Financial institutions must develop a disaster recovery (DR) plan to regain critical systems and resume normal operations following unforeseen incidents from wildfires to everyday power outages.
After a natural or man-made disaster, time is of the essence. Banks and credit unions require a well-defined DR plan to protect and preserve sensitive and vital data. Responding to incidents quickly, whether a cyber breach or tsunami, reduces downtime and minimizes an FI’s financial, operational, and reputational damage.
In this post, we’ll dive deep into disaster recovery planning. What is the relationship between DR and business continuity planning? What are the essential elements of a bank disaster recovery plan? How much data backup does your financial institution need?
Keep reading to learn more about safeguarding your institution’s infrastructure, data, and systems from disasters.
Table of Contents
The FFEIC IT Examination Handbook explains that a financial institution’s disaster recovery plan should address a wide range of potentially adverse events. At the same time, a DR plan should be function-based rather than incident-based.
For example, your recovery plan should focus on backup contingencies for losing an asset, such as a critical system, and not whether that asset is lost due to a data center fire. In short, for disaster recovery, it doesn’t really matter what the threat. What matters is how you prepare for and respond to it.
The first step in a disaster recovery plan is understanding the assets vital to your financial institution’s operations.
DR plans should focus on your FI’s IT systems and physical infrastructure. Your financial institution likely relies on an integrated network of technology systems and structures critical to operations. These include:
Once you thoroughly inventory your technology, systems, and critical applications, you can label them as mission critical, essential, necessary, or non-essential. For example, wires and ACH payment processing systems are mission critical for most financial institutions, whereas your employee Intranet may be non-essential.
Defining your mission critical systems brings your DR plan into focus.
A Business Impact Analysis (BIA) is essential to disaster recovery plans at banks and credit unions. BIAs help pinpoint the costs associated with disruptions, such as lost revenue, replacing hardware and other equipment, additional employee wages, and profit losses.
After finalizing a BIA, financial institutions will understand the budget needed to safeguard against these losses. A business impact analysis also lays the foundation for disaster recovery efforts by determining Maximum Allowable Downtime (MTD), Recovery Time Objectives (RTO), and Recovery Point Objectives (RPO).
MTD refers to the maximum allowable downtime your FI’s specific systems, processes, and applications may be down before your institution experiences significant harm while your RTO indicates an acceptable level of downtime.
An RPO stipulates the longest allowable timeframe for data loss. For instance, if your financial institution’s RPO is four hours for a critical system, then data backups must be made every four hours. Systems with high transaction volumes and/or critical nature of data require more sophisticated data replication strategies and technology effectively reducing RPO to a value of near zero.
Your financial institution must set recovery objectives based on your determined by MTD, RTO and RPO for critical systems. This is likely the most essential element of any disaster recovery plan.
Related: Is your FI Ready for the Next Disaster? 5 Questions to Find Out
Disaster recovery planning and business continuity planning (BCP) are often viewed as two sides of the same coin. Business continuity planning focuses on how to resume normal business operations after you ensure that your people are safe and critical systems are functioning.
Business continuity planning emphasizes maintaining operations during disruptions, while disaster recovery focuses on quickly restoring IT infrastructure and data following an unforeseen event or crisis. BCP is about keeping a financial institution afloat and serving consumers during particularly challenging times, while DR is about returning to normal as quickly as possible.
Related: Business Continuity vs. Disaster Recovery: Understanding the Difference.
To review, the first three steps in developing a disaster recovery plan are listed are:
These are the most critical steps in your DR plan but are not the only ones. As a financial institution, you must also:
Related: 9 Steps to an Effective Tabletop BCP
Many financial institutions discover that they lack the resources to manually create, test, refine, and update their DR plans. What if your FI could rely on a business continuity platform that saved you time and money in disaster planning and business continuity?
Ncontinuity offers financial institutions an unparalleled disaster readiness solution that closes the RTO gap, enabling your institution’s systems to get up and running faster following an incident.
Learn more about business continuity management.