How Zoho Corp responds to disasters and does business as usual
You can’t predict the next catastrophe, but you can be prepared for it!
Introduction
Glossary of terms
ARMC |
Audit and risk management committee |
BC |
Business continuity |
BCC |
Business continuity coordinators |
BCDR |
Business continuity and disaster recovery |
BCM |
Business continuity management |
BCDRC |
Business continuity and disaster recovery committee |
BIA |
Business impact analysis |
COVID-19 |
Commonly known as coronavirus; a global pandemic which is a severe acute respiratory syndrome |
DR |
Disaster recovery |
Disaster recovery team |
Disaster recovery team |
Emergency management team |
Emergency management team |
Building management system |
Building management system |
Backstory: The realization
Tsunami in 2004
Before and during the 90s, we saw the city of Chennai as a peace haven and the least vulnerable to natural disasters. However, over the last decade, we've witnessed natural catastrophe in all forms - hurricane, earthquake, tsunami, and the recent global viral pandemic COVID-19.
In 2004, a magnitude 9.1 earthquake struck beneath the Indian Ocean near Indonesia, generating a massive tsunami that claimed around 8000 lives in coastal Chennai. The giant waves flooded the coastal areas causing property and asset damage to many IT and telecom companies in the region. Our Zoho office was unaffected by the Tsunami, however employee absence was a challenge at that time.
Chennai Floods in 2015: Disaster strikes again
In 2015, we saw the worst downpour of rains in Chennai , followed by unprecedented flooding that left thousands of stranded citizens making their way through waist-deep water. The rains battered Chennai for a month and most of our employee homes were affected.
This time around we were prepared. We invoked our BCDR and some our essential customer facing teams were moved to our offices in Austin, USA, and Tenkasi, Tamilnadu the alternate locations for continued operations. It was also ensured that residential quarters is provided to our employees for their safety and business as usual; while some of our employees worked from their homes.
This incident opened our eyes and helped us realize how lack of planning can pose a serious risk to any modern organization like ours. We formed a Business Continuity Management Committee (BCDRC) to build a business continuity plan (BCDR) ) two critical components of our business. Hereon, we believed in being prepared for disasters of any kind by invoking this plan, depending on the impact and nature of the disaster
15 years after the tsunami..
How has zohocorp evolved as an enterprise in business continuity, resilience, & response?
Our BCDR Journey
Why BCDR?
The biggest test for an organization's reputation is its ability to handle a crisis. We find that not all crises are equal. Their intensity and longevity can differ and therefore no one formula to handle a crisis.
The key to emerging unscathed is to prepare. To this end, we have a broad crisis management umbrella to determine an appropriate response for every type of crisis. Our crisis management and business continuity efforts, steered by our BCDRC, integrates the disciplines of corporate crisis management, emergency response management, incident management/IT disaster recovery (technology continuity), business continuity management, (organizational/operational), information security management, and risk management.
BCDR is its own discipline, so we should treat it that way. BCDR and preparedness have to reach down to the grassroots level, and be considered one of the mainstream processes in conjuction with continual improvement.
Crisis management framework
In recent decades, natural disasters are becoming more common — and costly underscoring the need for business continuity planning to continue functions in the event of a disaster. As an enterprise, we fully understand that BCDR is vital to avoid and mitigate risks associated with the disruption of operations.
A disaster can impact organizations differently – a hurricane might tear the roof off one organization, flood the other, and leave a third with no damage. While some disasters such as hurricanes can cause loss of life or significant injuries, others are less dramatic like a major IT incident. At Zoho, we believe preparedness is key to handle every type of disaster effectively and to ensure business continuity. (If you are running a business, then you should too!)
Our BCDR records an enterprise-wide, process-oriented approach, that covers operational abilities of our data centers, IT operations, systems, customer services functions, and communication strategies that are critical to Zoho's resilience during unforeseen circumstances.
The BCDR is built on these guiding principles:
Principles |
Rationale |
Integrate into mainstream business processes |
|
Gather the best and reliable information |
Gather information from various data sources:
|
Take a people-first approach |
|
Ensure swift and speedy recovery |
|
Prepare effectively to handle all types of disasters |
|
Continuously improve |
|
So, should organizations start with BCDR right away?
The answer is a resounding YES. No business is immune to disasters.
The history of continuity planning is riddled with examples of enterprises going out of business after a disaster. More enterprises are now shifting their focus on business continuity understanding the fact that downtime, especially if it lasts for a longer duration, can result in substantial risks and costs to their organization.
Measurable |
Intangible |
Deferred or lost revenue |
Damage to credibility and reputation |
Rise in customer churn; customer dissatisfaction |
Loss of goodwill with partners and customers |
Less employee productivity |
Loss of employee morale and loss of trust in the organization |
Penalties due to non-compliance of service-level agreements (SLAs) |
Loss of competitive advantages |
A comprehensive BCDR is key to dealing with unforeseen events and resulting downtime, enabling organizations to eliminate points of failure, ensure back up plans, and restore operations quickly. However, while some enterprises struggle to build and execute a plan, others have a myriad of excuses to build one:
"Our people will know what to do during an emergency."
What will your employees do when something happens to your physical location? Yes, we hire the smartest and most intuitive people, but letting employees respond and act on their own will only add to the existing chaos. A well-documented business continuity plan, relevant policies, and training with live simulations can ensure that the workforce is prepared for disasters, and they keep their work i on the radar.
"It won't happen to us."
As much as we appreciate the optimism, it is always best to expect the unexpected. The fact of the matter is that every organization is at risk. The lack of sufficient backups, disaster recovery plans, or continuity efforts can leave any business crippled should the worst happen.
"We have insurance. We've got this covered!"
We've been in business for around 20+ years and have taken some hits along the way. That's how we know that although insurance is part of a business continuity strategy, it cannot cover the peripheral damages from an event like loss of customers, market share, or setbacks in the development of a new product.
"It isn't our priority. We don't have time for it."
It happened to us — We hardly saw continuity as a priority until it became a dire requirement. In the event of a disaster, business continuity has been the key factor in keeping our business afloat. We believe that the ability to serve customers during and immediately after an event can improve credibility with the customers and ensure sustenance.
"BCDR is for large enterprises. We can relax."
Many small-to-medium sized businesses (SMBs) believe they are too small and having a BCDR in place can be an overkill. Unfortunately, the impact on startups and SMBs is way more brutal during disasters as they have less cash reserves for managing sudden slumps. Having a BCDR can prevent small businesses from incurring more losses allowing them to break even until the situation is stabilized.
Why our framework?
We are a software (SaaS) provider with over 20 years of experience in software development with 12 offices around the world and 10 data centers. Our US headquarters is currently in Pleasanton, California. The research and development campus and global headquarters is at Estancia IT Park, Chennai, India with world-class infrastructure hosting nearly 10000+ workforce working on develop game-changing software products. Around 45+ million customers worldwide rely on our applications for their business and IT needs.
The upcoming framework features Zoho's business continuity and disaster recovery model that includes resources, actions, processes, checklists, best practices, and information that is created, tested, and held in readiness to be more resilient and to avoid disruption of operations in the face of an event.
This model has helped Zoho to minimize the impact, maintain essential functions, and to return to normal operations as quickly as possible in any scenario regardless of the cause and duration. It records our learnings over the last decade and can serve as a blueprint to simplify, and de-mystify the business continuity process for all IT organizations that are new to its disciplines, and can also help enterprises get started with their own BCDR efforts based on their business model.
It combines the expertize of Zoho's Business Continuity Disaster Recovery Committee (BCDRC) which includes the board of directors and senior management making it an essential read for business continuity teams, risk managers, auditors, and other IT leaders.
If this piques your interest, then move on to our BCDR framework below.