How Zoho Corp responds to disasters and does business as usual

You can’t predict the next catastrophe, but you can be prepared for it!

Introduction

Glossary of terms

ARMC

Audit and risk management committee

BC

Business continuity

BCC

Business continuity coordinators

BCDR

Business continuity and disaster recovery

BCM

Business continuity management

BCDRC

Business continuity and disaster recovery committee

BIA

Business impact analysis

COVID-19

Commonly known as coronavirus; a global pandemic which is a severe acute respiratory syndrome

DR

Disaster recovery

Disaster recovery team

Disaster recovery team

Emergency management team

Emergency management team

Building management system

Building management system

Backstory: The realization

Tsunami in 2004

Before and during the 90s, we saw the city of Chennai as a peace haven and the least vulnerable to natural disasters. However, over the last decade, we've witnessed natural catastrophe in all forms - hurricane, earthquake, tsunami, and the recent global viral pandemic COVID-19.

In 2004, a magnitude 9.1 earthquake struck beneath the Indian Ocean near Indonesia, generating a massive tsunami that claimed around 8000 lives in coastal Chennai. The giant waves flooded the coastal areas causing property and asset damage to many IT and telecom companies in the region. Our Zoho office was unaffected by the Tsunami, however employee absence was a challenge at that time.

Chennai Floods in 2015: Disaster strikes again

In 2015, we saw the worst downpour of rains in Chennai , followed by unprecedented flooding that left thousands of stranded citizens making their way through waist-deep water. The rains battered Chennai for a month and most of our employee homes were affected.

This time around we were prepared. We invoked our BCDR and some our essential customer facing teams were moved to our offices in Austin, USA, and Tenkasi, Tamilnadu the alternate locations for continued operations. It was also ensured that residential quarters is provided to our employees for their safety and business as usual; while some of our employees worked from their homes.

This incident opened our eyes and helped us realize how lack of planning can pose a serious risk to any modern organization like ours. We formed a Business Continuity Management Committee (BCDRC) to build a business continuity plan (BCDR) ) two critical components of our business. Hereon, we believed in being prepared for disasters of any kind by invoking this plan, depending on the impact and nature of the disaster

15 years after the tsunami..

How has zohocorp evolved as an enterprise in business continuity, resilience, & response?

Our BCDR Journey

Why BCDR?

The biggest test for an organization's reputation is its ability to handle a crisis. We find that not all crises are equal. Their intensity and longevity can differ and therefore no one formula to handle a crisis.

The key to emerging unscathed is to prepare. To this end, we have a broad crisis management umbrella to determine an appropriate response for every type of crisis. Our crisis management and business continuity efforts, steered by our BCDRC, integrates the disciplines of corporate crisis management, emergency response management, incident management/IT disaster recovery (technology continuity), business continuity management, (organizational/operational), information security management, and risk management.

Rajesh Ganesan

BCDR is its own discipline, so we should treat it that way. BCDR and preparedness have to reach down to the grassroots level, and be considered one of the mainstream processes in conjuction with continual improvement.

- Rajesh Ganesan
Vice President
ManageEngine

Crisis management framework

Crisis management framework

In recent decades, natural disasters are becoming more common — and costly underscoring the need for business continuity planning to continue functions in the event of a disaster. As an enterprise, we fully understand that BCDR is vital to avoid and mitigate risks associated with the disruption of operations.

A disaster can impact organizations differently – a hurricane might tear the roof off one organization, flood the other, and leave a third with no damage. While some disasters such as hurricanes can cause loss of life or significant injuries, others are less dramatic like a major IT incident. At Zoho, we believe preparedness is key to handle every type of disaster effectively and to ensure business continuity. (If you are running a business, then you should too!)

Our BCDR records an enterprise-wide, process-oriented approach, that covers operational abilities of our data centers, IT operations, systems, customer services functions, and communication strategies that are critical to Zoho's resilience during unforeseen circumstances.

The BCDR is built on these guiding principles:

Principles

Rationale

Integrate into mainstream business processes

  • Ensure BCDR and risk management are an integral part of mainstream processes

Gather the best and reliable information

Gather information from various data sources:

  • Internal: Stakeholders and board of directors to make evidence based decisions.
  • External: Governing bodies and law enforcement

Take a people-first approach

  • To ensure the safety of our workforce

Ensure swift and speedy recovery

  • Operate efficiently during emergencies and ensure that our products and services are not disrupted for our customer.
  • Take immediate and effective response to maintain credibility in the eyes of our customers, partners, and stakeholders.

Prepare effectively to handle all types of disasters

  • To ensure our BCDR addresses the business disruption due to different kinds of disasters. (Refer the section below to understand the disaster categories)

Continuously improve

  • Record the learnings from disruptive events to identify gaps in the BCDR so we can better prepare to respond to future events

So, should organizations start with BCDR right away?

The answer is a resounding YES. No business is immune to disasters.

The history of continuity planning is riddled with examples of enterprises going out of business after a disaster. More enterprises are now shifting their focus on business continuity understanding the fact that downtime, especially if it lasts for a longer duration, can result in substantial risks and costs to their organization.

Measurable

Intangible

Deferred or lost revenue

Damage to credibility and reputation

Rise in customer churn; customer dissatisfaction

Loss of goodwill with partners and customers

Less employee productivity

Loss of employee morale and loss of trust in the organization

Penalties due to non-compliance of service-level agreements (SLAs)

Loss of competitive advantages

A comprehensive BCDR is key to dealing with unforeseen events and resulting downtime, enabling organizations to eliminate points of failure, ensure back up plans, and restore operations quickly. However, while some enterprises struggle to build and execute a plan, others have a myriad of excuses to build one:

"Our people will know what to do during an emergency."

What will your employees do when something happens to your physical location? Yes, we hire the smartest and most intuitive people, but letting employees respond and act on their own will only add to the existing chaos. A well-documented business continuity plan, relevant policies, and training with live simulations can ensure that the workforce is prepared for disasters, and they keep their work i on the radar.

"It won't happen to us."

As much as we appreciate the optimism, it is always best to expect the unexpected. The fact of the matter is that every organization is at risk. The lack of sufficient backups, disaster recovery plans, or continuity efforts can leave any business crippled should the worst happen.

"We have insurance. We've got this covered!"

We've been in business for around 20+ years and have taken some hits along the way. That's how we know that although insurance is part of a business continuity strategy, it cannot cover the peripheral damages from an event like loss of customers, market share, or setbacks in the development of a new product.

"It isn't our priority. We don't have time for it."

It happened to us — We hardly saw continuity as a priority until it became a dire requirement. In the event of a disaster, business continuity has been the key factor in keeping our business afloat. We believe that the ability to serve customers during and immediately after an event can improve credibility with the customers and ensure sustenance.

"BCDR is for large enterprises. We can relax."

Many small-to-medium sized businesses (SMBs) believe they are too small and having a BCDR in place can be an overkill. Unfortunately, the impact on startups and SMBs is way more brutal during disasters as they have less cash reserves for managing sudden slumps. Having a BCDR can prevent small businesses from incurring more losses allowing them to break even until the situation is stabilized.

Why our framework?

We are a software (SaaS) provider with over 20 years of experience in software development with 12 offices around the world and 10 data centers. Our US headquarters is currently in Pleasanton, California. The research and development campus and global headquarters is at Estancia IT Park, Chennai, India with world-class infrastructure hosting nearly 10000+ workforce working on develop game-changing software products. Around 45+ million customers worldwide rely on our applications for their business and IT needs.

The upcoming framework features Zoho's business continuity and disaster recovery model that includes resources, actions, processes, checklists, best practices, and information that is created, tested, and held in readiness to be more resilient and to avoid disruption of operations in the face of an event.

This model has helped Zoho to minimize the impact, maintain essential functions, and to return to normal operations as quickly as possible in any scenario regardless of the cause and duration. It records our learnings over the last decade and can serve as a blueprint to simplify, and de-mystify the business continuity process for all IT organizations that are new to its disciplines, and can also help enterprises get started with their own BCDR efforts based on their business model.

It combines the expertize of Zoho's Business Continuity Disaster Recovery Committee (BCDRC) which includes the board of directors and senior management making it an essential read for business continuity teams, risk managers, auditors, and other IT leaders.

If this piques your interest, then move on to our BCDR framework below.

Get fresh content in your inbox

By clicking 'keep me in the loop', you agree to processing of personal data according to the Privacy Policy.