*This article was originally published on CU Times.
When TruStage announced a cybersecurity incident in July, it was another reminder that even large, established organizations with significant security and technology resources can experience disruption. As the company took systems offline to remediate the situation, credit unions faced interruption of some member services. More than a dozen class action suits have already been filed, alleging that the incident disrupted critical services and that TruStage failed to provide the cybersecurity safeguards it had represented.
Every financial institution understands the threat of cyberattack, but there’s another lesson here for operations leaders. Systems – including those of third-party vendors – can become unavailable for any number of reasons: severe weather, power outages, equipment failures, even geopolitical disruptions. Whatever the cause, disruption forces an institution to deal with a fundamental question: Which operations must continue while normal systems and processes are unavailable?
Continuity Is More than System Recovery
Traditionally, business continuity planning concentrates on access to accounts, payment processing, digital banking, core systems, and data protection. Those priorities are entirely justified because financial institutions can’t function without them. That said, statements, notices, disclosures, tax and payment documents, and other required member communications belong in the conversation because their delivery involves compliance obligations.
There is danger in defining continuity too narrowly around the availability of systems rather than the business obligations those systems support. A financial institution may restore account access and resume transaction processing but be unable to generate a time-sensitive notice. Its digital banking platform may remain online, but what if the data feed required to produce statements is unavailable? Employees may have access to internal systems but no way to retrieve documents previously delivered to a member. The institution may be open for business while a critical vendor is inaccessible. In each case, the institution is technically operating, yet an important part of its operations has stopped.
System Recovery Is Not Process Recovery
Communication production and delivery is more than an administrative function; it’s an operational capability that carries compliance, servicing, audit, and member-trust implications.
Of course, not every communication carries the same deadline or legal consequence, and obligations that apply during a disruption would vary upon the circumstances. Still, an institution shouldn’t wait until systems are unavailable to think about which communications must continue – and how they’ll continue.
One challenge is that a required communication rarely depends on a single system. A statement or notice may rely on source data, secure transfers or integrations, validation, document composition, approval processes, print or digital production, delivery partners, authentication services, and an accessible archive.
Business continuity plans built around recovering individual technologies can miss the connections between them. A core system may get restored, but the required data may not reach the document-production environment. A communications platform may be available, but its archive or authentication provider may not be. Resilience must therefore be evaluated across the complete communications process, not system by system.
Delivery flexibility can provide an important safeguard. If a print facility or postal operation becomes unavailable, the ability to redirect communications to digital delivery may allow the institution to keep essential work moving. Conversely, print may provide an alternate path when a portal, authentication service, email system, or other digital channel is disrupted. Channel diversity becomes a valuable continuity capability when communications can be moved to an available delivery method.
A Vendor’s Resilience Becomes Your Own
Third-party providers are central to this discussion because most credit unions depend on outside organizations for core technology, document production, digital presentment, archiving, mailing, data processing, and other essential functions. These relationships can strengthen efficiency by providing specialized expertise, infrastructure, scale, and redundancy that would be difficult for an individual institution to maintain internally. But those advantages also create operational dependency.
And when a vendor participates in an essential operation, its continuity posture becomes part of your own.
Cybersecurity is an essential part of that posture. Preventive controls can reduce the likelihood of an incident, while monitoring and detection can limit its spread and operational impact. But prevention is only one dimension of resilience. Orgs must also be capable of rapidly containing and responding to a threat, which is why zero trust approaches are critical.
Institutions must also understand whether a provider can preserve essential operations, protect the integrity of data and documents, and recover securely if an incident does occur. Cybersecurity and business continuity should be treated as connected capabilities rather than separate areas of vendor oversight.
FFIEC guidance emphasizes financial institutions should embed business-resilience considerations throughout third-party risk management, including due diligence, contract negotiations, ongoing monitoring, recovery capabilities, capacity, continuity testing, and subcontractor dependencies. NCUA similarly stresses that credit unions remain responsible for determining whether vendor relationships support safe, sound, and compliant operations.
This suggests that communications providers should be evaluated on more than features, service, and price. Their ability to protect systems and data, contain emerging threats, maintain or recover production, shift delivery methods, preserve document access and delivery evidence, and operate through a widespread disruption should be considered part of their value.
No institution or vendor can prevent every outage, but business continuity is not the promise that disruption will never occur – it’s deliberate measures and planning to preserve the institution’s ability to perform its essential responsibilities when normal conditions don’t exist. Statements, notices, disclosures, and other required documents should be treated as operations that require resilience and continuity planning of their own.
