The Electronic Funds Transfer Association is assembling a group of disaster recovery definitions that it hopes bank examiners will adopt as part of the official language they use in their audits.
The definitions will attach specific recovery periods to heretofore vague terms such as "hot site" and "cold site."
By clarifying the terms used in disaster recovery, the association believes it can help financial institutions be better prepared for the way certain disasters will affect the service they receive from their electronic banking networks.
"Right now, there is not a common level of understanding of the terms used in the disaster recovery industry," said Sean Kennedy, president of the funds transfer association, an industry trade group based in Reston, Va.
"We're trying to get to the point where if someone says, |hot' we all know what he's taking about."
Defined Terms
The association hopes to complete a document and submit it to the Federal Financial Institutions Examination Council, which oversees bank examinations, in the first quarter.
Many of the definitions to be included in the document have already been written. A "seamless" disaster recovery plan would be one that includes a facility that can assume a main computer site's processing in an hour or less.
A "hot" site could be activated in 72 hours or less; a "warm" site in four to 14 business days. A "cold" site provides for disaster recovery in 14 to 60 business days.
The lowest level of preparedness, termed "plan only," is when no specific arrangements are in place prior to a disaster, but an outline for making such arrangements exists.
The funds transfer association began assembling the document last spring, when the examination council issued a policy statement suggesting that banks gain a better understanding of the disaster recovery plans of their automated teller machine networks.
Among other things, the examination council statement warned that ATM service outages could erode the public's confidence in banks at which ATM failures occur.
Inherent in this warning is that the ATM has become at least as important to many consumers as the branch delivery systems. And while the examination council did not specifically state that it intends to make the ATM disaster recovery part of routine bank audits, many in the industry believe that ATM recovery plans will get increasing attention from examiners.
If the funds transfer association succeeds in getting the examination council to adopt its definitions, network executives expect that bankers will have less trouble evaluating whether the disaster recovery services provided by their ATM networks and third-party processors is adequate.
In cases where the disaster recovery preparations are inadequate, bankers would be expected to demand better from the ATM companies in which they participate.
Network executives said they are prepared to improve their disaster recovery plans if the banks that own and participate in their companies are willing to pay for technical upgrades.
"A lot of banks believe that if they have disaster recovery plans in place to cover their [demand] deposit systems, they are all set," said Neil Marcous, general manager of Electronic Data Systems Corp.'s clectronic commerce division, based in Clifton, N.J.
"I'm here to say that responsible risk management is going to require that a lot of other areas be secured as well."
EDS, which is one of the ATM networks participating in the formation of the funds transfer association document, experienced a disaster last spring that knocked out about 5,000 of its customer banks' ATMS for several days. The company is currently building a state-of-the art backup data facility.
