What Does a Business Continuity and Disaster Recovery Plan for an Ohio Credit Union Really Include?

A few years ago, I was sitting in a conference room with the leadership team of a community credit union. The conversation wasn’t about cybersecurity. It wasn’t about cloud migration. It wasn’t even about technology. The CEO looked across the table and asked a simple question:

“Rusty, if we couldn’t open our doors tomorrow morning because our systems were down…what would happen?”

The room got quiet. Everyone knew they had backups. Everyone assumed they had a disaster recovery plan. But when we started asking questions—Where are the backups? How long would it take to recover? Who makes the first phone call? What happens if ransomware spreads to every server?—the confidence in the room began to fade.

That’s when I realized something. Most organizations don’t need a better backup solution. They need a better plan.

Business Continuity Is About People First

When most people hear “disaster recovery,” they picture servers, backup software, or cloud storage. Those things matter. But business continuity starts somewhere else. It starts with people.

Your members expect to access their accounts. Employees expect systems to work. Your board expects leadership to be prepared. And regulators expect you to prove it. Technology is simply one part of keeping those promises.

A good Business Continuity and Disaster Recovery (BCDR) plan ensures your credit union can continue serving members even when something unexpected happens—whether it’s ransomware, a power outage, severe weather, or a hardware failure. For most credit unions, that means preparing to restore critical operations within hours—not days—and regularly testing those plans before they’re needed.

The Five Pillars of a Strong Business Continuity Plan

Over the years, I’ve found that the strongest continuity plans all have five things in common.

1. They Know What Matters Most

Not every system has the same level of importance. If your email is unavailable for an hour, it’s inconvenient. If your core banking system is unavailable for an hour, that’s a completely different story. One of the first steps in any continuity plan is identifying your mission-critical systems. That usually includes:

• Core banking applications

• Online and mobile banking

• Microsoft 365

• Network infrastructure

• Teller systems

• Loan processing

• Branch connectivity

When you know what matters most, you know where to focus your recovery efforts.

2. They Protect Data in More Than One Place

I’ve heard people say, “We’re fine—we have backups.” That’s a good start. But backups only help if they’re protected, recoverable, and regularly tested. Today’s credit unions should think in layers. That means maintaining secure backup copies that can’t be altered by ransomware, protecting Microsoft 365 data, keeping critical information offsite, and verifying that everything can actually be restored when needed. The question isn’t whether you have backups. The question is whether you’ve ever had to depend on them.

3. They Build Systems That Can Take a Punch

No technology environment is perfect. Hardware fails. Internet providers experience outages. Storms knock out power. The goal isn’t to eliminate every risk. The goal is to keep one problem from becoming a full-blown crisis. That’s why resilient organizations invest in things like:

• Redundant internet connections

• Virtualized servers

• Cloud services

• Battery backup systems

• Modern firewalls

• Hardware lifecycle planning

Think of it like building a bridge. The strongest bridges aren’t built because people expect them to collapse. They’re built so they won’t.

4. Everyone Knows the Plan

One of the biggest mistakes I see is assuming technology alone will solve the problem. It won’t. People need to know what happens next. Who declares an emergency? Who contacts employees? Who communicates with members? Who works with vendors? Who speaks to the board? A documented recovery plan removes uncertainty when emotions are running high. Because the worst time to figure out your plan is during the emergency itself.

5. They Practice Before They Need It

This may be the most important lesson of all. A disaster recovery plan sitting in a binder isn’t really a plan. It’s a document. Plans become effective only when they’re tested. That means:

• Restoring data from backups

• Running tabletop exercises with leadership

• Simulating cyber incidents

• Reviewing lessons learned

• Updating procedures as technology changes

Every test builds confidence. Every lesson makes the next recovery faster.

The Mistakes I See Most Often

When we assess a new credit union’s environment, a few patterns show up again and again:

• Backups haven’t been tested in years.

• Microsoft 365 isn’t being backed up.

• Recovery procedures exist only in one person’s head.

• Nobody has defined how quickly systems need to be restored.

• The business continuity plan was written years ago and hasn’t been updated since.

None of these issues happen because people don’t care. They happen because day-to-day operations get busy. That’s exactly why having a trusted technology partner matters. Someone needs to be thinking about tomorrow while you’re focused on today.

A Story Worth Sharing

I remember working with a credit union whose leadership believed they were fully prepared for an outage. On paper, everything looked fine. They had backups. They had recovery software. They had documentation.

So we scheduled a recovery exercise. Within the first thirty minutes, we discovered outdated passwords, missing documentation, and systems that took much longer to restore than anyone expected.

It wasn’t a failure. It was a gift. Because we discovered those problems during a planned exercise—not during a real emergency when members were depending on them. That’s why we encourage every client to test, learn, improve, and test again. Preparation isn’t about proving you’re perfect. It’s about making sure you’re ready.

Business Continuity Is Really About Trust

When people think about disaster recovery, they usually think about technology. I think about people. I think about the teller helping a member who’s trying to buy their first home. I think about the retiree checking their account balance. I think about the board members trusting leadership to protect everything they’ve spent decades building.

Technology exists to support those moments. Your business continuity plan protects them.

Final Thoughts

If there’s one thing I’ve learned after more than 26 years helping organizations navigate technology, it’s this: Emergencies don’t create leadership. They reveal it.

The credit unions that recover the fastest aren’t always the ones with the biggest budgets or the newest equipment. They’re the ones that prepared before they needed to.

If you don’t know how quickly your systems could be restored after a cyberattack, hardware failure, or natural disaster, now is the right time to ask. Not because you expect something bad to happen. Because your members are counting on you if it does. That’s what business continuity is really about.