By Kirk Drake | July 23, 2014

How Can I Test The Recovery of My Credit Union Third-Party Connections? [Tech Tip}

If you work for a Credit Union, you probably are trying to figure out how to test and prove to the NCUA that you can recover your pesky Credit Union third-party connections.  Third party connections are generally things like shared branching, ATM, Credit Card or Online banking.  Click here for a full review of potential third party connections.

These connections provide critical delivery channel access to your members and are often ignored in CUs.  The expense of having duplicative infrastructure here is generally cost prohibitive even for larger CUs.   That being said, if you do have backup connections or use Ongoing Operations Connector DR product then it is important to test at least annually.   If you use Ongoing Operations product then you are in luck as we test a subset of the connections almost weekly and generally reroute connectivity multiple times during the year to different Credit Unions.  Consequently, we know it works and can prove it!

For those of you that want to be more hands on or would like to know how to approach it.  Here are our basic testing steps for third-party connections:

Testing requirements vary for each vendor connection but our process is pretty simple.

• Define 3rd party testing in SOW provided below
• CU to contact vendor account management (PSCU, Frist Data etc.); OGO can assist if CU does not have an account manager.
• Conference call with CU to share technical details.
• Conference call/email w/3rd party to share technical details and confirm dates.
• OGO to make any modifications (firewall, routing etc.)
• CU, OGO & Vendor work together on test day to confirm communications.

A Sample SOW Might Include The Following:

Planned Test Date and Schedule

• Network Recovery Schedule
• Delivery Channel Recovery Schedule
• Core Recovery Schedule
• Server Recovery Schedule (RTO)
• Process and Procedure Testing (BCP)
• Communication Test Schedule

Planned Scenario

Recovery Point Objective

After Hours activity planned

Overview of Key Technology Included:

• Network (WAN/LAN)
• Delivery Channels (ATM, Online Banking, etc.)
• Employee technology (pcs, applications)
• Core System
• Application Recovery Goals
• Communication System Recovery Goals (Voice, E-mail, etc.)

Primary Contacts

Broad Success Statement

You can learn more about disaster recovery by clicking here for an outline of the FFIEC guidelines on Disaster Recovery Testing:

In general we find it takes a few hours of effort to properly scope and design the test. The actual disaster recovery test can take up to two full days depending on the depth. Many of our clients test multiple times in a year.

For more information on how you can improve your business continuity program and disaster recovery plans, contact us today.