By Kirk Drake | March 23, 2020

How Is Business Continuity Priced?

Have you ever wondered how much credit unions spend on business continuity and disaster recovery? How about how the pricing is determined? Do you wonder what the TCO (total cost of ownership) is when you are looking at different providers?

The reality is, these are difficult questions to answer. Why, you ask? Well, there are four main components to consider, and they all present constantly moving targets. Your credit union is always changing. New systems, new employees, and new strategies create a dynamic environment.

Here are the four components to pricing business continuity or disaster recovery.

1.  Assessment

The first place to start is the assessment phase. There are several assessments you will need to perform. Each of these business continuity assessments are designed to measure risk while building consensus among key constituents so that you have a common framework, language, and approach to understanding how they interrelate. The various disaster recovery assessments include:

• Business Impact Analysis
• Risk Assessment
• Threat Assessment
• Financial Impact Analysis

These assessments can be done a la carte or as a group. Pricing will vary based on how much you are doing at once. In our experience, each component ranges from $5k to $25k, or when bundled together, they run $10k to $40k.

2.  Planning

Once you complete the Assessment phase, it’s time to start the planning phase. Ongoing Operations recommends that you focus on three levels of business interruption. Ask yourself:

• What happens if this person can’t work?
• What happens if this department can’t function?
• What happens if the whole organization goes down?

Each departmental plan needs to address these three levels. Additionally, they should have documented strategies and plans to deal with downtime, down people, and system-wide outages.

Business continuity pricing for this step usually requires some level of input from multiple people and departments in the credit union. Generally, this phase runs from $10k to $100k, depending on what level of input the credit union wants to provide.

For example, business continuity plans may be developed in house, with expert assistance, or wholly outsourced. Most of our clients opt to develop plans with assistance, and we provide a coach to work through plan creation and refinement with your team. The more involved we are, the more expensive the plans get.

3.  Tools

Disaster recovery planning software, data vaulting, backup data centers, crisis management notification systems, etc. are all “tools” of the trade. Their associated pricing options range considerably. Generally, we see credit unions spend on average $1 per member per year on these systems and tools.

More generically, organizations average 6% of their annual IT budget on business continuity spending.

Planning software runs $5 to $25 per user and can be fairly bare bones or highly feature rich. The more complex software includes embedded incident management software or crisis management notification software (CMNS).

Data vaulting, online backup software, or cloud replication tends to run $100 to $300 per month per server in our experience. Again, the features can vary greatly, and there is a direct correlation to the desired RPO and RTO. The faster the recovery and the lower the acceptable data loss, the more expensive the solution.

Connectivity capabilities help credit unions connect to key third parties like online banking, mobile banking, the Federal Reserve, or credit card and debit card providers. These connections often run about $1,000 per connection. Or, if you use a service like Ongoing Operations Connector DR, you can leverage an existing solution and spend less than $1,000 for all of your connections.

Co-location or offsite data centers are another key component of business continuity pricing. Almost every credit union over $50 million in assets has some ancient hardware that is not easily replicable and requires custom hardware. For example, this could be a core system or a DES key encryption system for your ATMs. Generally, a rack of space runs $1,000 to $2,000 a month, depending on the quality of the data center. You can also buy a capacity a la carte, from a single server, to a quarter rack, a half rack, and so on.

Core Systems are a unique component for credit unions. Each one usually cannot leverage traditional offsite data replication or backup solutions. Cores generally charge $1,000 to $5,000 per month for offsite backup and replication solutions. Some also will provide secondary hardware and software for performing this function.

4.  Testing

At this point, you have conducted an analysis, built a plan, and installed a solution. Well, unfortunately your work is just getting started. This is the most often overlooked part of business continuity pricing.

Almost half of our cost of delivering disaster recovery solutions comes to the care and feeding of the solution and testing it once or twice a year. This area involves a ton of labor, scopes of work, and a highly coordinated effort so that you don’t break your live environment. Strangely, it’s often easier to fail over in a real event than to orchestrate a simulated test…

Conclusion

So, whether you are considering rolling out your first business continuity solution or simply improving your existing one, understanding how business continuity pricing works will help you plan the tools, resources, etc. required to create and maintain a working solution. That way, you’ll know that if disaster strikes, your credit union will be prepared.