recent months, NSE.IT was busy preparing and implementing
a Business Continuity plan for its parent company, the
National Stock Exchange. NSE's disaster recovery site
was recently completed and went live. Satish Naralkar,
CEO, NSE.IT Ltd., tells us the strategies behind his
Business Continuity Plan. by Brian Pereira
What's the latest development
at your disaster recovery site?
Our DR site in Chennai has been fully operational for
the past two months. We did our own internal tests and
these were followed by a mock, i.e. dummy trading. The
DR site went live at the end of March—we actually did
live trading from there. For this, we shut down the
Mumbai site for about two hours, and did live trading
from the backup site.
What are the
norms for switching over to the DR site in an emergency?
The criteria we follow are based on the nature of the
disaster. For hardware, software or environmental problems,
we determine if systems or applications are repairable
and recoverable, and within what timeframe. In such
emergencies, our engineers do spot assessment and troubleshooting.
The first choice is to recover the same system as soon
If we are not able
to get back online (within a certain time), we switch
over to a backup system within the same premises (at
the primary site itself). But if even this is not possible—for
instance there may be a major fire at the primary site—then
we take a decision to switch over to the backup site
(if we know we are not going to recover in a certain
timeframe, say a few hours).
to the DR site is the last resort, since the switchover
takes time, and involves a set of operational procedures.
We thought this is the
best approach to recover systems quickly, without unnecessarily
switching over to the DR site.
So the decision
is taken on the basis of each situation.
How much time
does it take to switch to the DR site?
We have designed our systems to switch over in such
a way that we would be online again the very next day.
But if a disaster occurs at the beginning of the day
(before the market opens), we could be online maybe
in an hour's time (by switching to the backup systems
at the primary site itself).
But the switch
cannot be instantaneous. The reason is that the transactions
are conducted in real-time, and are held in memory.
One transaction may be worth several crore rupees—and
it could have a cascading effect (on other transactions).
So we will switchover with a fresh cycle, and copy previous
transactions to the backup site.
procedures are specific to each department/workgroup—and
everything is well documented.
When do you
back up transactions?
We have two ways of backing up. Backup for the backend
transactions (like clearing and settlement) are done
on an event or online basis. The time taken to backup
depends on the transmission time for data transfer.
Secondly, there is the
trading data which is inside memory. This data is transferred
to the backup site at the end of the day.
What are the
challenges you encountered while setting up a BC plan/DR
site? How did you tackle these challenges?
Broadly, there are two types of challenges—technical
and non-technical (people/management). The biggest challenge
is convincing top management that business continuity
(BC) investment is essential. The general perception
is that, investment on something you will use only in
an emergency (which is very rare), is not justified.
But one should remember that, though disasters are not
frequent, the consequences will prove very costly.
suffer huge losses in business each day due to downtime.
NSE's daily turnover (total worth of all transactions
each day) is Rs 2,000 - 3,000 crore.
The resulting damage
could be both tangible and intangible. Tangible: Loss
of assets. Intangible: Loss of business, loss of credibility/image.
The second challenge
is deciding how much to replicate. Then there are second
level decisions like how much time do you want for the
switchover. The switchover time definition is important
because everything is going to cost you. All these decisions
are linked to your investment.
The other challenge
is to give realistic requirements (for decisions like
switchover time definition), rather than just what one
The next challenge
is to involve all groups in business continuity planning
(BCP). The technology will handle the switchover—but
who is going to monitor the markets? It's your people,
so they must be part of this plan. Everyone has to own
the BC plan.
The plan is made
after consulting the entire organization. Remember Y2K?
It was an organization goal, not a technology goal.
Complete BCP cannot be achieved unless all user groups
are involved, including top management.
The next challenge
is handling change and maintaining the BC policy. You
can create a BC plan that will hold good in the beginning.
But as time goes by, you upgrade infrastructure, install
new applications, make changes in existing applications
and configurations—so the plan may not be comprehensive
after six months. The challenge is to keep the backup
site in sync with the primary site—at all times.
You should conduct
regular drills and test the BC plan, then keep it up
to date. At NSE we do such drills once a month.
NSE, what's the current scenario in India? Which type
of companies have a business continuity plan?
It is mainly the large enterprises and finance-related
companies who have a BCP. But these companies have done
this mainly out of compulsion. Regulatory bodies have
insisted on BCP. RBI has imposed this for all banks
and SEBI has also introduced guidelines for mutual funds
Many IT companies
will go in for BCP/DR as their overseas clients insist
on it. If they want contracts they need to have a BC
plan. Organizations dealing with essential services
are also going in for BCP—especially those that make
a major impact in the market.
The attitude and
mindset has got to change. People think they will not
be affected by a disaster, and hence they do not feel
the need for a disaster recovery site or investment
in business continuity. Companies will do this only
out of compulsion. If the choice is left to them, few
will take initiatives.
But the awareness
levels have certainly increased after 9/11.
Brian Pereira can be
reached at firstname.lastname@example.org