Given the critical nature of telecommunications, management should ensure appropriate redundancy levels in the entity’s telecommunications infrastructure. The entity’s telecommunications infrastructure may contain single points of failure that are outside the control of a single entity. Management should understand the limitations of the entity’s third-party telecommunications providers’ infrastructure. For example, multiple carriers may rely on the same telecommunications backbone. Key aspects management should consider in establishing telecommunication redundancy include:
- Identifying and mitigating single points of failure across the entity’s infrastructure.
- Developing and maintaining a plan to address an outage in the telecommunications lines with the entity’s primary third-party service providers.
- Establishing redundant telecommunications links with each of the entity’s third-party service providers through a contractual arrangement, which allows either party to switch its connection to an alternate communication path.
- Reviewing the entity’s third-party service providers’ plans and determining whether critical services can be restored within acceptable time frames.
- Developing guidelines, commensurate with the entity’s size, complexity, and risk profile, to diversify connections to mitigate the risk of a telecommunications failure.
- Assessing the communications technology that bridges the transmission distance between the telecommunications service provider and the entity, sometimes referred to as the “last mile,” for single points of failure.
- Monitoring relationships with telecommunications providers to manage risks.
- Inquiring about the physical paths used by telecommunications providers and verifying that system redundancies have been properly implemented.
Communication is critical to the financial services sector and other industries. Therefore, management should consider the following services provided by the federal government. These services give participants priority access to telecommunications during a wide-spread event.
- The Telecommunications Service Priority (TSP)Refer to the DHS’s “Telecommunications Service Priority” (TSP) webpage. The TSP program provides service vendors a Federal Communications Commission mandate to prioritize requests by identifying those services critical to national security and emergency preparedness. TSP-designated circuits are recovered first in an emergency. Management may contact the entity’s primary federal regulator for information on the TSP program and whether the entity qualifies for a TSP designation. If the entity qualifies, management should integrate the TSP program into the entity’s BCP. program.
- Government Emergency Telecommunications Service (GETS).Refer to the DHS’s “Government Emergency Telecommunications Service” (GETS) webpage. GETS provides “priority access and prioritized processing in the local and long distance segments of the landline networks, greatly increasing the probability of call completion.” It is intended to be used in an emergency or crisis situation when the landline network is congested and the probability of completing a normal call is reduced. Management may request GETS cards by submitting an application to the entity’s primary federal regulator.
- Wireless Priority Service (WPS),Refer to the DHS’s “Wireless Priority Service” webpage. which is the wireless complement to GETS.
IV.A.5 Third-Party Service Providers