IT Backup Should Be Only the Beginning of Your Disaster Planning
Editor's Note: CURE (Credit Union Retired Executives) is sharing advice with Journal readers based on questions it receives and responses from the numerous retired CU execs it has recruited. For more info: www.curetiredexecs.com/
Q: A CIO raised the issue of disaster planning and asked if IT backup is enough, and if it's not, what else might need to be considered.
A: The short answer is no. IT backup — far from being the end solution — is really just the beginning.
Beyond your standard IT backup, the first step for any organization — including credit unions — is to define the priorities and the vital functions that need to be in place, and continue uninterrupted, if a disaster strikes. This process must involve input from all departments of the credit union, from the CEO on down.
Your plan needs to take into account the different levels of disaster. All disasters are not considered "major." A major disaster might be an earthquake or flood, when the property and information loss potential is substantial -when even human lives may be at risk. Most disasters, thankfully, are not major; instead, they are more localized, such as a water main break, wind damage, or a problem with your power company or telephone service.
Your plan must cover all of these situations. What are your vital functions? They must be at the heart of your disaster plan. What do you need to continue to perform these vital functions and serve your members? Your plan must drill down to every detail — what, where, when, and who.
The most important — and perhaps most challenging-part of your plan is the testing phase. You must create and test an actual downtime scenario. It's too late to test when the event happens. For example, today we have become so dependent on electric power that everything from running computers to pumping gasoline depends on it. Can your staff function without electricity? If so, for how long? What is your Plan A? Your Plan B? And yes, your Plan C? Do you need an offsite location to continue operations?
To continue daily operations of vital functions — to continue to perform your core mission, which is serving your member-you need a plan, you need to exhaustively test every aspect of that plan to ensure that all contingencies are covered, and most importantly, you and the CEO need to make a commitment that continuous operations is vital for your credit union under any circumstances.