How to create a business continuity plan in 6 steps

As the Chief Operating Officer of a credit union service organization, it’s been tough watching the wildfires affect so many across California and North Carolina. But even though it feels like disasters are hitting left and right, I take solace in knowing there are credit unions looking out for the well-being of their members and their communities in these trying times.

And when nature decides to act, credit unions can’t just hope for calm skies. We have to be ready. That’s why I’m so passionate about business continuity planning: it’s the backbone that keeps us standing when everything around us is uncertain.

But what does “ready” actually mean? It means having a plan that covers technology, operations, people, and communication. It’s making sure your staff can switch to alternate systems seamlessly if your primary site goes down. It’s also checking that your members can access their accounts, no matter what storm (literal or figurative) may blow through.

So, let’s explore a few key steps you can take to create or refine your credit union’s business continuity plan.

One thing to keep in mind as you begin the process: Disasters are rarely predictable. Sure, hurricanes follow certain patterns and wildfires are more likely to start in dry areas, but you never really know when nature will throw you a curveball.

That’s why you can’t just file a plan away in a drawer and call it a day. A business continuity plan should be a living document—something you nurture, update, and test on a regular basis.

One of the first things you should do is to assemble a group of folks, your Incident Response Team, who will be ready to spring into action during an emergency. “Incident Response Team” is a specific term that SOC auditors look for to identify plans complete with cyber response components.

This team typically includes senior executives, IT managers, and even frontline staff who know your operations inside and out. Some credit unions also appoint a safety officer or a communications lead who can coordinate updates to employees and members.

Here’s the thing: communication is always key in a crisis. You need clear phone trees, email protocols, or even SMS alert systems set up. That way, nobody’s left in the dark when decisions need to be made quickly.

Not every system or department is equal when it comes to criticality. For example, your mobile banking platform may be a top priority system, while your marketing stack could be a secondary priority. That’s not to say marketing is unimportant—just that in a disaster, you’ll likely focus on making sure members can transfer money or even check their balances first.

Create a list of what absolutely has to stay operational for your credit union to function. Then, make sure you have backup procedures (and even physical backups where needed) for those systems. This clarity ensures you’re using your resources effectively, especially during an emergency.

Credit unions should never rely on a single server room with a single power line, because they’ll be left scrambling if that one line goes down. A more robust strategy should involve:

When your plan includes a solid backup plan for power and network connections, you’re less likely to experience a total shutdown.

Anyone who knows me knows this is one of my favorite parts of business continuity planning. I’m a huge fan of tabletop exercises—basically “practice runs” where you imagine a disaster scenario and walk through your continuity plan step by step. Think of it as a fire drill but for all aspects of your credit union’s operations.

Round up your emergency response team, set the stage with a hypothetical catastrophe (e.g., a hurricane knocked out your main power grid), and then talk through your entire plan. Who contacts whom? Which systems are prioritized first? How do you inform members?

Don’t be afraid to throw curveballs during these simulations. The more realistic, the better. After the exercise, debrief as a team and adjust your plan based on any pitfalls you discovered.

A plan is only as good as the paper (or server) it’s stored on. Be sure to keep your business continuity plan in a secure, easily accessible spot. If your team can’t find the plan when they need it, then all your preparation is for naught.

Encourage your staff to review it at least once or twice a year. Technology changes, roles shift, and new threats emerge. For instance, you may decide to relocate your data center or partner with a new IT vendor, so you need to keep that plan fresh.

When it comes to business continuity planning, it’s easy to focus so much on technology that you forget the real heart of a credit union: people.

Make sure your plan looks out for employees who have to navigate disasters themselves. Do you have a way to check in on staff safety and well-being? Are there provisions for remote work if roads are impassable? Sometimes, the most pressing challenges involve people’s personal circumstances.

Show genuine care and flexibility, and your team will stick together even in the toughest times.

Managing an IT infrastructure can feel like wrestling with an octopus—there are always unexpected tangles and things popping up, no matter how prepared you think you are. As technology keeps evolving, the complexity level climbs higher and higher.

If you’re finding it hard to keep up, or you simply want extra support, CU*SOUTH offers IT Managed Services designed to keep everything humming—even when the power grid flickers.

We’ve built a program that goes beyond just troubleshooting errors. Our team will collaborate with you to craft a Business Continuity Plan that checks every box, making sure you’re equipped to handle IT audits and random disasters alike. And we’re not just about continuity—our crew can assist with daily IT tasks, network monitoring, cybersecurity, and a whole suite of services designed with credit unions in mind.

Feel free to reach out and discover more about our IT Managed Services—it may be the boost you need to face any storm that comes your way.