Credit unions often look to NCUA for guidance on preparing for a catastrophic act. While NCUA has minimal regulation in this area,1 as an aid to credit unions it is publishing this appendix of suggested guidelines. It is recommended that all credit unions develop a program to prepare for a catastrophic act. The program should be developed with oversight and approval of the board of directors. It is recommended the program address the following five elements:

(1) A business impact analysis to evaluate potential threats;

(2) A risk assessment to determine critical systems and necessary resources;

(3) A written plan addressing:

i. Persons with authority to enact the plan;

ii. Preservation and ability to restore vital records;

iii. A method for restoring vital member services through identification of alternate operating location(s) or mediums to provide services, such as telephone centers, shared service centers, agreements with other credit unions, or other appropriate methods;

iv. Communication methods for employees and members;

v. Notification of regulators as addressed in 12 CFR 748.1(b);

vi. Training and documentation of training to ensure all employees and volunteer officials are aware of procedures to follow in the event of destruction of vital records or loss of vital member services; and

vii. Testing procedures, including a means for documenting the testing results.

(4) Internal controls for reviewing the plan at least annually and for revising the plan as circumstances warrant, for example, to address changes in the credit union's operations; and

(5) Annual testing.

[72 FR 42274, Aug. 2, 2007, as amended at 77 FR 71085, Nov. 29, 2012]