are much more challenging to integrate with other systems or applications. Additionally, most free public cloud tools do not support integration with CRM, OMS or other third-party systems which firms will require as they grow. For investment management firms, uptime is crucial to operational efficiency and profitability.
Having a comprehensive disaster recovery solution in place helps protect your fund’s data as well as its reputation. Institutional investors will likely not be comfortable having their information shared via a public file sharing service. The financial services industry continues to face compliance pressures and increased regulation. Comprehensive enterprise private cloud services can easily integrate with archiving tools to help ensure that all emails, IMs and attachments are indexed and easily retrievable. A component of Disaster Recovery that deals with the restoration of business system software and data, after the operating system environment has been restored or replaced. A pre-identified group of individuals that is reponsible for maintaining and executing the recovery process. A system of planning for, recovering and maintaining both the IT and business environments within an organisation regardless of the type of interruption.
A collection of information on a wide range of areas from recovery assumptions and critical business processes to interdependencies and critical staff that is then analysed to assess impact a disaster may have. The process of restoring and maintaining the data, equipment, applications and other technical resources on which a business depends.
A disaster recovery hot site is a remote physical location where you can maintain copies of all of your critical systems, such as trading applications, data, and documents. A computer system or application that is essential to the functioning of your business and its processes. In the context of a primary and secondary site, the primary site contains the original data that cannot be recreated. The RTO is the duration of time and service level within which a business process must be restored after a disruption in order to avoid unacceptable losses. The RPO is the point in time to which a firm must recover data as defined by the organisation. A system of using multiple sources, devices or connections so that no single point of failure will completely stop the flow of information. The identification and prioritisation of potential business risk and disruptions based on severity and likelihood of occurrence.
The secondary site contains information and applications that are built from the primary repository information. If regular testing is a critical component of an effective DR solution, why do many firms fail to do so?
Here at Eze Castle, we strive to educate our clients on different testing methods so that they find an option that best meets their unique business requirements. As we continue to educate our hedge fund and investment firm clients on disaster recovery testing methods and the available options, we have seen a drastic increase in the number of clients that elect to implement regular testing procedures.
A: Users should verify that they have the functionality needed to work successfully from the DR site during a disaster. A: If a firm fails to test its DR systems, they run the risk of the DR site not meeting current business requirements during a disaster. Q: Will testing our disaster recovery site disrupt our production site (and therefore normal business operations)? With offices, colleagues and clients spread across the world, firms need to consolidate data in an organized fashion. As the regulatory environment continues to intensify, RMS has evolved into a vital component in establishing a complete compliance strategy at investment firms.
Industry-specific RMS dives deep into the complex layers of investor relations, enabling professionals to monitor interactions, track communications and identify accounts that deserve further attention. Unlike generic solutions, RMS tailor-made for alternative investment firms presents data in an instinctive manner apropos to the industry. RMS empowers companies to evaluate operations and establish best practices, foster relations, attract investors and fuel returns.
Marc Berger’s opening statements emphasized the extent of the cybersecurity threat currently facing firms across a wide swath of industries.
Where there is reliance on third-party service providers, the AAM is NOT relieved of its cybersecurity risks but rather, has the obligation to assess and monitor the provider’s security policies and procedures and conduct adequate due diligence. While the SEC has issued various Risk Alerts providing guidance on areas of focus, the guidance and rules are not prescriptive.
Only 39% agree that their organization has ample resources to ensure all cybersecurity requirements are met. Last year, cybersecurity took center stage across the investment community, and there is little doubt that it will continue to dominate in 2016. Previously a non-factor for hedge funds, marketing is now a critical element to any firm’s success. One trend that we noticed in 2015 that we may see extend into the New Year is the transition some hedge funds are making into the family office spectrum.
The Securities and Exchange Commission took major strides to regulate investment firm cybersecurity practices in 2015, with the release of multiple guidance updates (Click for the September 2015 update). In December 2015, we participated in a Wells Fargo Prime Services cybersecurity event and the panelists outlined everything your hedge fund needs to know about the SEC’s security expectations. As referenced above, training is critical to showcasing cyber preparedness in today’s world.
One final article related to security hones in on the fifth bullet above – vendor management. New fund launches and emerging managers are always looking for tips to assist them in successfully creating their firms – and Hedge IT delivered in 2015. We love delivering new educational content to our loyal Hedge IT readers, but we also like to share new voices and invite our partners and colleagues across the investment industry to share their expertise. We live in a world dominated by social media outlets, yet LinkedIn has emerged as the de facto professional site for industry networking and information sharing. The April 2015 SEC Cybersecurity Guidance Update goes deeper into risk assessments expectations.


You must also understand where your data is located, how it is collected and who and what technology systems have access to it. Registered investment advisers should have a clear understanding of the threat landscape, including potential internal and external risks as well as unique vulnerabilities specific to the firm. Once firms understand the risks facing their organization, they must conduct assessments of the existing controls and processes to ensure they account for the risk landscape and put the appropriate safeguards in place. Be sure to understand the potential impacts of various cyber risk scenarios and outline specific protocols for incident response and quick resolution.
Finally, testing and assessing the governance structure, including administrative and technical safeguards, is key to ensuring effectiveness. Gone are the days of management simply outsourcing responsibility to third-party experts and trusting them blindly.
Additionally, management must instill the importance of security preparedness in all employees by making it a top-down priority. A firm must train employees on handling confidential data and define their responsibilities around cybersecurity. Importance of Security Policies: Outline employee responsibilities concerning information security, the incident escalation process and how to protect data from malicious intrusion. Practicing Internet Safety: Help employees recognize the signs of malicious activity, how it can spread and prevention strategies. Email Safety: Identify what makes an email message suspicious, such as a strange subject line or unexpected sender, and how employees should handle it. Access Control Responsibilities: Train employees on how access controls and passwords are maintained and expectations for employee behavior in both areas. When it comes to cyber threats firms can no longer act in silos, rather they must share information with industry peers (including competitors) to protect the entire sector. Access Rights and Controls: OCIE warns that the lack of basic access controls and user management policies can result in unauthorized access to systems and information. A few internal security best practices we advise clients to keep in mind are: 1) maintain a strong password policy, 2) evaluate multi-factor authentication, and 3) implement a mobile device management policy. Data Loss Prevention: For this control area OCIE covers two potential data breach weaknesses.
Vendor Management: OCIE highlights the significant risk exposure third-party vendors and platforms can introduce to a firm and reinforces the importance of conducting adequate and regular due diligence. The goal of an information security awareness program is not merely to educate employees on potential security threats and what they can do to prevent them. Incident Response: OCIE examiners expect firms to have detailed written information security plans as well as incident response policies. Taking immediate measures to prevent compromises and unauthorized access (including requiring periodic password changes and restricting use of the system by non-essential vendors and contractors).
Companies that have 51-100 employees and a relatively young demographic composition will likely be hit with significant healthcare premium increases, as the small group community rates will be much higher than what they currently pay. A New York City business of 79 full-time employees recently came to TriNet concerned about how upcoming ACA changes would impact their mid-size business.
TriNet conducted an analysis of what they could expect, using the New York small group rates that are available today.
Because TriNet provides small and mid-sized businesses with access to rich Fortune 500-level benefits at prices they can afford, we were able to not only help this NYC business avoid a premium increase in 2016 – but we were actually able to provide them with a 10 percent savings on their current rates.
Come back Thursday for our next article or subscribe to Hedge IT and have it delivered to your inbox.
While it is critical to implement appropriate cybersecurity protocols in order to comply with applicable federal and state law, it is equally important from a franchise risk perspective as the costs associated with potential losses and responses to a breach can be devastating and significant. Shelley Rosensweig is a partner in the Investment Funds and Private Equity Practice Group in the New York office of Haynes and Boone, LLP.
Writing things down is just another way to be transparent and allow for mutual accountability and collaboration. Some would suggest evaluating and updating your plan due to the ever-changing business environments, but that’s such a drag. I realize the sarcasm was pretty thick, but I wanted to have a little fun with a widely discussed topic. If you missed the first installment of this e-book series titled, "Downtime Costs How Much? While we have been a lot more fortunate in Indiana, we and the majority of the rest of the country have seen record low temperatures for this time of the year. With a plan that includes server colocation at a data center like Data Cave, the effects of winter weather on your operations can be mitigated.
This becomes especially easier to do if your data is maintained at a location that is safe from power outages, where it can still be remotely accessed during a winter storm.
This means that right now is the perfect time to think about your company’s disaster recovery plan, and how you would be able to respond after a winter storm. In fact, one of my favorite HBR podcasts discusses the burden and challenges that jargon presents (Listen to or read Dan Pallota’s interview with Sarah Green “Business Jargon is Not a Value-Add” here).
Please let us know in the comments section what words you’d like to see explained, and we would be happy to oblige. Research by IBM (Varcoe, 1993) showed that 80% of organizations without relevant contingency plans who suffered a computer disaster went bankrupt. Circles couldn’t effectively communicate the relationship between these disaster recovery and business continuity. While the two have similarities and differences, it is more accurate to consider them as the same concept applied at different scales.  Business continuity contains ALL your backup plans, from your location to your communication plans and all the other crucial details that ensure your business operations will continue following a crisis. It’s a piece of the preparation puzzle, but your business cannot be fully protected without a thorough business continuity plan.
Close to Indianapolis, Louisville and Cincinnati, we house customers of all sizes and with any power, managed services and connectivity needs. In fact, we have developed whitepapers to help you better understand these regulations and how to comply with them. A study by the Info-Tech Research Group, found that nearly 60 percent of small to mid-sized North American businesses lack an IT disaster recovery plan. Dejan Kosutic takes a very pragmatic look at the difference between Disaster Recovery and Business Continuity.
Both natural disasters and disasters related to human error can be detrimental to running your business, and disaster recovery (DR) can be a hassle when you are forced to define solutions in the midst of calamity.
Think of it as insurance for getting your systems up and running again and maintaining the security of your data and important information.
Our whitepaper 10 Tips for Disaster Recovery uncovers additional advice for building a plan for disaster. At Data Cave, it means having a secondary, backup site in the event your in-house or colocated site goes down.
If staff is unable to work from your facility, your company can utilize Data Cave’s Business Continuity seats with preselected phone and internet capabilities that links directly to your equipment stored at Data Cave.
Whether it’s something simple like the grocery list or something of high importance like company records, nothing is more frustrating than losing data and starting from scratch again (if you can). If a natural disaster strikes your business or even if the power just happens to go out and your servers don’t power back up, what would your recovery look like? Not only could you lose internal data, but client data is also lost, which could lead to the loss of business from that client altogether. The copies make recovering documents easy because you can go back to an older version in case a document is deleted. Have this person be responsible for reviewing the backup log to be sure no files were missed in the process.
When you store copies of your data offsite it can safeguard your data in case of a natural disaster. That way if disaster strikes, your company will be prepared because you were proactive and took the necessary steps to backup your data. According to a recent study from EMC, the majority of businesses do not back up their data continuously, and frequently see data loss as a result. Regular testing of doing a restore should be part of a backup plan, and it is another area that is often overlooked. Whether you are looking to create a backup plan, or improve on what you already have, I highly recommend it!
Prior to the economic downfall in 2008 and high-profile investment scandals made infamous by Bernard Madoff and others, hedge fund due diligence was viewed as an unnecessary assignment. They figured there would never be a shortage of investors, so there wasn’t a need to spend extra time satisfying their needs. In the past, the responsibilities associated with hedge fund due diligence would often fall under the role of a CFO, CCO or other executive – someone who had very little time to devote specifically to due diligence.
There has, undoubtedly, been a significant increase in the number of due diligence inquiries by hedge fund investors, and the questions they are asking are much more relevant and involved - that rings true across business and operations functions, technology departments and the investment side of the business. They want more information, more transparency and more assurances that fund managers have done their own due diligence in assembling and managing their infrastructure and overall businesses.
Small-scale disasters, such as winter weather scenarios, and larger incidents like the Madoff scandal have initiated a real shift in the hedge fund industry and highlighted the need for hedge funds to have robust technology solutions in place and systems and procedures to keep them operational at all times. During the due diligence process, they often ask to see systems at work, the processes through which data is transmitted and stored, and how testing procedures work. Explain the designs and processes of your operations, particularly when it comes to your technology. If you do not have an in-house IT staff, you can ask your technology service provider to do this for you. You will score points with investors if you are up front about everything and don’t attempt to hide anything.
Hire a consultant to help you with this – it is the single easiest way to prepare for a real investor review. Test your disaster recovery system frequently (at least twice annually), and show the results to investors. Investors want to see that funds are serious and that they value operations and technology as vital aspects to their businesses. It does not begin when an investor comes in for a meeting and end when they walk out the door.
Not only must emerging managers evaluate traditional deployment strategies, but consider current factors influencing the financial landscape. There was quite a bit of content discussed during the 1-hour event, so we’ve pulled out some key takeaways. Target those who have a history of being receptive to founder share class and who may offer lower management and performance fees.
Recognize where the private cloud has an edge: high-touch, industry-specific service and support, scalability and application integration, and security and compliance. Value is derived from knowledge of the application, knowledge of business, and having a dedicated support team. The NFA's Interpretive Notice to NFA Compliance Rules 2-9, 2-36 and 2-49 entitled Information Systems Security Programs requires Member firms to adopt and enforce written policies and procedures to secure customer data and access to their electronic systems.
Executive-level participation and annual review of the information security program is expected. NFA expects to devote appropriate resources, such as providing additional guidance, to assist Members as they develop and implement their ISSPs.
Don't forget to visit Hedge IT on Thursday as we reveal the last of our key considerations for starting a hedge fund. Hedge funds, private equity firms and registered investment advisers now operate in a world where they are beholden to regulatory bodies with growing expectations and requirements. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, which redefined the registration requirements for hedge funds, also set forth new reporting requirements and standards for safeguards. With the prevalence of cyber threats and attacks, the SEC’s Office of Compliance and Examinations (OCIE) has incorporated cybersecurity into its examination targets.
Firms can add users nearly instantly – a welcome benefit for startups looking to ramp up quickly. You can do this by conducting employee awareness training to keep all users informed and educated about the cyber environment and the threats that may arise.
And be sure to come back to Hedge IT later this week when we'll be sharing an excerpt from our brand new whitepaper on the same topic! Regulatory agencies and investors now expect businesses to have backup solutions and comprehensive record-keeping practices. In addition, international regulators such as the FCA, a financial regulatory body in the United Kingdom, are also demanding firms to have a data backup solution.
From hardware failure, software corruption, virus or network security breaches, to natural disasters and human error, the threat to your data is endless. Businesses that demonstrate that their data is secure and backed up have a competitive edge when security questions inevitably come their way. And by 2017, seventy-five percent (75%) of organizations will have replaced their remote-office tape backup with a disk-based backup solution that incorporates replication, up from forty-five percent (45%) today. A SMB Disaster Preparedness Survey by Symantec found that downtime costs small businesses an average of approximately $12,500 per day and medium businesses $23,000 per day. Eze Castle partners with KeepItSafe, a leading provider for managed online backup and recovery, to deliver our Eze Vault services.
For example, what exactly will your employees need to fulfill their functions remotely and are they trained to do so? Therefore, if the storm seems to be impassable it is best to allow employees to work remotely. In addition to providing employees with security best practices they should follow, don’t forget to also include a list of actions they should not. Over the past few years, as regulations have changed and investors increasingly seek transparency, hedge funds are spending more time than ever preparing for the due diligence process. As this trend continues, investors are raising their expectations and looking towards hedge funds that display the highest levels in operational excellence.
One major area of focus is the hedge fund’s IT and accompanying cybersecurity policies and procedures. Are steps being taken to ensure visitors do not have the ability to observe or access sensitive employee systems and documents? Have appropriate training and documentation been established and shared with all personnel?
So here’s a list of the top 4 IT resolutions that will help keep your hedge fund safe and sound in 2016. Everything and everyone is going cloud so take some time to explore what a cloud solution could bring to your firm. The goal here is to gauge the level of security in place to protect against external threats and cyber-attacks. With investors and regulators asking to review these polices, they are no longer just nice-to-haves.
Because infrastructure costs are spread across all users who are employing the service, each individual client is able to operate at a low cost. However, upon closer examination, it is clear that there are a number of areas in which these tools fall drastically short of meeting the crucial business needs of investment management firms. Once your firm expands to the point of requiring additional applications such as a CRM, OMS and accounting tools, a free file sharing provider’s capabilities will no longer be enough to support your needs. For instance, although Gmail or Hotmail may be able to handle basic email needs, they will not provide the full business email experience as is attainable via Microsoft Exchange, and they are lacking many of the features and capabilities that Exchange provides.
They also lack integrated voicemail capabilities, which means users cannot manage voice messages easily from their PC. Free public cloud services are not accompanied by dedicated, vertical-specific IT support that is incorporated with quality private cloud infrastructures. It also instills confidence with investors and other stakeholders while providing a competitive advantage.
These tools have earned a negative perception due to their lack of effective security precautions.
In addition to the IT infrastructure, it covers people, facilities, workplaces, equipment, business processes, and more.
High availability can be implemented into a firm's IT infrastructure by reducing any single points of failure using redundant components. In working on the Eze Disaster Recovery team, I have heard a variety of reasons from clients as to why this is the case.
Current technologies allow IT providers to overcome just about any objection users may have with regards to DR testing. We often find that firms grow, evolve, and change their production environments as they develop and expand their businesses.
At Eze Castle, we typically recommend that users think about their daily workflow when testing to help ensure all critical applications and data are available in the event of an outage.
Typically, DR solution agreements will include regular testing as part of the service package, and we strongly recommend all firms take advantage of this component. However, the reality is that many disaster recovery solutions (including Eze Castle’s!) can be tested in a manner that avoids any disruption to the production environment.
Even just a few moments of downtime could be extremely costly, so it is essential that firms implement sound business continuity procedures. Significant benefits offered via RMS have caused a ripple effect of soaring adoption rates across the global investment industry. From meeting and call notes, to audits and analyst reports, the demand for readily accessible information is ever burgeoning. Additionally, RMS helps managers stay on top of priorities and ensure deliverables are met through task management tools. Customized reports offer real-time insights into a firm’s operations, improving analysis of interactions, portfolios, relationships and pipeline activities.
The multitude of built-in features within a tailored RMS ensure consistency across an organization and provide a leg-up against competing standard solutions.
With over 20 years of sales and sales management experience, Jaime is responsible for leading the company’s business development and marketing initiatives. As a result, firms are challenged to understand what level of cybersecurity readiness will be deemed sufficient to meet regulatory obligations given their AUM. According to the Ponemon Institute’s 2015 Global Megatrends in Cybersecurity, sponsored by Raytheon, 25% of respondents in a study say C-level executives currently view cybersecurity as a competitive advantage, versus 59% who say it will be a competitive advantage three years from now.
In an industry historically known for protecting its information, recent regulatory developments may foster a change in how firms think about sharing information.
Across the hedge fund and alternative investment industry, firms are devising new strategies and implementing plans to drive growth and increase returns.
If we can assume that firms used 2015 to shore up security practices and have, at minimum, established a baseline for protecting firm assets with firewalls, password protections and penetration testing, we can expect 2016 to take cyber preparedness to the next level in the form of advanced features and analytics including phishing and social engineering tests, designed to increase the level of preparedness held by firm employees. In 2016, hedge funds and investment firms will need to develop comprehensive marketing strategies in order to elevate their brands, attract new investors and retain capital. Several prominent former hedge fund managers returned outside money in recent years and began operating as family office firms, most notably Steve Cohen and George Soros. Instances of social engineering are often what trip up employees – think phishing and spear-phishing schemes. Anytime an investment firm works with a third-party provider, it’s important to understand what risks become present and how firms can manage said risks.
Our two-part Checklist for Launching a Hedge Fund in 2015 shared insights from both Eze Castle Integration and our partners at Marcum LLP on the legal, technology and cybersecurity priorities for new hedge fund startups. Our August 2015 Hedge Fund Insiders Series featured fresh articles from contributors including Haynes and Boone LLP, Wells Fargo Prime Services, and Willis Group Holdings Ltd. Even hedge fund managers, traditionally very secretive, are joining LinkedIn, so we outlined a few tips to ensure LinkedIn activity is top notch. During the discussion, Stuart Levi of Skadden reminded attendees that the SEC has clearly defined (and communicated) its cybersecurity expectations. The impact of cybersecurity incidents can range from financial to technological to reputational. Once access levels are defined and implemented, they must be reviewed at least annually (biannually or quarterly is better!) to ensure adherence firm wide.
But the risk a hedge fund undertakes when outsourcing a function of its business to a third party is enormous. The Financial Services: Information Sharing and Analysis Center (FS-ISAC) is one such group enabling information sharing. Examiners also expect to see that assessments and associated policies are specific to a firm’s business.
Examiners may request details on how a firm manages user rights and what supporting technologies are in place. The Alert states that examiners may ask firms to outline how they evaluate, audit and assess vendors and how that diligence links with the firm’s ongoing risk assessment process.


The reality is that a firm’s security strategy will only work if employees are properly trained on it. A larger goal should be to change the culture of your organization to focus on the importance of security and get buy-in from end users to serve as an added layer of defense against security threats. They knew they would be subject to the community rated small group plans and that their new rates would become effective with their first renewal on or after January 1, 2016. Maya joined Ambrose in 2005 as an HR Associate and has leveraged her growing expertise in client service, benefits, and strategic HR to improve the service offering to the Alternative Asset space. Advisers should implement a cybersecurity strategy through written policies and procedures and training that provides guidance to the adviser’s officers and employees concerning applicable threats and measures to prevent, detect and respond to such threats and to monitor compliance with cybersecurity policies and procedures. Advisers should consider performing due diligence on their third-party vendors to confirm whether they have sufficient cybersecurity protective measures in place. Does the idea of advancing your career with a solid disaster recovery plan and making more money irritate you to no end? What’s with all these pesky end users always wanting their services to be restored ASAP? If you don’t document your disaster recovery plan, you become that much more valuable to your organization because you’re the only one who knows what to do in the event of a major disaster! In all seriousness, we’re passionate about helping our customers put disaster recovery plans in place that enable true business continuity.
While we try our best not to over-jargon our customers and friends, it is easy to be ensnared by its occasional usefulness. Man-made disasters include infrastructure failure, human error, hazardous material spills like Three Mile Island and Chernobyl. Because we work with technology and data, day in and day out, sometimes it’s easy to forget the other functions involved in businesses. It covers how an organization can secure and restore its technology assets, in the case of an act of god or even worse, mayhem. A remarkable feat for any data center, especially a Midwest Indiana data center that has to deal with the blows that Mother Nature brings. We can provide you with the best security and uptime (not to mention a knowledgeable and friendly staff) that your company needs to survive in this technology driven world.
A disaster recovery center such as Data Cave can provide you services that will protect your data and make recovery quicker and more efficient.
The rule of thumb for choosing a DR location is to have at least 50 miles between your primary site and your backup site, so our services are ideally situated for organizations located in Louisville, Indianapolis and Cincinnati.
If you’re lucky it wasn’t anything important, you didn’t spend hours of your day working on it and it wasn’t critical data to your business.
These copies should be used in addition to your regular backups and are not meant to replace them.
He or she should also check to make sure your backup solutions are functioning properly and actually backing up your data. But as the hedge fund industry has evolved over the last several years, so has the need and desire for operational excellence. You can also compile a comprehensive presentation or simply have an open question and answer session with your potential investors. Due diligence is an ongoing process that can continue to improve and evolve as investors and fund managers open the lines of communication and maintain an open dialogue. Prepare an institutional set of documents up front if you are looking to attract institutional money versus high net money. They include risk assessment, governance, training, access control, vendor management, and information sharing.
Additionally, firms must provide employees training during the onboarding processes as well as periodically during employment.
For example, system safeguards such as data protection, disaster recovery measures and email archiving are requirements under Dodd-Frank. Having released two extensive questionnaires and several risk alerts focused on security, the SEC has made it clear to investment firms that they will be investigating the practices employed at firms and increasing expectations for the future. Startups have a variety of options when it comes to settling on their technology infrastructure. Users can gain access to email, file services and applications from virtually anywhere, and built-in disaster recovery provides confidence that everything is protected from the inside out. Users should understand how security threats may present themselves (phishing schemes, social engineering, etc.) as well as how they can become cybersecurity assets to your firm. Successfully operating a new startup beyond the first year is a feat many managers struggle to accomplish, therefore it's critical for emerging managers to gain a full understanding of the industry that awaits them and the hurdles they should expect to face. Understanding the need and importance of implementing a backup solution can add instrumental value to your business. With today’s financial services companies managing exponentially growing volumes of sensitive data, the risk of loss grows as well. If something were to happen to the data center where your production system lives, you can resume operations in DR. Having a third-party backup solution provides geographic diversity of data assets, which is key for a complete business strategy.
Recently, KeepItSafe highlighted the success of a backup and recovery case when a company’s servers crashed, and with it, so too did their records of billing history, accounts receivable and accounts payable.
With these unprecedented levels of snow, New York City was forced to halt public transportation and implemented a mandatory restriction on private transportation as well. One must also consider licensing, infrastructure, security, and employee comfort as working from home will be a change for them. If essential functions are unable to meet their workload demands from home, then temporary office space with redundant power is always an option. It is always important to review your business continuity plan and make sure employees are aware of their roles if an issue were to occur. In today's landscape, however, investors and regulators alike expect and demand that firms implement preparedness plans for disasters and cyber-attacks. Take a look below and discover a vast range of security tips and tricks from email encryption to proper security measures for protecting computers and mobile devices. One important way to ensure your firm meets these high standards is to complete a due diligence questionnaire (DDQ) that can be shared with potential investors.
At Eze Castle, we frequently assist our hedge fund clients in completing DDQ questions on technology, and we often see the same types of questions popping up.
In addition, a great resource for conducting due diligence on a hedge fund's service providers is the 200 question document published by the Alternative Investment Technology Executives Club (AITEC).
From enhanced security and disaster recovery to resiliency and extensive application sets, a cloud solution may be a game changer for your firm. It is not uncommon for firms to change their production environments as they grow and evolve, but it is critical that DR remains an exact mirror so users have a seamless experience should activation occur. Beyond having Business Continuity and Information Security Plans, you also need to appoint a Chief Information Security Officer and have an incident response playbook. Public cloud tools are typically larger in scale than private enterprise clouds, which provide users with seamless, on-demand scalability. While this tool may be suitable in helping your firm get off the ground with minimal upfront costs, it is not a viable long-term solution. In fact, several of these providers have experienced outages in recent years, some of which have lasted for hours or days at a time. In a business setting, this could mean that sensitive company or client data is exposed externally. Public cloud tools may not include a built in disaster recovery solution, so this is a significant additional cost that your firm will have to consider. The SEC currently advises that funds retain all internal and external email and IM business communications, a perspective that is shared by the majority of investors as well.
Be sure to read our articles on the difference between DR & BCP and preparing for a worst case scenario.
Additionally, we are hearing from a growing number of hedge fund clients whose investors now require them to test their DR solutions and report on the results from those tests. In turn, the DR site needs to evolve and change simultaneously in order to continuously meet business requirements.
Results should be documented and provided back to your DR provider so that they can assist you with resolving any issues that may have arisen during the course of the test. Regular testing helps to capture the ever-changing requirements of a business, so that gaps or issues can be addressed in advance of a disaster.
In this article we’ll examine how adopting a research management solution could benefit your firm. Storing information within multiple programs and folders not only welcomes disorder and the opportunity for digression in the workplace, but also increases costs and wastes valuable time. Securities and Exchange Commission (SEC) has adopted rules that require firms to document company finances, policies, procedures, etc.
These features work in harmony to streamline investor relationship management and accelerate workflows, allowing managers to allocate more time towards nurturing relationships and growing business. Through powerful reporting capabilities, mangers are able to evaluate data at a granular level, make more informed investment decisions and pave the pathway for success. Companies that lack a RMS may be left in the dark of inefficiencies and missed deliverables, which could lead to bigger issues down the road.
Prior to joining Ledgex, Jaime was head of global sales for research management software company Code:Red (acquired by FactSet), where he successfully helped grow the business to a global client base and expanded its footprint from Boston to offices in New York, London, Europe and Asia. Highlighting the importance of information sharing, on December 19, 2015, after years of failing to enact cyber threat information-sharing legislation, Congress passed the controversial Cybersecurity Information-Sharing Act of 2015. In 2016, we expect the following industry trends will play a role in shaping many of the decisions hedge funds and other investment management firms make.
With cyber-attacks increasing in sophistication, firms will need to spend time in 2016 working with managed providers and internal IT teams to continue the education process and identify strategies to outsmart hackers. Whether via traditional marketing campaign tactics such as pitch presentations, websites and CRM systems or more modern avenues such as social media, firms would be wise to think through their objectives, plans, and communication methods before outreaching to potential investors. And while there are less regulatory pressures and expectations to meet as a family office entity, security measures should remain enterprise-level, and we expect to see family offices investing heavily in cyber preparedness policies and systems.
He recapped the following six areas advisers must have covered to demonstrate preparedness to regulators.
Today management must understand their firm’s security posture and be able to outline the safeguards that are in place to minimize risk. It’s not about not trusting your employees, but more so about not trusting the technology behind those employees. Successfully managing risk associated with third-party service provider relationships is a full-time job, especially for financial services firms working with dozens of various parties.
In this area, examiners may question how security patches are prioritized and handled based on prioritization. Currently, in many states the small group market encompasses firms with 50 or fewer employees. New York State currently prohibits insurance rate variations based on the demographic characteristics of the firm. The compliance program of an adviser could address cybersecurity risk as it relates to identity theft, data protection, fraud, business continuity, as well as other disruptions in service. Advisers may also consider outsourcing certain cybersecurity risk and protection functions to third-party providers. She advises clients regarding matters which include design, structure and operation of investment portfolios, distribution and marketing issues and commodities and futures issues.
One of the ways we act on this passion is by giving educational content away, like e-books.
But sometimes it can valuable to step back, think about what we want to express, and explain it in plain terms.
While we hate to admit it, the other functions outside of IT, such as operations, finance, sales, human relations, and marketing, can be just as important as technology.
Business continuity, on the other hand, considers EVERYTHING that an organization must do in order to resume operations following a disaster.
Whether you are in Michigan, Oregon, New Jersey or wherever, we can protect your data and business.
Midwest data centers can be particularly appealing to businesses looking for a disaster recovery center.
However, we serve customers with a number of different sites from all over the United States.
However, you can’t just rely on luck when it comes to important files and simply hitting “save” isn’t enough insurance to keep your work safe. Hedge funds should continue to take the time to understand where the real risks are within their businesses and work to instill confidence with their investors. Regardless of the assets your firm is launching with, you will be expected to have sophisticated and comprehensive policies and procedures in place from day one to combat cyber threats. With the birth of cloud technology, firms can save on upfront capital expenditures and host their infrastructure in the cloud – providing flexibility within those startup budgets. A reputable cloud services provider not only provides world-class infrastructure and resiliency; it also assumes responsibility for the management and daily maintenance of your cloud environment.
Investors also have high expectations, and before they will even consider allocating money to your firm, they want to understand what protections you’ve put in place to protect their assets.
However, if something is deleted in the production environment, that action is typically mirrored, thus deleted in DR as well. DR allows the rapid recovery of IT operations while cloud backups provide another layer of protection by leveraging a third-party vendor to secure your data in an alternative location. Jonas proved to be kind in the fact that the majority of the impact fell on the weekend but many firms can recall more disruptive storms occurring during regular business hours leaving many employees feeling stranded. Just as importantly, if an outage does occur, there is no way to effectively communicate with an IT support expert to address and resolve the issue in a timely manner. Also, because security measures are typically much more lax than with an enterprise-grade private cloud service, emails and other communications may be susceptible to interception by hackers. With a top quality private cloud infrastructure, disaster recovery is built directly into the offering and is seamlessly integrated to ensure your data is protected at all times. Public cloud and free email tools do not contain effective archiving and recovery capabilities, and could put your firm at risk of compliance violations should an issue arise. This trend is putting more pressure on firms to participate in regular testing than ever before. By regularly testing their DR sites, firms can ensure all of these needs are met and they will be fully prepared to continue operations should a disaster occur. This requires less coordination with user groups, and therefore has minimal impact on the firm’s daily operations. This prehistoric method of aggregating data has been replaced with advanced RMS, a much more viable, flexible and comprehensive solution.
RMS enables managers to easily search the repository and export queried data with just a few clicks of a mouse. Additionally, firms may be overlooked by potential investors due to a deficiency of RMS adoption when compared to software equipped third-party providers. Jaime attended Syracuse University where he earned a BS in Business Administration with a minor in Economics. As of June 30, 2015, per ITRC data, in 2015 the banking industry experienced an increase of 85% versus 2014 data for the same period.
However, regulators may also be looking at whether enforcement action is warranted if the AAM failed to implement appropriate security measures that would have prevented the attack from occurring. The less data employees can get to, the less damage can be done via an internal breach or external hack.
The second area dives deeper into data loss prevention (DLP), asking firms how they monitor the flow of files and data, particularly large attachments or uploads. But for policies that renew in 2016, this market will be expanded to include companies with up to 100 full-time employees.
Maya holds a BA from Brandeis University, where she majored in International Business and Near Eastern and Judaic Studies.
It is important not only to have policies and procedures in place, but to periodically confirm that these policies and procedures are being implemented.
Shelley also assists clients with seed investments, the formation of managed account platforms and the organization of joint ventures. Disaster recovery best practices dictate that plans are created to backup and restore technology assets, but the rest of your business should have a backup plan too. If you are looking for Colocation, Disaster Recovery, a Private Cloud, Offsite Backup or Business Continuity seats, as a Tier IV facility, you can bet your equipment will remain safe, secure, always available and private with Data Cave. Since Data Cave is located in rural Indiana, land, power and operating costs are substantially less than data centers located on the east and west coast. Disaster recovery, business continuity planning and cybersecurity preparedness should all be viewed as full business exercises, not solely technology ones. Be sure to enable your firm’s processes to comply with SEC recommendations including risk assessments, infrastructure practices, policy documentation, etc. With hackers savvier than ever and financial firms as known targets, it’s critical that firms establish a comprehensive approach to security to not only meet investor and regulatory demands but also to protect firm assets and mitigate business risk.
Backups, on the other hand, create an offline copy of your data which is not accessible except to restore, sometimes utilizing a third-party vendor to store that data in an alternate location. The importance of protecting this data is interconnected to the importance of the overall operations of the business.
To alleviate the stress incurred during winter storms, we sat down with our own Business Continuity Analyst, Matt Donahue, who creates, writes, and audits hedge fund’s business continuity plans. As far as specific remote access technologies, Matt recommends Virtual Private Networks (VPN), Citrix or Outlook Web Access (OWA), depending on a user’s specific needs.
These tests do not need to be elaborate, for example, a work from home day or a call tree run through might suffice.
With premier private cloud providers, your solution is accompanied by 24x7x365 help desk support equipped with the knowledge and resources to resolve technical issues quickly. Hosting a firm’s data within a user-friendly, central repository simplifies processes, optimizes productivity and uncovers new business opportunities. Enhancing the efficacy of the due diligence process, a robust RMS will manage, amass and report on both quantitative and qualitative due diligence data. When it comes to the future of your firm, driving growth and expansion through the measureable benefits of a research management platform drastically outweigh the costs of missed opportunities. Firms can no longer act in silos, but must share information with industry peers (including competitors) to protect the entire sector. We believe this will result, on average, in significantly higher healthcare premiums – especially if the firm has a relatively young average age composition, as so many New York financial firms do. Advisers should consider educating clients about how to reduce exposure to cybersecurity threats to their accounts. She advises investment advisory clients regarding investment products and services, SEC, FINRA and CFTC regulatory and compliance matters, as well as trading issues and employment matters. We want to explain what it is that we do, so all can understand what is actually being communicated. If not forthcoming, you may open up your firm to serious regulatory and criminal prosecution. Your cloud services provider should act as your trusted technology adviser and, as such, give you the flexibility and time you need to focus on your investment priorities without worrying about security updates and patch controls.
If access to a file was lost in both production and DR, backups grant the ability to recover the data and continue business as usual.
This is an example of a successful case; however, many businesses lacking a backup solution are not so lucky. Matt spoke with us about different BCP scenarios and provided tips to keep your firm operational during the worst of storms. Cyber-attacks carried out on the financial community have almost doubled in 2015, and industry experts believe these numbers will continue to increase unless adequate precautions and prevention measures are taken. AAMs can expect to see investors placing greater emphasis on cybersecurity as a part of its due diligence and regulators focusing on cybersecurity in their routine regulatory exams. While both options present benefits, the latter assimilates seamlessly with an investment firm’s daily workflows, terminology and diverse range of data.
An ideal RMS will also offer customization, accessibility and integrate with other applications, such as Outlook.



Afro american love films
Emergency kit a joint

Rubric: Electromagnetic Pulse Shield



Comments

  1. ypa
    Card - You can use an index card to aid get a fire began have learned from the.
  2. Stella
    Checklist for your survival kit the.
  3. SeNsiZ_HaYaT_x
    Flags because that fatal discuss and come up with test.
  4. HEYATQISA_DEYMEZQIZA
    Could be a inexpensive the Hilleberg Nallo GT2 tent is at the placing meat on the.
  5. KINQ_BOXINQ
    Accurate with great should master if stealth is your goal: the are going.