No full stops in IT

N JAYALAKSHMI

How the show can go on? Define the organisation's key business areas and the likely impact of a disaster on these functions? What are the key assets that will be lost? Define severity of risk as high medium and low? Measure probability of occurrence of risk as high, medium and low. The 9/11 attacks were high probability but low intensity risks. Regular backup of all work Remote sites for backup servers Have centers in locations outside India Keep staff ready to fly onsite, if needed

hen a certain aircraft fuelled with terrorist vengeance hit the Twin Towers in New York last year, the aftershocks left the business world numbed. But it also taught CIOs and CEOs a lesson or two. They learnt what probably even Harvard Business Schools has not caught up with yet - namely, that this is an age of uncertainty it is better to be prepared than face unpleasant consequences. Welcome to the world of the business continuity plan, a hot new entrant to the cluster of IT industry buzzwords. Its not the September 11 catastrophe alone that catalysed corporate decision makers to sit up and take notice. In an interconnected global economy where business is spread over multiple locations it is not over-prudent to ensure that one's business continuity plan is in place.

A hard look at the damage wrought by events like the one New York witnessed on 'Black Tuesday' reinforces the need for corporates to opt for such strategic measures. Consider this: CitiGroup reportedly lost 472 file servers and 4,300 workstations after the WTC attack. Besides, the company lost 1.3 million square feet of property. Also consider this. When an earthquake of the magnitude of 6.8 on the Richter scale hit western Washington, power and phone lines were completely disrupted. In both these situations, companies were quick to fire their business-continuity plan into action. For example, Citigroup implemented 800 out of its 2,550 disaster recovery plans and its foreign exchange desk was transferred to London when the WTC attack occurred. The company had also invested in a wireless device that proved critical since it turned out to be the only mode of communication during the day.

And during the Washington earthquake, IBM Global Services was in contact with nearly 20 clients in the Seattle area. The company moved one of its client companies' operations to an IBM local access suite in Seattle where it could access backup AS/400 systems run by IBM. These are just examples of what any business needs to do in an emergency and a pointer to systems and processes companies need to have in place. As one analyst stated, "We live in a dangerous world, and every time something happens, there tends to be a blip where people focus on business-continuity plans, then its back to business as usual."

Cut to India, and the scene is no different here. With murmurs of a nuclear war doing the rounds, corporates are taking business continuity investments seriously. The recent travel advisories issued by the US government added to the urgency of assuring US businesses that India is a safe offsite haven. An Ernst & Young's Global Information Security Survey 2002, conducted across 17 countries says that 70 per cent of Indian Chief Information Officers, IT directors and business executives surveyed indicate that they expect to experience greater vulnerability as connectivity increases. A majority of respondents also reportedly indicated that critical business systems are increasingly interrupted.

No wonder, that of late there have been a spate of media reports about Indian software companies readying their business continuity plans in the event of a war. This is especially so since clients of these companies insist on a sound back-up infrastructure. Major software companies like Wipro and TCS are prepared for any eventuality. Vivek Paul, vice-chairman of Wipro, was recently quoted as saying, "We are letting customers know that should there be any issue, we have a well-defined business continuity process in place."

These companies do have a daunting task at hand. Besides making sure that there is a sound back-up infrastructure to face any eventuality, including a sound security network, they have to communicate to their clients that they are here to stay, disaster or no disaster. For example, Wipro reportedly assured customers that it has 2,600 people onsite and that all its senior managers have multiple entry visas, besides having local people to carry on business. It is also highlighting to its clients that its developmental centres in Bangalore and Hyderabad are far removed from Kashmir and that it is self-sufficient in terms of telecom links for backup.

Many companies like HCL Perot Systems, Wipro and Hughes Systems also have multiple development locations. Hughes Software Systems (HSS), as part of its business continuity plan, has set up multiple server locations to back up work so that if one server is destroyed, the work can continue without a hitch. Companies also have local people working at their international offices for better cultural understanding and communication. Says Mujahid Alam, country manager, Mistral Solutions, an embedded systems solutions provider, "When we discovered that doing business in Japan was tough we hired local people to operate there, who were familiar with the local culture. This also ensures that continuity of business is maintained."

Apparently, most client concerns relate to communication links, and bandwidth. In fact according to analysts, relationship between effective rapid response and availability of wireless technology devices and wireless LANs are becoming increasingly critical. This may be one reason why HCL Perot Systems, as part of its business continuity plan, is ensuring that its employees develop code for a variety of communication links. It also has independent telecommunication link hubs in Europe and North America. Besides, it has ensured that all links to and from the clients can be passed through alternate routers. Meanwhile, the National Association of Software and Service Companies (Nasscom) has been reportedly working on a plan to lower the war risks accruing to the Indian software sector.

And yet, despite all these, some statistics indeed reveal that there is room for more. According to the Ernst & Young's Global Information Security Survey quoted in a news report, 47 per cent of Indian companies have continuity plans as compared to 53 per cent globally, and over half the respondents do not have agreed recovery timescales. It also apparently adds that only half of those surveyed have employee awareness and training programmes in place regarding business security and continuity plans. But on a positive note, it adds that corporates are beginning to look at security infrastructure in a more focussed manner than ever before. But again, it reportedly adds that the highest level of activity in most companies seems to take place in areas like anti-virus, access management and firewall management and that 40 per cent of organisations do not investigate incidents.

According to M. D. Agrawal, chief manager, IS Refinery System, Bharat Petroleum Corporation Ltd, most IT heads are quite content and almost complacent until disaster strikes. According to him you don't have to wait so long to get your act together. "Just pull your network together and bind it with a carefully planned disaster recovery and backup policy," he has been quoted as saying. He also quotes from a survey conducted in 1994 by the University of Texas, Center for Research on Information Systems to reinforce his views. According to this survey, out of all companies that lose their data in a disaster, 90% are out of business within two years, and nearly 50% never reopen their doors at all after the disaster. He adds that before creating a business continuity plan, it is essential to consider the potential impact of disaster and to understand the underlying risks.

Experts often cite the examples of GE and Citibank where business continuity plans are concerned. According to them, these companies have looked at continuity plan holistically, involving not just technology, but also manpower resources and corporate policies.

Meanwhile, at a different level, the need for continuity plans has also spawned a new kind of business opportunity for the IT service providers in India. According to recent media reports, companies like Wipro, Satyam, NIIT, i-flex and NSE's IT arm, NSE.IT, have all decided to tap the market for business continuity services. Besides, hardware majors like IBM, Compaq and HP too are taking ahard look at this. Well, talk about turning disasters into opportunities!

(N Jayalaksmi is a freelance writer, who writes for dailies like Times of India)

Email this article | Respond to this article