You can't realistically prepare for every possible type of disaster, so you should prepare for the most likely worst-case scenario, Rich Griesser, vice president of information technology (IT) for Hughes Federal Credit Union, Tucson, Ariz., told CUNA Technology Council conference attendees in Hollywood, Calif., on Monday.
It’s important to differentiate business continuity planning from disaster recovery planning, Griesser says. Business continuity planning is about recovering all of your services whereas disaster recovery is about IT systems and functions.
“Our goal was to build a disaster recovery center with sufficient capacity to support all mission-critical applications," Griesser says. "Our course of action was to identify needs, understand risks, assess criticality of data and apps, assess the impact of hardware failures and downtime, and assess methods of recovery.
“Once I had a plan to achieve our goal, I had to present it to the board and senior leadership," he continues. "I explained that our disaster recovery center would need to be an extension of our operating environment, and it had to be ready at all times. I told them to think of it as a secondary branch that could process all transactions and serve all members—and that it wouldn't be cheap.”
Griesser recommends being upfront with senior leadership on what it will take to prepare business interruptions.
“Anticipate your hardware, communications, cooling requirements, and power needs,” he says, “and understand all of the interdependencies between your systems.”