In Person: Business Continuity
‘Consequences of disaster are very costly’

In recent months, NSE.IT was busy preparing and implementing a Business Continuity plan for its parent company, the National Stock Exchange. NSE's disaster recovery site was recently completed and went live. Satish Naralkar, CEO, NSE.IT Ltd., tells us the strategies behind his Business Continuity Plan. by Brian Pereira

What's the latest development at your disaster recovery site?
Our DR site in Chennai has been fully operational for the past two months. We did our own internal tests and these were followed by a mock, i.e. dummy trading. The DR site went live at the end of March—we actually did live trading from there. For this, we shut down the Mumbai site for about two hours, and did live trading from the backup site.

What are the norms for switching over to the DR site in an emergency?
The criteria we follow are based on the nature of the disaster. For hardware, software or environmental problems, we determine if systems or applications are repairable and recoverable, and within what timeframe. In such emergencies, our engineers do spot assessment and troubleshooting. The first choice is to recover the same system as soon as possible.

If we are not able to get back online (within a certain time), we switch over to a backup system within the same premises (at the primary site itself). But if even this is not possible—for instance there may be a major fire at the primary site—then we take a decision to switch over to the backup site (if we know we are not going to recover in a certain timeframe, say a few hours).

Switching over to the DR site is the last resort, since the switchover takes time, and involves a set of operational procedures. We thought this is the best approach to recover systems quickly, without unnecessarily switching over to the DR site.

So the decision is taken on the basis of each situation.

How much time does it take to switch to the DR site?
We have designed our systems to switch over in such a way that we would be online again the very next day. But if a disaster occurs at the beginning of the day (before the market opens), we could be online maybe in an hour's time (by switching to the backup systems at the primary site itself).

But the switch cannot be instantaneous. The reason is that the transactions are conducted in real-time, and are held in memory. One transaction may be worth several crore rupees—and it could have a cascading effect (on other transactions). So we will switchover with a fresh cycle, and copy previous transactions to the backup site.

The switchover procedures are specific to each department/workgroup—and everything is well documented.

When do you back up transactions?
We have two ways of backing up. Backup for the backend transactions (like clearing and settlement) are done on an event or online basis. The time taken to backup depends on the transmission time for data transfer. Secondly, there is the trading data which is inside memory. This data is transferred to the backup site at the end of the day.

What are the challenges you encountered while setting up a BC plan/DR site? How did you tackle these challenges?
Broadly, there are two types of challenges—technical and non-technical (people/management). The biggest challenge is convincing top management that business continuity (BC) investment is essential. The general perception is that, investment on something you will use only in an emergency (which is very rare), is not justified. But one should remember that, though disasters are not frequent, the consequences will prove very costly.

Companies could suffer huge losses in business each day due to downtime. NSE's daily turnover (total worth of all transactions each day) is Rs 2,000 - 3,000 crore.

The resulting damage could be both tangible and intangible. Tangible: Loss of assets. Intangible: Loss of business, loss of credibility/image.

The second challenge is deciding how much to replicate. Then there are second level decisions like how much time do you want for the switchover. The switchover time definition is important because everything is going to cost you. All these decisions are linked to your investment.

The other challenge is to give realistic requirements (for decisions like switchover time definition), rather than just what one fancies.

The next challenge is to involve all groups in business continuity planning (BCP). The technology will handle the switchover—but who is going to monitor the markets? It's your people, so they must be part of this plan. Everyone has to own the BC plan.

The plan is made after consulting the entire organization. Remember Y2K? It was an organization goal, not a technology goal. Complete BCP cannot be achieved unless all user groups are involved, including top management.

The next challenge is handling change and maintaining the BC policy. You can create a BC plan that will hold good in the beginning. But as time goes by, you upgrade infrastructure, install new applications, make changes in existing applications and configurations—so the plan may not be comprehensive after six months. The challenge is to keep the backup site in sync with the primary site—at all times.

You should conduct regular drills and test the BC plan, then keep it up to date. At NSE we do such drills once a month.

Looking outside NSE, what's the current scenario in India? Which type of companies have a business continuity plan?
It is mainly the large enterprises and finance-related companies who have a BCP. But these companies have done this mainly out of compulsion. Regulatory bodies have insisted on BCP. RBI has imposed this for all banks and SEBI has also introduced guidelines for mutual funds companies.

Many IT companies will go in for BCP/DR as their overseas clients insist on it. If they want contracts they need to have a BC plan. Organizations dealing with essential services are also going in for BCP—especially those that make a major impact in the market.

The attitude and mindset has got to change. People think they will not be affected by a disaster, and hence they do not feel the need for a disaster recovery site or investment in business continuity. Companies will do this only out of compulsion. If the choice is left to them, few will take initiatives.

But the awareness levels have certainly increased after 9/11.

Brian Pereira can be reached at brianp@networkmagazineindia.com