Natural and man-made disasters, technical interruptions, security breaches and theft all pose threats to the data that keep credit unions running.

And just as people prepare for the unthinkable, like a hurricane or fire, credit unions must protect their data should disaster strike.

The media used to store data will vary according to the institution's needs, but in any case, data backup plans must evolve just as business processes do, and data should be encrypted and regularly tested. That's according to a new white paper from the CUNA Technology Council.

The 500-member council's report examines the role data backup plays in the business impact analysis credit unions conduct as part of business continuity planning, plus the factors credit unions should consider when choosing data backup plans.

To help determine its findings, the council led case studies with three credit unions-one that uses evolving disk backup solutions, one that relies on tape backup and one that takes a blended approach.

"Whichever medium credit unions settle on, they must identify the most efficient and cost-effective means to replicate the data from their core processing system as well as a host of other sources, including other operational and financial software, e-mail systems, and e-documents," wrote the report's author, Karen Bankston, a 15-year freelance credit union writer and editor. "That may entail one or more backup solutions, identified through the process of settling on priorities on which data need to be retrieved most quickly and through which channels," Bankston said in her report.

The three case studies showed that data backup plans should be determined on a case-by-case basis, the report concluded. For instance, in order to store data critical both to its operations and member services, $279 million City County Credit Union in Fort Lauderdale, Fla., recently transitioned to full reliance on business continuity appliances that feature the ability to quickly get up and running on virtual servers. On the other hand, $358 million Nassau Financial Federal Credit Union in Westbury, N.Y., relies fully on tape backup, mostly because handing data over to a third party raises cost, security and accessibility concerns for the credit union. And $1.7 billion Veridian Credit Union in Waterloo, Iowa, uses tape backup for its core processing system but maintains a disk-based backup system for its other systems to ensure quick data recovery.

Tape versus disk is at the center of the data backup plan debate, and there are pros and cons to each side, Bankston said in her report. The biggest downside to disk backup is cost, but the data retrieval process is faster, more efficient and more accessible. A tape backup system, which is physically stored off-site, is less costly from the get-go and often provides peace of mind; however, data takes longer to retrieve, can be prone to malfunctions and is more likely to be lost.

"In terms of backup solutions, there remain generally two camps that rely on either tape or technologies using disk backup as a medium," Bankston said, adding that the two solutions do not have to be mutually exclusive. "For many credit unions a blended solution makes sense, depending on budget, timeline and level of risk."

While third-party vendors supply a variety of data backup solutions for credit unions, the CUNA Technology Council report recommended that credit unions look to their core processors for data backup plans as well. Although core data is a critical piece of the puzzle, it's far from the only element that must be backed up. Today's credit union draws on multiple systems and tools, such as third-party lending systems, e-mail and collections systems. And as a credit union's systems and tools grow and change, so must its data backup plans.

"Data backup requirements tend to swell over time, slowly and inexorably as credit unions add new systems," Bankston said, adding that according to Ryan Christensen of data backup company i365, "Credit unions looking to streamline backup processes should seek out solutions that can aggregate data from multiple platforms."

Once a credit union has determined a data backup plan strategy-which might include both tape backup and disk backup-three questions should be asked, the white paper said. First, is the data encrypted? Second, what's the backup plan to keep business operations running and restore data should it be lost? And third, is there a secondary site on which to operate and interact with members should the first one fail?

Encrypting data is essential, the report said, as is testing backup solutions. Testing should be done every couple of weeks, or every time the credit union upgrades or adds memory to a server.

The paper also urges credit unions to back up electronic documents, which are becoming more widely used. Additionally, they should examine the size of their Internet connection to make sure the bandwidth can support the amount of data to be backed up.

And credit unions must also review their data retention policies. By eliminating unneeded data on a regular basis, credit unions can lower data backup costs and more easily comply with data retention regulatory requirements.

No survey of a credit union's data backup plan is complete without taking a look at how it impacts business as a whole, from complying with regulatory requirements to enabling a member to cash a check. And since productivity depends on reliable access to data, an effective data recovery plan is mandatory for today's credit union.

Data recovery also is a core consideration in business continuity planning, which should include determining the costs of downtime. According to Bankston, "The most effective approach to data backup and recovery begins with business continuity planning, not as a standalone consideration but in the wider analysis of identifying and maintaining critical systems and business processes."

The white paper, titled "Backup Takes Front and Center: Capturing the Growing Tide of Data," is available at www.cunacouncils.org.

–[email protected]