How Zoho Corp responds to disasters and does business as usual

You can’t predict the next catastrophe, but you can be prepared for it!

Introduction

Glossary of terms

Backstory: The realization

Tsunami in 2004

Before and during the 90s, we saw the city of Chennai as a peace haven and the least vulnerable to natural disasters. However, over the last decade, we've witnessed natural catastrophe in all forms - hurricane, earthquake, tsunami, and the recent global viral pandemic COVID-19.

In 2004, a magnitude 9.1 earthquake struck beneath the Indian Ocean near Indonesia, generating a massive tsunami that claimed around 8000 lives in coastal Chennai. The giant waves flooded the coastal areas causing property and asset damage to many IT and telecom companies in the region. Our Zoho office was unaffected by the Tsunami, however employee absence was a challenge at that time.

Chennai Floods in 2015: Disaster strikes again

In 2015, we saw the worst downpour of rains in Chennai , followed by unprecedented flooding that left thousands of stranded citizens making their way through waist-deep water. The rains battered Chennai for a month and most of our employee homes were affected.

This time around we were prepared. We invoked our BCDR and some our essential customer facing teams were moved to our offices in Austin, USA, and Tenkasi, Tamilnadu the alternate locations for continued operations. It was also ensured that residential quarters is provided to our employees for their safety and business as usual; while some of our employees worked from their homes.

This incident opened our eyes and helped us realize how lack of planning can pose a serious risk to any modern organization like ours. We formed a Business Continuity Management Committee (BCDRC) to build a business continuity plan (BCDR) ) two critical components of our business. Hereon, we believed in being prepared for disasters of any kind by invoking this plan, depending on the impact and nature of the disaster

Why BCDR?

The biggest test for an organization's reputation is its ability to handle a crisis. We find that not all crises are equal. Their intensity and longevity can differ and therefore no one formula to handle a crisis.

The key to emerging unscathed is to prepare. To this end, we have a broad crisis management umbrella to determine an appropriate response for every type of crisis. Our crisis management and business continuity efforts, steered by our BCDRC, integrates the disciplines of corporate crisis management, emergency response management, incident management/IT disaster recovery (technology continuity), business continuity management, (organizational/operational), information security management, and risk management.

BCDR is its own discipline, so we should treat it that way. BCDR and preparedness have to reach down to the grassroots level, and be considered one of the mainstream processes in conjuction with continual improvement.

- Rajesh Ganesan
Vice President
ManageEngine

Crisis management framework

In recent decades, natural disasters are becoming more common — and costly underscoring the need for business continuity planning to continue functions in the event of a disaster. As an enterprise, we fully understand that BCDR is vital to avoid and mitigate risks associated with the disruption of operations.

A disaster can impact organizations differently – a hurricane might tear the roof off one organization, flood the other, and leave a third with no damage. While some disasters such as hurricanes can cause loss of life or significant injuries, others are less dramatic like a major IT incident. At Zoho, we believe preparedness is key to handle every type of disaster effectively and to ensure business continuity. (If you are running a business, then you should too!)

Our BCDR records an enterprise-wide, process-oriented approach, that covers operational abilities of our data centers, IT operations, systems, customer services functions, and communication strategies that are critical to Zoho's resilience during unforeseen circumstances.

The BCDR is built on these guiding principles:

So, should organizations start with BCDR right away?

The answer is a resounding YES. No business is immune to disasters.

The history of continuity planning is riddled with examples of enterprises going out of business after a disaster. More enterprises are now shifting their focus on business continuity understanding the fact that downtime, especially if it lasts for a longer duration, can result in substantial risks and costs to their organization.

A comprehensive BCDR is key to dealing with unforeseen events and resulting downtime, enabling organizations to eliminate points of failure, ensure back up plans, and restore operations quickly. However, while some enterprises struggle to build and execute a plan, others have a myriad of excuses to build one:

"Our people will know what to do during an emergency."

What will your employees do when something happens to your physical location? Yes, we hire the smartest and most intuitive people, but letting employees respond and act on their own will only add to the existing chaos. A well-documented business continuity plan, relevant policies, and training with live simulations can ensure that the workforce is prepared for disasters, and they keep their work i on the radar.

"It won't happen to us."

As much as we appreciate the optimism, it is always best to expect the unexpected. The fact of the matter is that every organization is at risk. The lack of sufficient backups, disaster recovery plans, or continuity efforts can leave any business crippled should the worst happen.

"We have insurance. We've got this covered!"

We've been in business for around 20+ years and have taken some hits along the way. That's how we know that although insurance is part of a business continuity strategy, it cannot cover the peripheral damages from an event like loss of customers, market share, or setbacks in the development of a new product.

"It isn't our priority. We don't have time for it."

It happened to us — We hardly saw continuity as a priority until it became a dire requirement. In the event of a disaster, business continuity has been the key factor in keeping our business afloat. We believe that the ability to serve customers during and immediately after an event can improve credibility with the customers and ensure sustenance.

"BCDR is for large enterprises. We can relax."

Many small-to-medium sized businesses (SMBs) believe they are too small and having a BCDR in place can be an overkill. Unfortunately, the impact on startups and SMBs is way more brutal during disasters as they have less cash reserves for managing sudden slumps. Having a BCDR can prevent small businesses from incurring more losses allowing them to break even until the situation is stabilized.