Can Your Bank Bounce Back in Real-Time? (Cover Story)

Bounded by the Potomac River, Chesapeake Bay, and the Rappahannock, Virginia's Northern Neck Peninsula is a place for peaceful rural and waterfront living within easy proximity to many important places. The Neck's town of Lancaster falls within two hours' driving distance of Washington, D.C. The state capital of Richmond, home of a Federal Reserve District Bank, is also about two hours away. Sixty miles south is the naval base and extensive shipping center at Newport News. On Sept. 10, 2001, those distances all seemed substantial. On Sept. 12, potential targets for terrorism suddenly seemed, by contrast, to be part of the neighborhood--and to $250 million-assets Bank of Lancaster, redefined what disaster recovery and business continuity planning were all about. (For more on Bank of Lancaster, see p.30) In other neighborhoods around the country there were rumblings. Last spring, during a symposium on disaster recovery that the Federal Financial Institutions Examination Council held for information technology examiners, Allan P. Woods, vice-chairman and chief information officer of Pittsburgh's Mellon Financial Corp., gave a speech about Mellon's continuity plans. To underscore Mellon's preparations, recalls an examiner who attended the meeting, Woods held up a bulky satellite phone. He reportedly told the group that he was now expected to carry this with him at all times in case land lines and cell phone service failed. Meanwhile, for the $442.5 million-assets SpiritBank, Bristow, Okla., the Sept. 11 attacks were taken as a cue. "We went back to our disaster plan and reevaluated it," says Michelle Haskin, vice-president, information systems. "We felt that for the most part, we were fine." Both the core system and the separate check imaging and processing system were backstopped by hotsites. Still, there was one niggling detail that the bank considered--and then reconsidered: the location of its backup tapes. The site was ten miles from the bank's processing facility, in a town known as "The Pipeline Crossroads of the World," a place where multiple pipelines for gas and oil snake underground. "Prior to 9/11 we never really worried about that town getting hit," says Haskin. "We have since relocated our office backups to another small city, with less notoriety." Getting it together In a year of few consolations, the industry can at least take comfort in its first wave of progress on the preparedness front. One aspect of this is the renewed emphasis on "business continuity" over "disaster recovery." Continuity is a much broader category of expertise of which disaster recovery is a sub-specialty. While the latter is concerned with reconstructing systems and retrieving data if a primary production facility is damaged or destroyed, continuity looks to switch operations to a backup facility ("failover" mode) in real-time or close to it--typically within 24 hours. It also involves planning to help guide personnel in those critical minutes and hours after crises hit. (See Thinking the Unthinkable, ABA Banking Journal, January 2002, p.44.) By whatever definition, creating a new layer of protection against potential future disruption is costly. The North American securities industry will spend more than $790 million on continuity in 2002, and up to about $1.1 billion by 2005, according to TowerGroup, Needham, Mass. Banks are also stepping up their spending to become more protected, though hard data were not available. "Since it will be increasingly difficult to anticipate political flare-ups and the fallout here in the future, the idea will be to use technology and to engineer a reasonable solution around what is unknowable," says Seth Fagelman, vice-president of Business Development for CyrusOne, a business continuity vendor based in Houston. …