FINRA Rule 4370

A business continuity plan must address the following, as applicable: 

1. Data back-up and recovery (hard copy and electronic records);
2. Mission critical systems;
3. Financial and operational assessments;
4. Alternative communications between customers and the member firm;
5. Alternative communications between the member firm and its employees;
6. Alternative work location for employees;
7. The impact on critical business constituents, banks, and counterparties;
8. Regulatory reporting;
9. Communications with regulators; and
10. How the member firm will provide customers with prompt access to their funds and securities if the firm determines that it is unable to continue operating.