Your natural disaster preparation checklist

Proactive bankers and industry experts share their best advice for keeping your physical branches—and customers’ data and resources—safe and accessible should a natural disaster strike.

By William Atkinson

Before 2017, the US had never experienced two Category 4 hurricane landfalls in the same year in recorded history. Recently, two of these occurred within 16 days of each other.

Hurricane Harvey hit Texas for the first time on August 25 and made landfall two more times in the next four days, leaving in its wake an estimated $180 billion in damages. Hurricane Irma made landfall in Florida on Sept. 10, resulting in an estimated $65 billion in damages there. Irma also made landfall on Puerto Rico, followed shortly by Hurricane Maria, which is estimated to have caused upwards of $40 billion in damages to the US territory.

Many natural disasters, including hurricanes, tornados, floods, wildfires, ice storms and earthquakes, are likely to cause physical damage, but most of them will, at the very least, cause power outages of various lengths. Such events seem to have increased in frequency and intensity over the past 20 years, making it more important than ever that community banks be prepared to respond.

During a natural disaster, community banks must protect the safety of their own employees, customers and physical structures. They must also protect their financial data and transactions, the majority of which are now electronic, and continue to meet the financial needs of their customers as much as possible. If branches are damaged and the power is out, things get difficult.

“You need to be thinking about all of the considerations well ahead of time. For example, you need to know that you will have access to generators for sure if an event strikes. You can’t wait and hope to find some while everyone else is looking for them, too.”
—Scott Teel,
Agility Recovery

According to Scott Teel, senior director, corporate communications, for Agility Recovery, based in Denver, Colo., disaster preparation should be done when the disaster is still theoretical—not an imminent reality. “You need to be thinking about all of the considerations well ahead of time,” he says. “For example, you need to know that you will have access to generators for sure if an event strikes. You can’t wait and hope to find some while everyone else is looking for them, too.”

Agility Recovery provides business continuity and disaster recovery services to financial institutions, primarily. Services include temporary generator power, mobile and existing office space that allow for the continuation of retail branch and back-office functions, satellite communications equipment for internet and phones, and computer systems including servers, routers, laptops and desktops.

According to Jeremy Dalpiaz, ICBA assistant vice president for cyber and data security policy, it is important that community banks not only have comprehensive disaster preparedness and incident response plans in place but also test those plans on occasion to address any gaps in coverage.

Cyber and data security
As part of any disaster recovery plan, community banks must consider how their data backups are stored. The Federal Financial Institutions Examination Council (FFIEC) IT Handbook on Business Continuity Planning includes guidelines on this issue. “The IT Handbook states that banks should store their backup data in a secure off-site location to allow restoration and normal processing in the event of a disaster,” Dalpiaz says.

In case of a total loss of data, including backup data, community banks should consider joining Sheltered Harbor, which establishes industry standards for data backup in a secure vault. If all disaster recovery and business continuity options fail at a bank, a restoring partner, such as another bank or vendor, can service customers by providing account balance and basic account functions in a relatively short time period.

“It is an eye-opening experience to run through these tests every year and discover where our weaknesses are.”
—Meredith Olivia Begley,
Black Mountain Savings Bank

Should a branch sustain so much damage that it must close for repairs, community banks should also have a plan in place that offers continuous customer account processing, such as small-business processing payroll, customer check clearing and bill pay. “Electronic access to accounts is an excellent way to service customers during a natural disaster,” says Dalpiaz. “If banks use a vendor, make the vendor aware of the situation and work with them to ensure that customers have the access they need to perform their banking functions during a disaster.”

Tailor-made plans
The nature, scope and complexity of a community bank’s natural disaster plan will largely depend on its size. Black Mountain Savings Bank in Black Mountain, N.C., is small enough that it looks to third parties to help fill some of its gaps.

“We work with Secure Banking Solutions out of South Dakota and our IT service provider, All Covered,” says Meredith Olivia Begley, corporate secretary-treasurer for the $38 million-asset community bank. “SBS provides us with tabletop testing once a year to make sure our business continuity plan and incident response plan are up to date and working properly.”

The community bank, SBS and the bank’s IT service provider recently conducted a mock incident response test, where the incident was a flood, and walked through all of the steps the bank and IT provider would need to take during a real flood.

“We realized that since our server is in the basement, even though we are not in a floodplain, this could still potentially be a problem for us,” Begley says. “As a result, we are now going to look into how to address that potential exposure.”

Black Mountain Savings Bank is also planning for crises beyond natural disasters. As part of its test, it looked at how to manage a potential flu outbreak among bank employees. “We only have six employees, so this is something we need to consider,” says Begley. “It is an eye-opening experience to run through these tests every year and discover where our weaknesses are.”

The community bank also conducts disaster-related education and training for its board members. “When you involve different levels of experience and perspectives, this leads to even more questions and raises more issues and ideas of things you can do to improve during and after tests,” says Begley.

Black Mountain Savings Bank’s plan for power outages has already been tested and proven in real life. “We have had these events in the past, because we are in the mountains,” Begley says.

During a power outage, the community bank is on lockdown and services customers only through its drive-through. “We all work on laptops,” she adds. “Those of us who are officers have a ‘hot spot’ we can utilize for a period of time, even if the internet goes down.

“Having the laptops and internet service allows us to check reports that come down from our service providers,” Begley adds, “so we can tell how much a customer has on deposit, or how much their mortgage payment is, allowing us to continue to transact from customer accounts.”

US natural disasters, 2016

19: Number of floods
(up from 15 in 2015)

$10 billion: Cost of Louisiana floods

91: Total number of weather, climate
or geological disasters

Source: Munich Re

William Atkinson is a writer in Illinois.