Business Continuity is the Key

SBI Life Insurance (State Bank of India Life) came into being in 2001. It is a joint venture between SBI and Cardiff Insurance, an insurance arm of BNP Paribas which has been in the insurance business for quite some time. Cardiff has come in with its state-of-the-art technology. Since 2005, SBI Life had information technology (IT) policy and the information security (IS) policy and that gave proper guidelines and direction on how to go about the venture. Initially, IT was more a transactional kind of a thing, but since then it has moved forward encompassing all areas concerning the customer, the regulatory compliances as well as record keeping and business analytics. In its first year, SBI Life did a business of about 140 million. After 12 years now, it has crossed the 100-billion mark. Today, SBI Life holds nearly 4 million policies.

The disaster recovery site of SBI Life is at Hyderabad. This followed a huge deluge in Mumbai which destroyed many of SBI Life records. It was then realised that if SBI Life is to be an organisation which is reliable and can deliver even in the face of a disaster, there has to be a disaster recovery site which is robust as well as has a business continuity plan. It was decided to establish a disaster recovery site in a city which was not in the same seismic zone as Mumbai. Thus, Hyderabad was chosen for the purpose.

Moreover, SBI Life introduced SBI Live data plan as well as process plan, instead of going for synchronisation which is expensive and also results in duplication of data on a real-time basis. The process holders now look at critical areas and non-critical areas and this is done as per ISO 29555. The business continuity plan has various aspects. Disaster recovery management is one of them. These two get linked when a business impact analysis of various lines of business is done. Then one understands that may be there are certain lines of business where if something goes seriously wrong, one can wait for say, three days. But, there may be certain types of business where one can’t even wait for three hours. This is what business continuity plan enables one to analyse and understand. So, it is not the case of ‘once size fits all’.

The disaster recovery set up, that supports recovery with regard to certain lines of business, is monitored through period drills – at least once in six months. Certain drills are also mandated by the Insurance Regulatory and Development Authority (IRDA), which happen biannually and for all lines of business.

With regard to IT, the challenge is to keep with the times and have an absolutely top-class IT system, which the SBI Life is trying to have. For this, in Belapur, a suburb of Mumbai, SBI Life is replicating an IT centre.

The disaster recovery system at Hyderabad started with the disaster impact analysis wherein the stakeholders look at all the functionalities of the organisation and drill it down to various process areas. There are hundreds of processes that have been listed and if a particular process is not available, it could cause a financial impact. The idea is to quantify the process financially before prioritising things and also to set up various Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO) to assess the financial impact.

IT also has an important role to play in getting budgetary approvals for building up business cases. One of the areas where IT helps is in increasing the capacity of the existing systems to meet business volumes. It also helps in taking care of the capabilities of Disaster Recovery (DR) site. SBI want to increase DR capacity so as to match the capacity of the primary centre. However, this is not practically possible because of the huge cost involved. There is also a great pressure on reducing the RTOs. For that, one needs to constantly monitor and assess what are RPO and RTO volumes on each drill. At the end of each delivery, the company assesses the parameters – whether there is a need to increase the capacity of the servers, or whether to increase the bandwidth on the link. Initially, SBI Life spent two hours on RTO and RPO policy management system. Over time, without making much investment in the hardware and links and by fine-tuning the processes using the various results coming from the DRM solutions, it has been brought down to 30 minutes. This is how constant evaluation of the results of DR have to be ploughed back into the DR process per se.

 The RPO is looked after by the IT team, but the business verticals tell them about the recovery time – whether one is satisfied in two hours or in two minutes. The business impact analysis tells for which particular business what kind of recovery point is suitable. The RPO also tells what the frequency of the back-up will be. The recovery time too is arrived at after analysis.

In SBI Life’s initial days, the data back-up was taken after each day. But now it is almost in real time. Basically, the more robust is the business impact analysis and the business continuity plan, the more clear will be the recovery point and time objectives.

Technology Used

SBI Life works on the Linux platform. It uses Oracle database and Intel hardware, supplied by various players like IBM, HP and Dell. HP storage is used as the primary data storage and Oracles tools are used to replicate the database. For disaster recovery – implying, recovery of a data, recovery of application and recovery or alternate arrangement of communication network – Sanovi Technologies is its main partner. The Sanovi solution enables replication of data and application at the same time, which means that on a real-time basis not only the data is being captured, but applications required to run the data are also being captured simultaneously.

This is a big advantage as otherwise while data will be there safe somewhere, but one will have to set up and install the applications separately to enable disaster recovery site to be up and running. With this solution, if something goes wrong, it can automatically start without waiting for installation of the applications.

This cyber technology also enables a robust monitoring arrangement. The DR site needs to be monitored from the recovery point objective and recovery time objective during a drill. This technology makes it easy to do so.

SBI Life has today automated its DR processes, recovery back to the primary site and the assumption part. The DR tool helps automation of recovery, activation of recovery DR site, monitoring the performance of RTO and RPO and also coming back to the original state. Further, it gives various reports and parameters for fine-tuning the RPO and RTO. It also provides places where one can store things like internal checklists, which are handy for any DR operationalisation.

Way Forward

The new products require immense IT intervention. Without proper IT support, these products cannot be launched as they are quite complicated. SBI Life constantly has to ensure that its business continuity plans are being upgraded as per the changed dynamics of the industry. This means that RPO and RTO have to be analysed alongwith – whether the change can be managed with the same RPO and RTO, or there is a need to intervene. A lot of changes are happening in the industry today and the journey promises to be exciting.

SBI Life expects a lot of business growth to happen, particularly in the next 4-5 years. Its parent bank, SBI, has a lot of potential and since the last one or two years the SBI online banking channel is also picking up. Keeping this in view, SBI Life has started scaling up its data centre by building more headroom. A 300 square feet centre is being built with all the TA 4 level requirements. This means it will be passed from two different enclosures and hall building attendances, so that there is no single point of failure at that data centre.

Efforts are on to ensure that DR site is also equally capable. Analytics may play a big role, so number crunching, data crunching and data mining could become more important. This would give more inputs to the marketing team to process and upscale. In this regard, mobile technologies will also play a very important role in changing the customer interaction.

SBI Life is also gearing up to do pilot projects and evaluate new technologies.