Be a Master of Disaster Planning
Business continuity requires a broader definition of 'disaster.'
“Business continuity” is one of those euphemisms designed to keep people’s minds from leaping immediately to dire visions.
“Basically, it’s disaster avoidance,” says Julie Esser, director of new alliances for CUNA Strategic Services. “Many credit unions have a ‘it’s never going to happen to us’ view, partly because they see a disaster as something huge, like Hurricane Katrina or a wildfire. Part of what we do is broaden the scope of what they see as a disaster.”
Esser cites several examples:
- A fire that destroys a branch or vital equipment;
- A backhoe that accidentally severs a major phone line; or
- A broken water pipe or water main.
“Maybe the tenant upstairs has a broken pipe that leaks overnight and creates extensive damage that isn’t discovered until the next morning,” she says. “Even after repairs, there’s the problem of mold and trying to dry out. Supposedly simple water damage turns into a long, drawn-out recovery process.”
Esser says many credit unions think business recovery is primarily an information technology (IT) problem. “But it’s not. There are a host of other concerns. How do employees get to work if there’s icing or flooding? Can they work from home?”
For credit unions that already have business continuity plans in place, Esser recommends updating and testing them at least annually. “Many credit unions won’t test their plans because of time constraints, cost, or fear of disrupting operations. One way around that is to test parts of the plan at night or on a Saturday if the credit union is closed on weekends.”
Credit unions won’t know if their plans will work until they test them, says Debbie Bergenske, CUNA Strategic Services alliance manager. “Also, you learn as you go along. One credit union tested its plan by taking two or three crucial people out of the loop and keeping them uninvolved just to see the effect: What will happen if there’s no backup? Who will step up to fill those gaps?”
CUNA Strategic Services has linked with Switch Communications Group to provide cloud computing services. “Instead of maintaining server racks and desktops, users can access software and apps on the Internet on a pay-as-you-go basis,” Esser explains.
Next: Plan components
Once a credit union decides to create a business continuity plan, there remains the question of what elements to include. Agility Recovery Solutions offers “Ready Suite,” an a la carte bundle of services credit unions can pick and choose from.
“We can run the gamut from temporary branch locations with complete facilities, such as a teller station and loan officer areas, as well as computers and furniture,” says Paul Sullivan, Agility’s vice president and general manager. “Or perhaps a credit union needs only satellite communications for voice and data, or a mobile temporary back office with workstations and office furniture.”
Emergency power is a major concern, he adds. “Seventy percent of all credit unions will have a power outage within the next 12 months, whether it lasts only minutes or goes for days. Often, the culprit is an aging infrastructure in many big cities. As it ages and is repaired but not replaced, power outages become more frequent.”
Agility, working from 80 North American depots, can have a standalone generator in place within four to six hours.
Sometimes potential clients will tell Sullivan they can acquire furniture, satellite links, generators, and mobile technology themselves after a disaster instead of paying someone to do it for them. “My response is simply, ‘Is this where your focus should be immediately following a disaster?’ ”
Sullivan understands that business continuity is yet another obligation heaped on credit unions, which don’t have the resources banks have.
“Credit unions could be well aware of the need for a recovery plan but don’t think they can afford it,” he says. “Also, with employees wearing so many hats, who’s in charge of recovery? Is it a full-time position? What must we sacrifice to be able to afford it?”
Some credit unions located within select employee group facilities simply hope the sponsor company will take care of them if disaster strikes.
Sullivan recalls a courthouse in an Appalachian county that had a fire. It took 10 days and $250,000 to restore IT functions.
“When we later discussed with an official how our $295 monthly fee would have allowed the courthouse to be up and running within hours after the fire, he said that amount was ‘spit in the bucket compared to what we spent to get back running,’ ” he says. “We thought, ‘10 days down? Would there be any point in continuing a business after so long?’ How many members would go elsewhere when they saw how slowly you responded?”
A common mistake is thinking a plan is the most important component of business continuity, says Sullivan. “The first thing you need is a place to do business if disaster strikes and/or arrangements with somebody who can come to you with essential facilities and services. I often ask, ‘If you were told today that your building had burned down last night, where would your people congregate and work?’ After that, you can create a formal plan.”
Some credit unions get bogged down in creating a plan, he notes. They’ll hire a consultant or cobble a plan together simply to please examiners.
“It never becomes a continuing process or a living, breathing thing,” Sullivan notes. “They never work the plan, it just gets put on the shelf to gather dust.”
Awareness, says Sullivan, is one thing. Taking action is another.
“The chilling statistic is that less than 20% of U.S. credit unions have a full-blown recovery plan in place,” he says. “They can’t meet the regulator’s criteria.”
Next: Disaster Recovery: Look to the Cloud
Disaster Recovery: Look to the Cloud
A relatively new element of business continuity planning is cloud computing, which involves accessing software and applications via the Internet on a pay-as-you-go basis instead of maintaining server racks and desktops.
One company that has extensive experience offering cloud computing is i365, a Seagate Company, which focuses on system and data backup recovery. Launched in 2008, i365 has 30,000 customers and eight U.S. data centers. Credit unions form one of its key vertical markets.
“Trailers and laptops aren’t as important as before,” says Karen Jaworski, i365’s director of product management. “With cloud, we can provision a virtual private network that allows all employees in an organization to work from anywhere. In scenarios where employees can’t get to the main office or branch, they can still work as though they’re physically there.”
Jaworski says many credit unions spend too much time on disaster recovery planning and testing whether their IT teams know what to do. “Crucial IT team members might not be available at a critical moment. It’s better to outsource to a provider who has the resources and experience to initiate recovery, and has customized the process to fit a credit union’s hardware and software.”
Cloud computing also eliminates costly purchases of duplicate equipment, applications, and software licenses. “We can bring up a client’s entire array of applications, so there’s no need to worry about which ones can be supplied right away for business use. All data up to the last backup before the disaster and during the time between the disaster and full recovery is also backed up.”
Jaworski says security is a common concern with cloud computing. But i365 encrypts data before transmitting it via encrypted wire. “As a final security step, the credit union is the only entity that holds the encryption key.”
Another concern is bandwidth and storage. “The costs of both have dropped dramatically and continue to do so,” she says. “So, aside from cloud’s economic sense, there’s its advantage over the physical transportation of data off-site to secure backup locations. Tapes can become corrupted, transport can be slow or disrupted, and there’s the element of lost time in both processes.
“Cloud is the next logical step in data recovery. It’s an achievable, outsourceable, economical service.”