Business Continuity and Contingency Planning Efforts Based on the CIS auditor's limited inquiries to the Y2K Project Director and to OIT management, the SEC is progressing in developing its internal contingency plans. During the audit's field work, these plans were being refined. No opinion is expressed on the sufficiency of these plans. The Commission intends to perform additional contingency testing. Good business practices indicate that business continuity and contingency plans should be tested.
Untested plans can lead to a false sense of security.
The Y2K project has involved significant resources, much work and many issues. The accomplishments and benefits of the Y2K effort can and should be leveraged to strengthen overall management of SEC's information resources. The lessons learned from the Y2K effort can be used to develop or tailor practices and guide the development of appropriate policies and procedures in support of best practices. These accomplishments should be maintained by instituting and following appropriate policies and procedures.