Northbridge Credit Union: A DR Plan That Does Not Match the Business Promise

The finding is fair. Disaster recovery is the set of technical and operational arrangements that restore data, applications and infrastructure after a disruption. Business continuity is the broader capability to keep delivering products and services at acceptable predefined levels. DR is therefore a subset of BC, and a DR plan that is not derived from business impact tolerances cannot demonstrate alignment.

Evidence supporting the finding:

• The four-hour RTO is not traced to a business impact analysis or to a maximum tolerable period of disruption. Calling it 'aspirational' confirms it is neither committed nor resourced.
• The alternate site covers only the online banking front end. Recovery of the core depends entirely on the vendor's 24-hour service restoration commitment.
• The test produced nine hours, more than double the stated objective, and the manual fallback was used without a tested capacity limit or end-of-day reconciliation procedure.
• There is no evidence of business sign-off on recovery priorities or of management acceptance of residual risk.

Partial mitigation exists: NCU has a documented plan, an alternate site and a manual fallback. Those are inputs, not proof of alignment. The practical response is to rebuild RTO and RPO from a business-led BIA, validate the vendor dependency and re-test against agreed objectives before arguing about the wording of the finding.

The three figures answer different questions. The MTPD is the time after which the impact of losing core banking becomes unacceptable. The RTO is the target time to restore the service and must sit below the MTPD with a margin for detection, decision-making and verification. The vendor's 24 hours is a contractual service restoration target, not a guarantee, and may exclude data recovery, queue processing or failures caused by NCU's own systems.

If the business can tolerate only 12 hours of manual processing before liquidity, regulatory reporting or customer harm becomes severe, a 24-hour vendor commitment already breaches the MTPD. A four-hour internal RTO then cannot be delivered by the vendor alone. The nine-hour test result should be treated as evidence, not an anomaly.

Actions:

• Determine the real MTPD by measuring manual processing capacity, transaction backlog growth and regulatory reporting deadlines.
• Renegotiate the contract to include tested recovery evidence, service credits, escalation and data restore obligations.
• Add an intermediate recovery capability, such as pre-staged data or a partial in-house core, so the business is not wholly dependent on one vendor.
• If the gap cannot be closed, present it to the board as a risk acceptance with a dated remediation plan, not as an IT performance issue.

Changing the number may make the document internally consistent with the vendor contract, but consistency is not the same as adequacy. The change is acceptable only if a business-led BIA shows that the MTPD is comfortably greater than 24 hours plus a recovery margin, and if manual processing can be sustained for that period with tested controls, reconciliation and customer communication.

If the MTPD is shorter, the proposal documents a gap rather than closing it. The regulator is likely to see a reduced commitment without supporting analysis as evidence of the original problem. A defensible approach is to set tiered objectives: a shorter RTO for critical functions such as deposits, payments and regulatory reporting, and longer RTOs for lower-impact services. The board should approve the tiering and any residual risk.

The plan should also state the assumptions behind each objective: vendor performance, manual capacity, data currency and staff availability. The CIO's proposal can be part of the solution only when it is the output of an impact analysis and is linked to a funded remediation plan, not when it is used to align the text with an inconvenient test result.