April 14, 2003 -- Federal regulators have released their final white paper on disaster recovery for the financial sector, urging improvements in data center redundancy, but stopping short of any specific guidelines regarding backup facilities.
The document reinforces the need for "out of area" data centers, but acknowledges industry concerns about disruptive mandates, such as a minimum distance between primary and secondary data centers.
The findings, which were expected, backed away from more aggressive proposals in an earlier version of the document.
In recent months, numerous large financial firms have begun seeking additional data center space outside Manhattan and its immediate suburbs. The Depository Trust Corporation and MasterCard have bought data centers, while the Bank of New York just leased a former WorldCom facility in Somerset, NJ.
In its initial form issued last fall, the white paper - prompted by the Sept. 11 attacks and developed jointly by the Federal Reserve, Treasury Department and SEC - established a goal of same-day recovery for Wall Street and the banking sector.
It also suggested that some key financial firms' disaster recovery plans were inadequate to address a large-scale regional disaster.
"All core clearing and settlement organizations should begin to implement plans to establish out-of-region back-up resources within the next year," the agencies state. "The objective is to minimize the risk that a primary and backup site, and their respective labor pools, could both be impaired by a single wide-scale regional disruption."
Those concerns were supported by a February GAO report which found that at least four major Wall Street firms maintain no backup data centers for disaster recovery, while six other firms' facilities are located within 10 miles of their primary site.
Wall Street industry groups objected to the initial white paper, saying business continuity programs should be guided by current best practices, rather than specific criteria such as a minimum distance between data centers. They also noted that current real-time mirroring technology also places limits on the distance between the primary and secondary data centers, usually no more than 60 miles.
The revised paper "provides more flexibility to firms in managing geographic diversity of back-up facilities, staffing arrangements, and cost-benefit considerations," the agencies noted.
"The agencies do not believe it is necessary or appropriate to prescribe specific mileage requirements for geographically dispersed back-up sites, the paper noted. "Firms may consider the costs and benefits of a variety of approaches that ensure rapid recovery from a wide-scale disruption."
The agencies made it clear that "core clearing and settlement organizations " bore a responsibility to meet the highest standards for business continuity. "Accordingly, these organizations should establish back-up facilities a significant distance away from their primary sites," the paper stated.
While concerns about disaster recovery have boosted activity in the US data center market, some Wall Street firms appear to be looking abroad to outsource their backup facilities.
"A few commenters indicate that they are exploring overseas locations as part of their recovery and resumption solutions and ask for some assurances that domestic and foreign financial authorities will permit such arrangements," the white paper said.
The final form of the white paper was welcomed by Wall Street trade groups.
"The paper's business continuity objectives, sound practices and timetables will clearly improve the resilience of the U.S. financial markets," said Donald Kittell, Executive Vice President of the Securities Industry Association.
"We appreciate the agencies' responsiveness to those comments, the intelligent process the agencies used to follow through and understand the views of market participants, and the constructive balance between meaningful objectives and flexibility of approach reflected in the final paper," Kittell added.