NY disaster underlines business continuity needs

banking technology online

By Fabien Buliard

Thursday, 25th October 2001 - The destruction of the World Trade Center (WTC) in New York on 11 September has not only caused many of the most prominent financial institutions in the world to lose a shocking number of their employees, but also the technological infrastructure on which their businesses relied.

TowerGroup estimates the cost of replacing these systems as $3.2 billion. In an event of this magnitude two conditions must be fulfilled to ensure business continuity – access to a disaster recovery location and a back up of the data lost on site.

According to Ian Glover, a director at Insight Consulting, which specialises in business contin-uity, companies affected fall into three categories. In the heavily regulated financial sector, few firms would fit into the first category of those without any disaster contingency plan.

However, Glover believes that not all recovery plans being used by financial institutions are comprehensive. Following the disaster, many brokerage firms had to divert much of their activities to their offices overseas, mainly in London or financial centres in Asia. At the second level of continuity planning, some firms will have a third party recovery contract for the provision of temporary dealing rooms, computer systems and an office envir-onment. Access to such centres is sold to more than one client and the problem with this particular set-up is that many of the same kind of companies need to use the same facilities. Glover says they can all be accommodated but not necessarily in the location they thought they were going to get.

‘That is causing logistical problems in terms of getting people to the centres and providing the connections back to the main exchanges,’ he says. These contracts also provide recovery positions for a limited period, after which they move on to a very costly charge per seat per day.

The shortcomings of such contracts have led many financial organisations to chose to run their own recovery centres, which are geared to take over the business for a longer period of time. ‘The idea is that you would use such facilities while you look for other accommodation within your property portfolio, or go to the marketplace to find something, or back to your existing building for normal operations. They have the ability to recover to a minimal level, but they may struggle to find available resources,’ says Glover.

Another major issue raised by the WTC tragedy is the ability of companies to recover the data that was stored in the twin towers. According to a report published on 12 September by software house mi2g, ‘most banks and insurance companies have routine batch back-ups for all their key data. In addition, trading floors have a regular back-up every hour or per transaction.’

Some organisations will have mirrored systems with every single transaction written to the main computer system being written to a duplicate system located elsewhere. ‘With those systems you would recover the data immediately,’ says Glover. ‘Other organisations work on a back up principle, which means that in some cases the data could be 24 hours out of date.’

The problem is the location of such backed-up data. It won’t have survived if the mirrored copies or back up tapes were located within the WTC.

Glover says he knows of at least one client that had its primary system in one tower and duplicate system in the other tower, underlying the case for backing up data well off-site. Last month’s attacks will inevitably lead to higher business continuity investments. However, financial institutions in the UK might be better prepared than their US counterparts, because they had already faced terrorist attacks. Glover says past attacks at Bishopsgate in 1993 and Canary Wharf in 1996 caused many London-based institutions to review their location and recovery centres.

‘Banks moved their back-up sites at least three or four miles away, off the Docklands island, but we’re already getting questions as to whether that’s far enough away,’ he says. ‘A balance needs to be struck between the geographic separation and accessibility.’

He points out that most business continuity plans are designed to provide recovery, making the assumption the right number of technical staff and business people will be available to continue the operation. ‘What we haven’t had in the past is significant loss of life,’ he explains.

Much was made of the ability of the US markets to get up and running so soon after 11 September. While this was mainly due to fierce determination not to be beaten, the existence of recovery procedures greatly contributed.