CRA is developing a Business Continuity Management System and planning to receive a BS 25999 certification. CRA has a Business Continuity Plan in place, which includes physical standbys of the main system, storage of data off-site, an off-site facility and storage of all backup files. Also a second data storage device and DB server is located in the second system room of the same building.

In the event of a failure, the back-up system could be activated in 1 to 4 hours and the main system could be re-activated within 6 hours.

CRA has three different Disaster Recovery sites:

• One “hot” site located in a nearby building;
• One “hot” site located in Istanbul, about 5 kilometres away from CRA premises;
• One “cold” site located in another city, about 470 kilometres away from Istanbul.

These are tested once a year with direct involvement of all CRA participants, and in the event of a major disruption, it would take about 2 hours to switch activities from the main site to the DRP site. With regards to the BCP, CRA has arrangements in place that would enable it to run its operations from different premises (three), which can accommodate about 30 people, with PCs, phone, fax, internet, WAN connection to guarantee the continuation of operations of CRA. These are tested at least once a year and the last test was conducted in May 2010.

There is a working committee accountable for the BCP and DRP, which reviews the procedures in place to improve the current arrangements.

Neither BCP nor DRP have had to be formally activated since CRA commenced operations.