Chennai, one of India's largest metropolises, has been struck for the past week or more by unprecedented urban flooding, leading to massive disruption to life and business. Over 250 lives have been lost, and the city's economy have been brought to a standstill. In the midst of this tragedy is the need to resume critical business operations serving national, even global geographies, and organizations are trying to cope with the situation the best they can by bringing their business continuity processes and disaster recovery regimes to bear.
Vishal Salvi, Partner Advisory at PricewaterhouseCoopers, was formerly the CISO at HDFC bank and a specialist in BCP &DR. He spent seven years of his career in Chennai and was there during a similar disaster in the past. In this exclusive interview with ISMG, Salvi shares advice and insight for practitioners coping with the present situation.
Speaking of how he would deal with the situation, he says the first thing is to take stock of the human angle - ensure the safety and well-being of all personnel. The second is to gather the designated business continuity committee - the people who will review the situation and take key decisions, in terms of critical processes that need to be resumed, and others that can wait, he advises.
"You can never have a fully functional alternate site," he says, "so you will need to prioritize what to resume. The other important thing is to take a stock of what are the things you need to shut down at your primary as well as the backup site, for you to be able to resume critical services."
How to Respond
During his last brush with a similar disaster of a smaller magnitude in Chennai, Salvi was the owner for a BCP and DR service centre for HDFC Bank, which had a 24x7 centre supporting global operations. Salvi is in touch with former colleagues and says he is aware that the organization's global centres there have stopped working now completely, because even the backup generator sets have run out of fuel. But because the organization had a focus on BCP and DR from the beginning, it was able to recover some of these processes to sites outside India, to continue to operate these global processes.
"Those organizations that have invested in BCP and DR proactively are in a much better position in this scenario, because there is only so much that one can do once disaster strikes," he says. But a lot of the ground can be covered in advance, in terms of planning. This will ensure you are able to address these issues in a rational frame of mind, he says. However, Salvi says many organizations have not heeded the lessons of the past and may not have invested in BCP/DR deeming the cost too high, as against the likelihood of such a disaster repeating itself.
It's not just about technology, but also about training people and having people there, who can manage these tasks in such situations. Salvi says it's not how you react, but how you respond to these situations, which is important.
"Be calm, composed and look at the situation as it is and deal with it in a professional way," he says. Additionally, there is no room for heroism here, he advises. Safety should be the primary concern - do not try to perform tasks that might pose a risk to lives. "I have seen a situation where a person lost his life trying to retrieve equipment, because the building caved in on top of him," he says.
Thirdly, if one has a BCP/DR plan and a process in place, do not try to reinvent and make changes to them. "There is a tendency to try to do things on your own; then the plan is of no use," he says. Lastly, engage your management in making all the decisions and become very proactive in raising those decisions and risks to them on an ongoing basis. "In these situations, taking decisions is the toughest, but at the same time the most important aspect, so ensure that there is a process for this," he asserts.
In this interview, Salvi shares his unique expertise in BCP and DR, and shares insight and recommendations that may help current practitioners efficiently and effectively execute their present mandates. He speaks about:
- How he would approach the situation if he were managing BCP/DR;
- Key challenges he sees in the present situation;
- Recommendations to help practitioners empower business transition back to normalcy.
Salvi is an information security thought leader and partner cybersecurity advisory at PricewaterhouseCoopers India. He joined PWC in November 2014 as partner for its cybersecurity practice in India after spending 15 years as a practitioner, primarily in banking. He served as CISO and senior vice president at HDFC Bank, heading its information security group for eight years. Before HDFC, he served at Standard Chartered Bank for 11 years.