Developing a Comprehensive IT Disaster Recovery Plan for Financial Institutions in North Central Nigeria

Financial institutions in North Central Nigeria, including microfinance banks and cooperative societies in Abuja and Plateau State, operate critical IT systems without formally documented disaster recovery plans, exposing them to prolonged service outages following power failures, ransomware attacks, or physical disasters. This study developed a comprehensive IT disaster recovery plan framework for financial institutions in the North Central geopolitical zone. A risk assessment methodology drawing on ISO 22301 Business Continuity Management standards was applied through structured interviews with IT managers at 10 financial institutions in Abuja, Jos, and Makurdi. The risk assessment identified the top five disaster scenarios: extended power failure (probability 0.87 annually), ransomware attack (0.62), flood damage to server room (0.31), hardware failure (0.94), and telecommunications provider outage (0.48). For each scenario, recovery time objectives and recovery point objectives were negotiated with business unit representatives and mapped to technical recovery strategies. The DR plan framework encompasses backup strategy specifications, alternative site provisions, emergency communication procedures, plan activation criteria, recovery team structure, and quarterly test exercise templates. A cost-benefit analysis demonstrated that the full DR plan implementation cost of approximately 4.2 million naira would be recovered within 18 months by avoiding a single major outage event. Expert review by six IT governance professionals confirmed alignment with CBN IT Standards for Banks. The study recommends mandatory CBN regulatory requirement for DR plan certification across all licensed microfinance institutions.

Keywords: disaster recovery plan, financial institutions, ISO 22301, North Central Nigeria, IT governance