Continuity expert shares wisdom

It’s a Sunday afternoon and you need a mobile bank branch. Where do you get it? It’s not something you’d find listed in the phone book. As a business continuity consultant for banks in the 1980s, finding the answer to ‘where can I get…?’ questions was a frequent quest for Steven Lewis, a certified information systems auditor and a certified computer programmer with a Ph.D. in systems and a couple of engineering degrees. Lewis developed more than 120 comprehensive business continuity plans for network-based organizations — many of them banks — attaching an ever-growing sourcing guide to the disaster plan. Eventually, a client suggested he make a product out of his guide. The 2005 version of the Edwards Information Disaster Recovery Yellow Pages is the fourteenth edition of that commercialized product, now published by Edwards Information, LLC. Lewis serves as editor-in-chief of the book spanning Canada and the U.S. with more than 3,000 listings in 355 categories. He recently spoke to Susan Maclean from his office in Brookline, Mass.

IT Focus: I see the directory is intended to help professional business continuity managers and general managers involved in disaster planning locate hard-to-find resources in the planning process and on-the-spot during emergencies. Do you have a major readership base in the financial services industry?

Steven Lewis: We have probably 35 per of our readers in some kind of financial services capacity, with about 15 to 20 per cent in banking, including credit unions, community banks as well as large banks; another five to 10 per cent in the brokerage business and another five to 10 per cent in the insurance companies. So, our biggest block of readers is in the financial services sector. The directory began in the banking business. If you go through it listing by listing you’d come across drying wet microfilm. That’s the kind of thing a bank rather than a manufacturer is interested in. Its heritage in the financial services industry is laced through it.

Banks have a lot of paper records. Banks travel on paper so they have to be sure to have the capability to process paper no matter how electronic they are. No matter how much you want to use optical disks, there comes a point with loan applications and other personal things that get signed that have to exist on paper. We find the general theme of records management laces through a lot of our buyers.

IT Focus: Is there a message financial services firms need to hear in terms of disaster recovery and information technology?

Lewis: In a way, it’s a two-part message. The first part is that bankers’ hours don’t count any more. They are a 24-hours-a-day operation. The financial sector has a broader range of institution sizes than almost any other, and it is often the smaller institutions that can get burned. In 2005 you can be a little credit union somewhere, buy a package from a service bureau and suddenly you’re in online banking. But that means you have to be running at three in the morning and you can’t afford to have your ISP suddenly go away so people can’t reach you. You have to have alternate ISP providers, alternate e-mails, and so on.

The second part of the message sounds simple but is really very complicated: quick recovery of what’s essential today.

A quick example: an insurance client years ago had 47 servers in a skyscraper. The sprinklers went off and they had to bring up 47 new servers. The way the world works is you go to a temporary operation for a week or two, you come back to a six-month’s site and then you finally get back to a permanent refurbished site. There was no way they were going to get 47 servers even delivered within a week, much less reloaded, tested and reconfigured before they’d be moving to another site. What they needed to do was take off the 47 servers just the really important drop dead stuff, put that onto one or two servers, run those couple of servers three shifts a day and people would come in and get their work done.

Particularly in financial institutions, you have regulatory reports due, tax returns due, all kinds of individual regulatory requirements that may be important tomorrow but not today. If they are due in February and the disaster happens in September, you can forget about it [in the context of] what’s essential today. IT people really need to know the ebb and flow of the business. IT managers may not always be exactly sure who they work for. They often don’t know or understand the business’ turnover. They just know they have to keep the computers going with the latest servers and all kinds of technology stuff and they often don’t pay attention to what’s crucial this moment to their user departments.

For example, one of the most important things for an insurance company is their cancellation notices. Come what may, those things have to go out. Here you are an IT person, but you have to provide a back-up for high-speed printing, insertion and mailing so that you can get those cancellation notices out. That often has very little to do with the work a systems programmer is normally concerned with, but that’s what people are going to be screaming for when that disaster happens.

IT Focus: Is not the financial services industry the best private sector in terms of business continuity and disaster preparedness?

Lewis: You could say it is the best, but that’s not saying much. The brokerage industry is onboard after 9/11. They had mirrored back-up sites, but no one was there to run them. They never thought they would lose their people. I gave a talk in 1995 based on the 1993 bombing of the World Trade Center. On the day of the conference, no one mentioned ‘what if we lose all the people?’ Brokerages are not up to the bank level. Insurance companies even less but they are coming along.

IT Focus: A recent document from your company lists 20 items often overlooked or wrongly assumed even by experienced disaster recovery planners. What of these apply to financial services companies the most?

Lewis: Employees’ personal-life situations. Often disaster plans require key employees to locate to a computer hot site in an emergency. Employees who are single parents and those who are caring for ill relatives may not be able to work emergency overtime or relocate. You can get into privacy issues if you ask employees personal questions. Instead, you can have employees sign a form on a yearly basis indicating that they understand the disaster plan as it pertains to them, and ask them to note any limitations they may have in carrying it out. You’ve protected their privacy and got the information out of them.

Another is the vulnerability of telephone and network terminators to falling water. Time and again we have found network servers right under sprinkler heads. One hundred per cent of the financial services buildings we have been in have an unprotected panel on the wall in the basement where the telephone wires enter the building. A toilet overflow could fry out the telephone connection. A South Carolina bank in hurricane Hugo had its roof lifted. There was no structural damage but water leaked in. The telephone connection in the basement was fried and they went one week with no outside connection.

A common assumption is made about your company’s priority to utility companies. Hospitals are first; emergency services second. Everyone else is altogether. Your company will be down in the weeds if you haven’t actually provided the back-up emergency generator your plan calls for. Another issue is with mergers and acquisitions. About 10 years ago, when an American insurance company bought a Canadian company, the Canadians were responsible for the facilities in the U.S. They didn’t even know whether the local police had the right information. Blueprints should be filed with the local emergency services de

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now