Business Continuity Plan Summary
First Southwest Holdings, LLC., through its operating subsidiaries, (collectively, “FirstSouthwest”) is a leading national financial services firm engaged in public finance, corporate finance, housing finance, underwriting, investment management, financial consulting, arbitrage rebate and the provision of securities brokerage, trading, finance and clearing services among other services. Based in Dallas, Texas, FirstSouthwest has numerous offices located throughout the United States.
We have developed a business continuity plan (the “Plan”) with a view to crisis prevention and, in the event of a business interruption, swift and effective assessment, management and recovery. The Plan incorporates regular testing, monitoring and maintenance to sustain the technology, systems and procedures in place.
The following summary of First Southwest’s Plan outlines the firm’s capabilities, strategy for responding to a business interruption, and commitment to sustaining and updating its capabilities going forward.
DATA PROCESSING AND BACKUP CAPABILITIES
Protection of data and redundancy of systems are key considerations in designing and implementing First Southwest’s plan. FirstSouthwest utilizes industry leading vendors, servers, storage and networking technologies. Computer systems, endpoint devices, and data storage equipment are maintained in secure environments with safeguards against intrusion and environmental disruption. These safeguards include monitoring systems that provide alerts of outages and environmental changes in our data center.
First Southwest’s system creates mirror images of trade and operating data in remote locations and integrates a daily backup protocol for further data protection. All critical file server data is backed up nightly at the corporate office. Branch office data that is physically stored on a server in the branch office is replicated throughout the day to a corporate server. Smaller branch offices have their data hosted on a server physically located in the corporate office. The branch office data hosted at corporate, as well as the data replicated from branch offices, is backed up using daily incremental and weekly full backups. The weekly full backups are copied to tape and sent offsite for storage.
FirstSouthwest utilizes a storage-area network (SAN) that allows it to consolidate its disk space in high-capacity, high-performance cabinets. This technology allows FirstSouthwest to replicate critical data from the corporate office to the firm’s primary alternate data center in near-real time. The replication disks are located at the alternate site and the process is performed over the company’s private network.
BUSINESS CONTINUATION STRATEGY
Our Chief Information Officer has assumed responsibility for maintaining and updating the firm’s Plan. This charge is carried out with the assistance of senior management, department and office heads and key vendors. In developing the Plan, we conducted an inventory of existing systems while considering the potential impact of various crisis scenarios and the specific needs of the firm’s various business sectors and diverse customer base. As part of this analysis, we evaluated the specific challenges posed by a catastrophic loss to our facilities, information technology, personnel and communications systems.
First Southwest’s Plan incorporates numerous redundancies and geographical dispersion that insulate the firm and its customers from business interruption. The firm’s strategy includes having redundant systems in primary and alternate sites that are active at all times, permitting rapid recovery of operations and access to data. This strategy also includes the creation of mirror images of data in remote locations, accessible from multiple venues and recoverable within minutes or hours.
FirstSouthwest has analyzed its system usage and capability, and identified its mission-critical systems. While FirstSouthwest does not host mainframe systems on site, they are an important part of the firm’s operations and have been given significant attention. We have reviewed the recovery plans of each of our mission-critical service providers and have found them to be sufficient and reliable. We participate in our service providers’ testing schedules, and work closely with them to ensure the compatibility of our respective systems, especially as additional measures are implemented.
In the event of a telecommunications failure, FirstSouthwest is able to re-route all toll free and direct dial lines to our alternate recovery sites. Predefined contingency configurations have been supplied to the firm’s telephone service providers with implementation instructions in the event of a failure. This means that the firm’s telephone numbers can be re-routed in near real time. Also, with all FirstSouthwest offices on VOIP phones, we can now exercise the backup Session Initiated Protocol (SIP) circuit the event when the primary corporate SIP circuit has a failure. Basic local and Long Distance (LD) for both incoming and outgoing phone calls will continue to function until the primary SIP circuit is restored.
FirstSouthwest implemented a new telecommunications infrastructure in 2007, designed to facilitate business continuity. First Southwest’s private network provides primary connectivity to the corporate office, and secondary connectivity to the alternate site. Data connections from external vendors have backup connectivity through dedicated secondary circuits in the alternate site or through re-routing the service in case of an outage.
FirstSouthwest has placed high priority to preserve and recover Internet and e-mail access in the event of a business interruption. The firm’s corporate office has Internet service from two different service providers. In the event of an outage from one provider’s network, the capacity of the remaining provider is sufficient to run the firm’s critical business functions. In addition to redundant providers, we use a pair of “next generation” firewalls in a redundant configuration in our production and Disaster Recovery (DR) sites. Our DR site has a redundant and diverse Internet connection with a separate “next generation” firewall for protection. These redundant/diverse capabilities are active at all times in both production and DR sites.
Customers and Third Parties:
FirstSouthwest has compiled and regularly updates emergency contact information for critical vendors, service providers and key banking relationships. This information is available at all times in each of the firm’s disaster recovery sites. In addition, we have compiled information relating to each organization’s service capabilities, in the event alternate services providers are needed.
In the event of loss of communication in the corporate office, as discussed above, FirstSouthwest has the ability to selectively re-route toll-free numbers and local numbers for both telephone and facsimile to an alternate site, permitting swift restoration of communication with customers and business partners. In addition, customers can make use of mobile numbers to contact FirstSouthwest personnel. Independent Internet access in the corporate office and alternate sites permits FirstSouthwest personnel to communicate with customers and others via e-mail.
In the event of a catastrophic loss to the corporate office, key employees such as executive officers, department heads key technical and operations personnel will be contacted directly and informed of the nature of the loss, the status of the event and any special instructions. All information technology staff members carry cellular telephones that are e-mail enabled. In the event of a business interruption, this will be the primary means of locating and notifying critical disaster recovery staff.
The firm’s employees can obtain information and updates by calling a designated toll-free number to receive messages from an automated voice attendant with recorded messages that will be updated as necessary.
Trading and Clearing Services Recovery
FirstSouthwest requires access to systems to execute, clear and settle trades. These systems, as well as a description of alternate methods to access these systems in the event of a significant loss to the corporate office, are discussed below.
- The Firm’s has contracted with a software vendor to provide the Firm’s primary customer maintenance and trade entry system. FirstSouthwest has installed a redundant line for this service in the Firm’s alternate site. In addition, the vendor has primary and alternate sites which are both accessible from First Southwest’s sites.
- Depository Trust Clearing Corporation (“DTCC”) provides clearance, settlement, custody and information services for First Southwest’s equity, debt and mortgage-backed securities transactions First Southwest has installed a duplicate line to the alternate site, which will permit swift re-routing of the service.
- The Firm settles trades in government securities for FirstSouthwest with a bank. We can fully restore our communications and services with this bank by re-routing through independent lines to the alternate site.
First Southwest’s corporate office and alternate recovery sites are located in buildings protected at all times by security guards, cameras and controlled access. In addition, First Southwest has installed in its primary and alternate recovery sites numerous fire protection measures that exceed building code requirements, and the firm participates in the fire drills and emergency evacuation tests conducted by building management.
FirstSouthwest has acquired a generator as an alternate power supply in the event of a disaster. The generator has the capacity to run the firm’s computer room, trading desk, operations department and certain other of the firm’s critical systems necessary to process and clear trades. Fuel is stored onsite for the generator to run for 24 hours. The firm has a fuel provider on retainer to supply additional fuel as needed.
First Southwest has implemented a testing schedule for our business continuity systems, and we participate in the tests performed by our service providers. Whenever possible, we coordinate our testing schedule with that of our service providers to ensure proper functioning from each firm’s recovery site.
FirstSouthwest will continue to evaluate its systems and procedures, including monitoring industry standards and available technological advances, to continue to improve its Plan.
Managing Director, CIO