Disaster Recovery Programme – Post 9/11 Regulatory Compliance

Following the global regulatory response to 9/11, the South African Reserve Bank mandated that all major banks must demonstrate the ability to recover critical financial systems within 90 minutes. Working within the trading environment at Nedbank CIB, I played a key role in the bank’s Disaster Recovery (DR) compliance programme.

I was responsible for compiling a full inventory of every application used within the Investment Banking division, identifying where each system was hosted, and classifying applications as critical or non-critical based on operational and regulatory impact. This allowed us to determine the recovery time requirements and ensure appropriate DR alignment.

A secondary DR site was established more than 25km away from the main production environment to meet business continuity requirements. This included full workstation setups (desks, desktops, telephony) and replicated servers for all critical systems. I coordinated the setup of these environments and ensured that technical teams, business stakeholders and vendors were aligned.

We conducted regular DR tests—typically over weekends—which involved shutting down the production environment and timing the full recovery of systems at the DR site. Working closely with infrastructure teams, business owners and the Reserve Bank, we refined recovery processes until all critical systems consistently met the 90-minute recovery mandate.

Once stabilised, these DR tests became subject to external audit twice annually, establishing full compliance and ensuring that the bank’s trading and settlement operations could remain resilient under extreme circumstances.