Tom Hinkel, Director of Compliance
Your ability to recover from an unanticipated business interruption is a direct function of your specific recovery procedures, and according to the most recent FFIEC guidance, “…recovery time objectives (RTOs) are now much shorter than they were a few years ago, and for some institutions, RTOs are based on hours and even minutes.” All Business Continuity Plans (BCPs) should begin with a comprehensive business impact analysis, which is designed to identify the most critical processes and functions and establish an RTO for each. Once the RTO is established, resources are allocated and specific procedures can be implemented to assure that the processes (and their interdependencies) are recovered within that RTO. Finally, testing will validate that the recovery procedures are effective.
Once the RTOs have been established by senior management, the BCP committee (or equivalent) will determine the best recovery method for each function. For example, in a traditional money center institution, cash handling functions typically have a lower (shorter) RTO than loan origination, meaning a quicker recovery time requirement. The teller functions rely on multiple interdependencies, such as core connectivity, WAN, LAN, Active Directory user authentication, and application software. All components must function properly in order for the teller functions to operate, and your specific recovery and testing procedures should include all interdependencies.
For example, let’s say the business impact analysis has determined the following recovery time objectives for these critical functions:
|Functional Area||RTO (Days)|
|Electronic Services – Debit Card||
|Electronic Services – Internet Banking||
|Electronic Services – ACH||
|Electronic Services – Merchant Capture||
Using the teller functions as a further example, a work flow analysis has identified the following interdependencies to the teller process:
|– OS||– PC||– Server||– WAN||– Security|
|– TellerPlus||– Teller Printer||– DHCP|
|– Scanner||– AD|
|– Laser Printer||– SQL database|
Since the RTO of the main Teller function is less than 1 day, software, hardware, LAN, core and facilities must all have an established RTO of less than 1 day. If testing does not validate recovery within the RTO, there are 3 options:
1. Increase the RTO to fit your current recovery capabilities. This could increase risk in other areas, such as regulatory, reputation, operational, or strategic.
2. Allocate additional resources to the recovery process. This could include staging spare equipment, hosting critical servers off-site, and utilizing online data vaulting.
3. Keep RTO’s and recovery procedures as is, and hope you never have a disaster (not really an option, but more common than you would think).
Depending on the threat, disasters can affect any or all of the following: people, processes, technology, or facilities. A server hosting solution can potentially eliminate technology and facilities from consideration, thereby shortening the recovery process. Additionally, in the case of teller function, the institution would also require a physical facility for customer access, however, with a server hosting solution, they would not require a server and database rebuild, which is the single most time consuming part of the recovery process. Based on these requirements and FFIEC RTO guidelines, Safe Systems has developed a comprehensive solution to address both server hosting solutions (Continuum), and physical facility recovery through our strategic partnership with Recovery Solutions.
There is generally an inverse relationship between recovery time and cost, i.e. the shorter the RTO, the higher the financial investment. This is only logical, because the most critical functions are those that carry the most significant risk of financial loss to the institution. Considering options such as a Safe Systems’ hosted server solution in your recovery planning will help you to assure that your RTOs are achievable. Equally important is that any such solution includes periodic tests in order to validate all recovery assumptions. To learn more about Hosted Services, Disaster Recovery, and our solutions, please contact Safe Systems at 877.752.0550 or email@example.com.