COLUMBIA, S.C. – The tragic terrorist attacks have awakened America to seemingly unthinkable threats such as biological warfare. For credit unions the attacks drive home the need for solid disaster recovery planning, especially data recovery. Moments after skyjacked planes slammed into the heart of America's financial and defense communities, Navy Federal Credit Union's technical team reacted instinctively – by backing up data. "The first thing we did was make sure we had the freshest information we could at our off-site storage locations," says Ardin Goss, chief information officer of suburban Washington-based Navy (www.navyfederal.org). "It wasn't that we thought that we would be targeted, but just in case there were other, sympathetic, issues," says Goss, whose $14.1 billion, 2.1 million member CU has 92 branches, 25 of them overseas, and serves a big chunk of the military community and their families. One of those issues, which Goss says Navy FCU managers began to look at that afternoon – "after we had taken care of the immediate things" – was the possibility that its nearest backup site would be overwhelmed by others who needed to use it because the WTC attacks. Like the majority of sizable credit unions, Navy FCU stores data at one site and maintains a relationship with a disaster-recovery site (from which it could run its operations) at another. Its disaster plan includes considerations of how to get its people to those sites if they have to set up shop for a while in one of the centers, which Goss says his organization inspects routinely to make sure that that company could handle the CU's needs in case of an emergency of any nature. Of course, Navy FCU's plans were made to deal with a variety of scenarios, and the planning includes "things like half our building or data center being destroyed," Goss says. "As far as whether we worry about that being more likely to happen now than before, maybe a little," the CIO says. "But just like everyone else, we're happy to have a plan. It would be tough if we didn't." While the NCUA requires such self-examinations, the events of recent days have prompted renewed interest and vigor in the process. SUBHEAD: CALL NOW FOR TESTING "Our telephones have been ringing off the wall from people who want to schedule a test," says Jerry Greer, who manages the disaster-recovery center Harland Financial Services (www.harlandfs.com ) operates in suburban Dallas for its ULTRADATA clients. "We're now booked up into January," he says. His 4,800-square-facility includes the typical hardware and software that its clients use at home, allowing it to quickly get a credit union up and running. "We can usually get a small or medium-sized credit union up in six hours," Greer says. "A really large one can sometimes take eight to 12 hours once everything's loaded onto disk." Location is as important to the center and its clients as the technology within. "We're close to the airports, we don't get hurricanes or snowstorms, and we're pretty central," says Greer, whose center is near American Airlines' Dallas hub and serves 88 clients (including groups of credit unions joined as service bureaus) from locations as far-flung as California, Alaska, Puerto Rico, Minnesota and up and down the East Coast. Greer says the tests fall into three basic categories: TAPE TEST – Credit unions send the tapes to center to make sure they can be loaded and read, and that reports can be run from them. COMMUNICATIONS TEST – These are conducted to make sure that CUs can connect to the center through such things as ISDN and T1 lines, including the ability to run reports and printers remotely. SERVICES TEST – Processes including credit card and share draft transactions are tested to make sure the remote system is working, including connectivity to third-party processors and vendors. This step also includes making sure the client knows such nitty-gritty as airport and hotel locations for staffers to get to the center. Since 1988, eight disasters have forced clients to use the Texas center, including California floods and major hardware failures that forced replacement of entire processing systems, Greer says. Doug Barton, who manages the CENTURION Business Recovery Planning Services center in Angola, Ind., says his company's 1,100 clients also were reacting to the Sept. 11 disaster by scheduling tests and reviewing their own plans. "Having a recovery center is a good thing," says Barton, whose center is one of 11 the Jack Henry & Associates division has scattered around the country. "But what you need to have before that is a plan, so that that institution knows what to do if you have a disaster. "That includes everything from how to deal with the press so as to not alarm your customers or members to how information is shared within the institution. A lot of times only one person in the institution has that knowledge, and if that person is negatively affected . well, you could have some real problems." And while credit unions have to work to keep their disaster-recovery plans updated, so do the centers that serve them. "We try to stay active in what's going on in the world," Greer says. "We've taken courses on domestic terrorism, for instance, and belong to the Association of Contingency Planners, where there's always discussion about different types of scenarios. We learn what we can and share that." CENTURION's client list includes Mountain America Credit Union (www.mountainamericacu.com) in Salt Lake City, Utah, which was testing its business-systems recovery capabilities at this writing through CENTURION's center in Burbank, Calif., says Annette Zimmerman, CIO of the $945 million, 152,000-member CU. "Mountain America has had a disaster-recovery plan for several years, and it's reviewed and tested annually," Zimmerman says. Her organization also has local locations set up for disaster recovery, and as far as tape-storage goes, she feels pretty secure about that, too. "We back up all systems to tape nightly. We use a disaster storage company, Perpetual Storage Inc., located in the Wasatch Range of the Rocky Mountains just 30 minutes from our corporate office," Zimmerman says. "Their vaults are carved 200 feet into a solid granite mountain. It's impervious to floods, fire and earthquakes." Mountain America's commitment to security is not unique, certainly. "It is my experience that financial institutions, including credit unions, take most seriously this responsibility," says Oscar Mireles, senior vice president of technology and business development for Fiserv Credit Union Group (www.fiserv.com). "Regulatory agencies also have made this area of operational protection one of their auditing cornerstones, both for the institutions and their solution providers," says Mireles, whose company serves more than 2,400 credit unions. "High-visibility disasters such as the recent terrorist events or other dramatic events such as a major California quake or the Oklahoma City bombing, result mostly in an accelerated review of whatever plans and procedures exist," Mireles says. As for his own company, Mireles says, "We practice state-of the-art methods and procedures that ensure maximum possible recovery of data lost to unforeseen events. "They generally call for storage of data both locally and remotely. Both magnetic and optically recorded media are used, as well as paper log records, themselves contained in the recorded data. "There are other, more sophisticated means of data and environment protection, such as redundant and parallel processing, but these are used by a smaller subset of institutions for now. Regardless, availability of this data is essential to a timely recovery." Availability of data also is key to Liberty FiTECH Systems (www.libertysite.com), an Atlanta-based provider of processing services to 180 credit unions around the country, including both CU's that process on-site and off. "We record and back up our data center customer credit unions' transactions each day and transfer the information via secure courier to an off-site, flood and fireproofed storage facility located a safe distance from our headquarters," says Mike Evans, Liberty FiTECH president. As for client credit unions that house their own data processing, Liberty FiTECH hopes to establish a relationship with SunGuard, a full-service disaster recovery firm, to serve them as an off-site storage and recovery service. Evans also is seeing increased concern. "Certainly the tragic events in New York, Washington, D.C., and Pennsylvania have heightened our customers' disaster recovery awareness," he says. "Concerns include how to the credit union can conduct business and serve members even if its facilities were damaged or destroyed. We assure our customers that our disaster-recovery plan will enable them to continue operations. "For our credit unions with in-house operations, we advise immediate evaluation of their disaster plans and recommend maintaining or establishing a relationship with a proven provider of disaster-recovery procedures," the Liberty FiTECH president says. To one Midwestern credit union, the terrorist attacks simply underscored existing security concerns, especially involving computer connections and in particular Microsoft. "Our largest concerns are susceptibilities via e-mail, along with a possibility of increased hacking attempts," says Marc Kilgore, vice president of information systems at City & County Credit Union (www.cccu.com) in St. Paul, Minn. Kilgore says his 35,000-member, $250 million CU already sees an average of one virus per 100 e-mail messages and that an outside firm has been hired to perform internal and external security/risk assessments. Some of the most pernicious virus and worm attacks of late are targeted at Microsoft systems, and Kilgore says events of late are just hastening a move away from the software giant's products. "We are thankful that we use Netware and Linux for our Intel-based servers, which significantly reduces our risk," he says. "We have one Microsoft server running IIS internally, which we plan to remove in 2002 due to security risks," Kilgore says. "Overall, we're continuing to move away from Microsoft operating systems and server products, due to their higher cost of maintenance as a result of ongoing security problems." As far as data protection, Kilgore's CU stores data each day at a disaster-recovery hot site it maintains itself at a branch about 10 miles from its main office. City & County also maintains, through software from Hewlett-Packard and its core processor, SUMMIT Systems, a transaction-logging file that is mirrored to its disaster-recovery site in real time via a point-to-point T1 line. "This allows us to re-post all monetary transactions since the last backup tape was made," Kilgore says. "We also keep one week's worth of transaction log files, which allows us to re-post transactions farther back than the most recent backup tape, just in case the most recent tape is bad or the data is unrecoverable. "Using this process ensures that we have minimal exposure to any type of data loss." But perhaps the most fundamental step in minimizing exposure is to have a plan, follow it and keep it updated, experts say. "Get yourself prepared and stay that way," says Barton, the CENTURION center manager. "If we can be of help to you, we'll be glad to. But do it with somebody." – [email protected]