CU Management Magazine
Storm Clouds Versus Cloud Cores
By Celia Shatzman
When natural or other disasters strike, there’s a lot for credit unions to worry about. But moving your CU’s core to the cloud can take one major thing off your mind by helping to ensure business continuity: You’re much less likely to have a core downtime when your branches go offline due to a disaster if the core system is hosted in the cloud rather than on-site or even off-site in a single location nearby.
In the long run, a cloud-based system aggregates resources so it can be more secure, reduce costs and simplify IT processes. It can also allow a credit union to focus on important trends, such as payment innovation to enhance member service. If you’re considering moving to the cloud core, here’s how it can help with disaster recovery.
Streamline Recovery
Moving the core to the cloud has a major impact on disaster recovery planning. “It’s critical that our staff can work remotely and have everything they need,” says Sarah Allison, CFO of $205 million Sterling Federal Credit Union (sterlingcreditunion.org), Sterling, Colorado.
“Through moving the core to the cloud, you have a more strategic disaster recovery and business continuity plan in place.”
Core systems on-premises or in private data centers require heavy investment in providing redundant environments that allow very fast recovery for a variety of failures, ranging from hardware and loss of facility to loss of telecommunications, explains Shanon McLachlan, VP of Jack Henry & Associates Inc. (jackhenry.com), Monett, Missouri, and president of Symitar (symitar.com), a division of Jack Henry with headquarters in San Diego.
But “when a credit union shifts from on-premises to a cloud environment, they shift responsibility for recovery to that provider,” he says. “Private and public cloud providers are typically able to provide a higher level of disaster recovery and business continuity by spreading the costs across a number of customers.”
In a private cloud environment, managed by the CU or a vendor partner, such functions as infrastructure upgrades and disaster recovery are typically the responsibility of the CU or the core vendor. In a public cloud environment, such as AWS (Amazon Web Services, aws.amazon.com), the cloud provider manages the infrastructure and hardware.
Since providing adequate redundancy in case of disaster can be cost-prohibitive, it’s a big a win for a smaller credit unions when private and public cloud providers take on DR responsibility. CUES member Javier Lozano, VP/information services of $943 million Northern Savings Credit Union (northsave.com), Prince Rupert, British Columbia, says that’s the case for his CU.
“We benefit from economies of scale here, and partnering with the right organization makes a big difference,” he says. “Every year, having to go through scenarios and test all the systems is really time-consuming and resource-intensive. … In the past, that used to take months for us in terms of preparation and planning. Now we’re benefiting from the work that [our providers are] doing. All we have to do is review the results and make sure that they are in compliance with our policies and standards.”
Moving the core to the cloud also gives vendors more control as it relates to continuity, says Preston Packer, VP/CMO, FLEX Credit Union Technology (flexcutech.com), Sandy, Utah. He advises that a continuity plan should include geographically diverse locations—and that applies to the locations of a cloud provider’s data centers too.
“We’ve seen an example recently where two data centers were within a 50-mile radius of each other, and all employees were in a 50-mile radius of those areas,” Packer says. In this instance, the winter storms that pummeled Texas in early 2021 took out a number of one provider’s servers, causing critical outages to online banking and other services for multiple credit unions.
“We can learn something from failure. That means a disaster scenario for a credit union that’s being impacted with their members. I certainly don’t wish that on anyone,” he adds. However, simply having a cloud core with data centers distributed across the globe doesn’t make disaster recovery as easy as flipping a switch. There’s a range of connection points to the core to con-tend with during an outage situation—internet banking, mobile apps, debit and credit cards, to name a few—so multiple parties are involved in these operations.
“But it can be more seamless, and it can be as near as real-time as possible because of technologies that facilitate the journey of transactions,” Packer says. Nevertheless, all parties need to be ready to tackle the recovery process. “The credit union is managing what’s local to them, and we’re managing our end of it, and then in a disaster recovery or continuity situation, we’re fusing together. We’ve been very successful with our model. We run it more as a hybrid.”
When a vendor is controlling the continuity plan, CUs must be wise and do their due diligence to understand how the vendor works and implements the plan. “We found out with the Texas freezes that vendors aren’t always doing everything right,” Packer says. “That was unfortunate, but that’s part of the continuity planning. The CUs really need to work closely with their vendor partners and core partners and ensure those types of risks are addressed.”
Business Continuity
Having lived in California for decades and now in Florida, Sabeh Samaha, president/CEO, Samaha & Associates Inc. (ssamaha.com), a financial technology consulting firm based in Miami Beach, knows what it’s like to live with the threat of natural disasters, and it’s taught him a few valuable lessons.
“The core should not be on site at the credit union, if at all possible,” says Samaha. “You want to have access to dynamic balances during a disaster of any size. You want to be able to take that snapshot of a balance from the core before the disaster, and then whatever transactions happen during and after the disaster. They should all be impacting that balance.
“They have to have that ability, and it has to be tested on a regular basis to show that all those transactions can be received and processed at the DR site,” he adds. “Otherwise, you’re operating in the dark during a disaster event.”
This applies to both in-house and cloud-based cores, adds Samaha. “In the case of cloud processing, the credit union would require the testing platform to be set up to handle this type of testing and also participate in the actual tests. In the case of in-house, the credit union would conduct the tests themselves.”
Having an off-site core minimizes the impact and can help avoid downtimes altogether, explains Darrin Blankenbeckler, CEO of Sterling FCU. “If a natural disaster were to impact our facilities, as long as we have secure internet access, we could still be open in an alternate location providing our members the services they need,” he says.
CUs should make sure their cloud provider has made the necessary investments in business continuity. To keep operating, it’s crucial to be able to access the system from anywhere and quickly and efficiently switch from one data center to another, Lozano advises.
Credit union staff need to be able to access to all systems, log everything and transact, adds Samaha. “It’s being able to work from hotels, being able to work from another credit union, being able to work from a warehouse or a school—you have to be able to do that,” he says. “This is the big piece that everybody misses, which is downtime processing procedures.”
Samaha has experienced disaster-related events while working at data centers in the past and knows this environment very well.
“These days, the challenges are quite different and yet the same,” he says. “This is where the real work begins—by committing to be prepared and modeling out real possibilities, from local fires to acts of God and everything in between. Unfortunately, we tend to have short-term memory and want to work on more exciting projects, but lest we forget Katrina and Rita, or Northridge and Whittier, we need to always remain vigilant and prepared.”
Credit unions should also consider what happens during a natural disaster from a member’s point of view. For example, if they need to leave town because their home doesn’t have electricity or running water, they may have to withdraw cash, so their ATM card will need to work.
“That’s the bigger connection point here,” Packer says. When members get to another geographic area, will they still be able to access their funds? “That’s where the cloud model really shines in the natural disaster scenario, because you’re in a data center that hopefully—and more than likely—is not impacted by natural disaster, which means it does not interrupt availability of data.”
Giving members a lifeline to the things they need during a disaster, which might be an ATM withdrawal to provide cash for basic necessities, is what will keep them loyal to your credit union.
Redundancy
The bottom line is that credit unions must plan for redundancy in case of a natural disaster, notes McLachlan. “For credit unions in geographical areas prone to natural disasters like a tornado, hurricane, earthquake or fire, having their system hosted in another region or in the cloud ensures business continuity,” he says. “In the event of a natural disaster, it’s not just about recovering the core; credit unions must re-establish connectivity to all their third parties.”
It’s important for credit unions to understand the technical details of redundancy when it comes to the cloud core, since it’s an integral factor. “With redundancy, critical components and/or functions of a system are duplicated,” McLachlan explains. “The duplicated instance acts as a fail-safe should the primary instance fail. With core redundancy, credit unions have a secondary version of their core running in the background that mirrors the primary core. Should the primary core fail, the alternate version can pick right up where the primary instance leaves off. Thus, credit unions can remain operational with little to no impact on member service.”
Having multiple data centers helps cloud providers mitigate and manage connectivity efficiently, enabling them to give the highest level of service and continue serving customers regardless of disasters affecting specific geographic locations.
Potential Challenges
Though the cloud offers more security during a natural disaster, it does come with some potential challenges. One is dealing with a downtime (or near downtime). “Downtime can happen for a number of reasons related to cloud-provider outages, configuration settings, etc.,” McLachlan says. “Back in November, AWS even had an outage for over seven hours!”
As such, it’s critical to verify that your cloud provider is ready and has the resources to detect and resolve issues before they cause a significant service disruption. “Jack Henry has modern monitoring tools in the hands of our skilled technicians to quickly diagnose issues so that any disruptions are quickly remediated,” he adds.
Even with potential pitfalls, moving the core to the cloud will not only help your credit union with disaster recovery, but it can provide the advantages of the latest technology. “We’re going to continue to see the pace increase of digital transformation,” Packer says. “Obviously, the pandemic kind of forced us all there. … When change happens, there’s all of these discoveries of new ways and more efficient ways of doing things.
If we’re going to accept that technology has improved our lives as consumers and as individuals, then we also have to accept that technology can change and transform our lives as a credit union and in delivering products and services to our members.
“It is inconvenient to make a change, but we’re getting through it and we’re learning from it,” he adds. “And in the midst of all of this digital transformation, we’re seeing a social transformation. That’s the beauty of technology.”
©2022 CU MANAGEMENT. REPRINTED WITH PERMISSION
