NATIONAL STOCK EXCHANGE OF INDIA LIMITED

MEMBERSHIP DEPARTMENT

CIRCULAR NO. 661

 

Download No: NSE/MEM/11832                                                                                                                                       Date:- 31-Dec-2008

 

Dear Members,

 

Sub: Business Continuity Planning(BCP)/Disaster Recovery (DR)

 

As you may be aware, Securities Market is heavily dependent on IT and IT infrastructure. Break down of IT and IT infrastructure could occur from major disasters such as Earthquakes, floods, fires, riots or war etc., which could lead to interruptions to business functions. In the past, there have been a couple of occurrences of such disasters in India due to which it is very essential that the Trading Members should establish a well defined Business Continuity/DR plan.

 

In the International markets, in order to ensure business continuity, generally, market participants have created and maintained  a business continuity plan which broadly include identifying procedures relating to an emergency or significant business disruption that are designed to enable the member to meet its existing obligations to customers. Normally, at a broad level, the BCP/DR plan addresses areas like Data back-up and recovery (hard copy and electronic); mission critical systems,  Financial and operational assessments,  alternate communications between the member,  its customers and employees, alternate back-up site from where business operations could resume and function, customer protective measures assuring prompt access to their funds and securities in the event that the member determines that it is unable to continue its business etc.,

 

Given the current technology intensive environment in which Indian Securities market operates, in order to ensure stability in operations of Members so that interest of investors and market at large is not adversely impacted, members are advised to sufficiently review all potential risks along with its impact on the business and put in place BCP/DR plan.

 

Members who already have established BCP/DR plan may please submit the details of their plan to Exchange in the format enclosed at Annexure I. Members who intend to establish BCP/DR needing any guidance on establishing such BCP/DR plan may please get in touch with Mr. Hemant Patade/ Mr. Mahesh Soparkar on 26598136 (direct) or through Boardline 022- 26598100 (Extn: 2083/2067)

 

Further, Exchange proposes to hold road shows on BCP/DR in the ensuing months. The schedule of such road shows would be communicated in due course. For any further queries on the above, you may please contact Mr. Jayesh Taori / Ms. Jinal Shah / Ms. Navneet Saluja /Ms. Shweta Gupta on 26598245 (direct) or through Board line 022-26598100 (Extn:   4111/  4103 / 4120/4119).

 

 

For and on behalf of

National Stock Exchange of India Ltd.

 

 

Rehana D Souza

Manager

            Sd/-

 

 

Annexure I

 

RECOVERY CAPABILITY FOR VARIOUS DISASTER SCENARIOS

 

Guide on understanding of different scenarios

                                        

Level 1:.Minor Outage Scenario

 

In the event of a minor outage, business processes may experience minor damage / outage and will run at a sub-standard level. Scenarios include link connectivity being temporarily down, switch or router port failures, System or network CPU failures, System Fan failures, System or Network Power supply failures, Ethernet card failures.

 

Level 2: Moderate Outage Scenario

 

In this scenario, some or all business processes at the location may experience moderate damage / outage. Processes may not continue or may run at a degraded level. An alternate site may not be required for continuing business but alternate equipment may be required depending on the criticality of the business process and infrastructure.

 

Some of the examples of such scenarios can be:-

1.   Equipment is damaged due to Power surge.

2.   ISDN/VSAT/Circuit router failure

3.   Core access layer switch failure

4.   Access/Distribution switch failure.

5.   LAN switch or router failure.

6.   Temporary outage of power.

 

Level 3: Disaster Scenario

 

In this scenario, the Member infrastructure may experience a severe disaster resulting in the total shut down of infrastructure of the Member. Full processing capability of all business processes like Trading, Risk Management, settlement systems etc. from that location and related infrastructure may be down. Key personnel may not be able to access the premises. There may also be non-availability of key resources in the building.

 

Some of the examples of such scenarios can be

1. Flood / Rain/Fire   making office premises like building and Datacenters inaccessible.

2. Riots /war etc., at a location near one of the offices or within the premises of the member may render the office premises inaccessible.

3. Complete power shutdown due to unavailability of generators.

 

    Under this scenario, Members may have to switch their business over to the BCP site. Key factors which will determine the Recovery Time Objective would be key personnel availability, resilient IT infrastructure and   robust BCP processes.

 

Level 4:  Catastrophe

 

In this scenario, a major disaster strikes which would result in a major disruption of services. Full processing capability cannot be achieved for a substantial period of time. Recovery will require use of alternate processing site as well as offsite offices for employees over an extended period of time

Some of the examples of such scenarios can be

 

1.   War

2.   Earthquake

3.   Extended Communal Riots etc

 

In such a scenario, capability to achieve their Recovery time objectives would critically depend upon Key personnel availability, resilient IT infrastructure and robust BCP processes.

 

 

 

Information on BCP Plan to be submitted by Member to Exchange

                                                                              

Please provide a Brief Description on how your BCP/DR plan addresses different scenarios (Minor, Moderate, Disaster & Catastrophe) which are described above.

 

In addition, please complete the following table by checking the appropriate box in columns A1, A2, A3, B1, B2 & C.

 

 

Degree of Disruption	AVAILABILITY			IMPACT		Recovery Capability Immediate Within Hours Within Days - C -
	Processes - A1 -	Personnel - A2 -	Technology Assets - A3 -	Financial - B1 -	Operational - B2 -
Level 1 (Minor Outage) Business Processes at enterprise level or at a particular location experience minor damage / outage and will run at a sub-standard level.	□ Low □ Medium □ Adequate	□ Low □ Medium □ Adequate	□ Low □ Medium □ Adequate	□ Low □ Medium □ Adequate	□ Low □ Medium □ Adequate	□ Immediate □ Hours □ Days
Level 2 (Moderate Outage) Business processes at enterprise level or at a particular location may not continue or may run on a sub-standard basis. Alternate equipment or routing of communication links may be required.	□ Low □ Medium □ Adequate	□ Low □ Medium □ Adequate	□ Low □ Medium □ Adequate	□ Low □ Medium □ Adequate	□ Low □ Medium □ Adequate	□ Immediate □ Hours □ Days
Level 3 (Disaster) Disaster resulting in the total shut down of infrastructure at central location leading to shut down of all business processes, related infrastructure and non-accessibility of people .	□ Low □ Medium □ Adequate	□ Low □ Medium □ Adequate	□ Low □ Medium □ Adequate	□ Critical □ Controllable	□ Critical □ Controllable	□ Immediate □ Hours □ Days
Level 4 (Catastrophe) Major disaster resulting in a complete city wide disruption of services and damage to the business center. Recovery will require the use of an alternate processing site as well as offsite offices for employees over an extended period of time.	□ Low □ Medium □ Adequate	□ Low □ Medium □ Adequate	□ Low □ Medium □ Adequate	□ Critical □ Controllable	□ Critical □ Controllable	□ Immediate □ Hours □ Days