New Delhi: Disasters—be it the terrorist attack in Mumbai on 26 November, 2008, the tsunami in 2004, or the floods in Kerala in 2018—tend to disrupt businesses in a big way, causing a lot of turmoil and anxiety among employees and huge losses for companies. Estimates from insurance giant Swiss Re pegged economic losses from natural and man-made disasters at $306 billion, worldwide, in 2017.
To ensure business continuity is not affected during such calamities, companies are turning to disaster recovery (DR) plans, offshoring data centres in locations across safer zones, or outsourcing them to cloud service providers completely. For instance, companies in Japan, where floods occur every year, have moved their data centres to Malaysia.
Just taking back-ups is not good enough: Most of the time, companies think taking back-ups is good enough for business continuity. “The real challenge lies in regular testing of data restoration and the frequency of the backup, depending on how dynamic your data is. So, if a company’s data is changing almost on a daily basis, they cannot be taking a back-up at the end of the week." says Vishal Jain, partner, Deloitte India.
Simulating, testing: A must: While having a plan helps, it is not sufficient unless companies are testing their DR strategy through simulation. When it comes to actual simulation of an event to check if the DR plan is working or not, most Indian companies are not fully prepared, rues Jain. “Simulation not only makes the company prepared, but also incorporates disaster preparedness into the company’s DNA. Training of staff is also important for disaster so they are mentally prepared."
But are Indian companies doing enough? There is an increase in awareness among Indian companies on this topic in the recent past as a result of cyber security attacks and flood situations, notes Santhosh Rao, senior director analyst at Gartner. “Mature Indian enterprises are re-looking their backup and DR process and architectures and making necessary changes and investments. However, the level of maturity is relatively low overall."
Jain corroborates that people are talking more and that awareness of becoming more resilient for disasters, be it man-made, natural or terrorism, has grown. “The challenge is how much are companies doing and that depends on the company’s risk appetite and that varies from sector to sector and companies to companies and the size of the data. In the services industry, such as banks or IT companies, the risk is high from a data point of view."
Will data localization be an issue? The recently-proposed draft data protection Bill, which is set to replace existing cyber laws, strictly mandates companies to store all governance-related data on servers within India to protect the privacy of Indian citizens.
Jain feels data localisation will not be an issue as India is a vast country, with geographical variations, allowing companies to set up DR sites in different regions where the risk of disaster is lower.
Whenever the primary site fails, companies can access all the applications from the secondary site.
Disaster recovery sites explained
■ Hot DR sites: These sites operate as virtual mirror of a firm’s data centres. They are available 24x7 but have a high cost of ownership.
■ Warm DR sites: These offer all the working of data centres but stay in a semi-functional state until the firm initiates backup.
■ Cold DR sites: These by default don’t offer DR support, but can be used to supplement hot or warm sites after procuring the relevant hardware and software. Recovery can take time.