Surviving the Hurricane: A Case Study in Business Continuity

BancorpSouth Used Lessons from Katrina to Prepare for Gustav
Surviving the Hurricane: A Case Study in Business Continuity
Hurricane Gustav may have hit the state of Louisiana with a broad swipe of rain and high winds, but one bank was ready for whatever it had in store.

BancorpSouth, ($13 billion assets, [BSX: NYSE]), employs more than 3,900 people in about 290 commercial banking, mortgage, insurance, trust and broker-dealer locations in Alabama, Arkansas, Florida, Louisiana, Mississippi, Missouri, Tennessee and Texas. The bank is no stranger to bad weather, having survived Hurricane Katrina along the gulf coast of Alabama, Mississippi, and Louisiana in the fall of 2005.

This is how BancorpSouth's incident response and business continuity plan handled Hurricane Gustav, and how the lessons learned from Hurricane Katrina were taken to heart when planning for the worst.

Calm Before the Hurricane
As Gustav's track across the Gulf of Mexico began in the last week of August, BancorpSouth's office of emergency management and response was opened and began tracking . BancorpSouth's Security Officer Mary Lois Stockman, at the bank's headquarters in Tupelo, MS., shares some of the lessons the bank applied before, during and after the hurricane. After Katrina, Stockman says that the bank's management team learned so much. "We went back and looked at our plan and made changes. You learn from each and every experience. We found the things that worked and those that did not work. By and large, our people felt more comfortable knowing we had all these things in place."

One thing the bank did differently was adding additional help in preparing the bank's structures for the hurricane. "Previously the bank did not have a contractor to help close and shutter our buildings, and our maintenance people were doing it," Stockman says. "That's a lot of work for a few people to do in a short time, and it's overwhelming if there's only got a few people in that area."

Preparations for each branch vary, she notes, according to the location and whether the branch is in the hurricane's line. "At all branch locations, after personnel power down their machines on Friday night, they had to back up their equipment and then put it inside plastic contractor bags to protect them from any water leakage. Any computer equipment was moved off the floor and put up on a counter or desk."

There are certain precautions taken for any unprocessed after-hours work. "Even if they have a full-sized vault, each branch places currency and checks and other important papers into the tamper evident currency transfer bags used by the Treasury. We learned a very hard lesson after Katrina, where we learned the horrible answers to what will happen when currency and checks are saturated with mud and water."

Communications Timeline
From a command post that was set up earlier in the week in Gulf Port, MS., the bank's office of emergency management rechecked its arrangements with vendors to supply the bank's needs after the hurricane, including arrangements with fuel suppliers to supply diesel for its diesel generators, if power was lost.

Before the hurricane hit, the bank checked with its commercial customers for any deposits or requests for money and change. For consumer communications, the bank uses the public radio to communicate after the hurricane. Public radio is used because that is the only communication that many customers will have immediately following a hurricane. "We will tell them what branches are closed or open, times of operation, and if they need special services, where to go to get them," Stockman says. "The media has been very good to us in the banking sector, especially after Katrina, to help us let people know where they can go to get banking services."

Of course, Stockman adds, the bank is very proactive in talking with its regulators to let them know what is going on. "One of our goals after Katrina was to get open quickly to serve the public, and in this case we were."

Vendor communication before, during and post hurricane is also important. Especially critical are core services, including business continuity planning vendors. One lesson learned after Katrina was arrangements should be made in advance for armored truck availability. "After Katrina, the Loomis armored trucks were not considered emergency vehicles, and were not allowed through certain areas. The trucks only made it through after a larger city had to make its payroll," she notes. With Gustav, the bank made its large government check payouts to consumers on Friday. "The government sent its social security out early because it wasn't sure what the storm was going to do. The railroad retirement checks also went out early for the same reason," she says.

It was Loomis that reached the bank earlier in the week by email to let them know that, after Gustav made landfall, the armored trucks would be running as soon as it was safe to do so. This was good news to the bank, as it handed out much more cash on that Friday, says Stockman. "Customers who were moving out of the coastal areas that were under mandatory evacuation were coming in and getting cash for the weekend, and many remembered the problems they faced after Katrina in getting access to their money." This meant the bank gave out a lot of cash. It was prepared for this event and had ordered extra cash for just that reason earlier in the week.

Employee communications were honed after Katrina, so over the weekend the bank held conference calls to confer with staff on the ground at branches in the hurricane's line to assess equipment and staffing needs, as well as building conditions. The bank also has an 800 number for employees to call during emergencies. It allows the employee to check status and let the bank know where they are, if they have evacuated and also if they have any emergency requests for help. It also informs employees where to report for work, branch closings, and other important information they need to know. "That communication piece, I think is the best part of our plan," Stockman observes.

The Aftermath
While Mississippi and Louisiana branches saw a lot of rain, only three Louisiana branches of the bank were forced to remain closed, two due to power loss, and the bank's main office in downtown Baton Rouge suffered some water damage from flooding. So far, so financial figure has been attached to the estimated damage.

"As soon as we can, we will be restoring power to the branches in Alexandria and Lafayette, LA. The water damage at the Baton Rouge main office will require cleaning, which will take some time," Stockman says. The main office's lobby will be cleaned first, as the other side of the building houses the bank's commercial lending. "Our priority will be to restore the lobby -- we will want the area where consumers come to be the most presentable and opened first."

Despite the few locations that were not able to open on time on Tuesday after the storm due to power issues, "With Gustav, we were ready, because we learned so much from Hurricane Katrina," Stockman says.

"At daybreak on Monday, we found out that we had water in the main office in Baton Rouge. The base camp moved people to the main office in Baton Rouge to work around the clock to clean up and make the office ready to open on Tuesday," Stockman says. One bright note Stockman recalls was the one additional day that was available to the bank because Gustav hit over a three-day holiday weekend. "We had that extra day to work to get things dried and get ready."


About the Author

Linda McGlasson

Linda McGlasson

Managing Editor

Linda McGlasson is a seasoned writer and editor with 20 years of experience in writing for corporations, business publications and newspapers. She has worked in the Financial Services industry for more than 12 years. Most recently Linda headed information security awareness and training and the Computer Incident Response Team for Securities Industry Automation Corporation (SIAC), a subsidiary of the NYSE Group (NYX). As part of her role she developed infosec policy, developed new awareness testing and led the company's incident response team. In the last two years she's been involved with the Financial Services Information Sharing Analysis Center (FS-ISAC), editing its quarterly member newsletter and identifying speakers for member meetings.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing cuinfosecurity.com, you agree to our use of cookies.