Guidelines for Setting up Disaster Recovery (DR) and Business Continuity Plans (BCP) Centers for IT / ITES SEZs - SEZ - D.12/25/2012

Guidelines for Setting up Disaster Recovery (DR) and Business Continuity Plans (BCP) Centers for IT / ITES SEZs No. D.12/25/2012-SEZ Government of India Ministry of Commerce Industry Department of Commerce (SEZ Division) Udyog Bhavan, New Delhi 20-22 nd February, 2013 Subject: Guidelines for Setting up Disaster Recovery (DR) and Business Continuity Plans (BCP) Centers for IT / ITES SEZs Disaster recovery (DR) may be seen as the process, policies and procedures related to preparing for recovery or continuation of technology infrastructure critical to a business organization after a natural or human-induced disaster occurs. Disaster recovery may be seen as a subset of business continuity. While business continuity involves planning for keeping all aspects of a business functioning in the midst of disruptive events, disaster recovery focuses on the IT or technology systems that support business functions. DR/BCP are essential for businesses today and more especially for IT/ITES businesses. Businesses with no DR/BCP systems i.e. no saved information, no documentation, no backup hardware, and no contingency plan are unable to put into place any recovery time objectives (RTO) which is the duration of time and a service level within which a business process must be restored after a disaster (or disruption) and also are not in a position to assure "recovery point objective" (RPO), which is the maximum tolerable period in which data might be lost from an IT service due to a major incident, to its clients. Such businesses are unable to attract business as all business clients seek assurances on credible RTOs and RPOs which are written into their business contracts. In the context of IT/ITES SEZs the following issues with regard to DR/BCP are of importance: 1. Defining Disaster : It is important to define a Disaster as it is on the occurrence of such an event that the DR/BCP plans would kick in. The Disaster Management Act defines disaster to mean a catastrophe, mishap, calamity or grave occurrence in any area, arising from natural or manmade causes, or by accident or negligence which results in substantial loss of life or human suffering or damage to, and destruction of, property, or damage to, or degradation of, environment, and is of such a nature or magnitude as to be beyond the coping capacity of the community of the affected area; Disasters can be classified in two broad categories. The first is natural disasters such as floods, hurricanes, tornadoes or earthquakes etc. The second category is manmade disasters. These include hazardous material spills, infrastructure failure, or bio terrorism etc. However in order to term a set of conditions/events occurring in the business area as a `disaster' the effect of such events should clearly be of "such a nature or magnitude as to be beyond the coping capacity" of the business enterprises of the affected area and it must have the effect of causing major hindrance or stoppage of work at the business unit. In addition IT sector can be adversely affected by major power outages, industrial sabotage, data theft, cyber attack etc. These events may also have a major disruptive effect of hindering the business activity of the IT/ITES unit or cause stoppage of work at the unit. 2. Movement of back up data on tapes/ storage devices from SEZs to locations outside the SEZ. Prevention and creating data backup is an integral part of the IT/ITES sectors DR/BCP strategy. The data is regularly backed up at locations which are isolated from the main business centres to prevent its loss in the event of a disaster. This would entail movement of data from SEZ to a DR/BCP location outside the SEZ and movement of storage media back into the SEZ. This movement of data on storage tapes/devices raises the need to address the following issues: a) This movement of tapes and data on the same is purely a means for Data back up and cannot constitute a commercial transaction. No commercial invoices would be raised, however a record of movement of magnetic / storage tapes/devices would be maintained at the SEZ. b) The movement of data as described above will not be treated as Exports from the SEZ and therefore will not be counted towards NFE calculations of the SEZ unit. c) The SEZ unit will have to pay necessary duty etc. on the tapes/storage devices on which the data is being moved. d) The back up location where the tapes / storage devices are moved could be a location under another SEZ or EOU i.e. a bonded secured location. Such location must be duly informed to the DC, SEZ, prior to movement of data and any change of this location must be with the due approval of the DC. 3. Setting up DRC/BCP Centres by SEZ Units: a) The DRC/BCP location will be approved by the DC, SEZ on an application made by the SEZ unit. Such approval will allow the SEZ unit to relocate its operations, data and employees to the DRC/BCP location upon the occurrence of a disaster. If the DR/BCP location is within another SEZ / EOU the DC of such SEZ/EOU may also be consulted prior to issue of approval. b) While making an application to DC office, the list of sites identified for DR/BCP operations by the unit as well as the list of calamities / events which are covered under `disaster' must be stated and thereafter approved by the DC. c) A DR/BCP location will be provided with adequate infrastructure including tele communication links, administrative support systems, data back up and retrieval systems as well as seating/workstations for personnel. d) On the occurrence of events pre-defined under the category of disaster , the unit will not need to seek prior approval of DCs to put into operation the DR/BCP strategy. However within 48 hours of the DR/BCP being put into operation the unit must intimate the DC, SEZ e) On the occurrence of a disaster, it will be necessary for the IT SEZs to carry out real time BCP/DRP operations including shifting of data, operations and employees to be shifted and re located to the DRC/BCP site on a temporary basis, till restoration of operations at the original location. The validity of the relocation will be initially for a period of 90 days and may be extended by DC office and any further extension will be granted based on application to DC office. f) As this activity is envisaged as a purely internal exercise to be carried out across branches of the same SEZ entity to ensure that business continuity therefore there will be no commercial activity involved and accordingly, no commercial invoice will be raised in such movement of data, operations and employees. g) Once the DR/BCP has been approved by the DC, SEZ in which the unit is located as well as the DC where the unit is situated may both ensure a seamless transfer of data, operations and personnel as per the terms of the approval. For this purpose necessary approvals/permissions for carrying out business at the new location, in terms of the DR/BCP approval, may be made available immediately. 4. Setting up DRC/BCP Centres in SEZ by Third Party clients There is a growing demand for setting up DR/BCP sites for third parties overseas clients in India within SEZs. Such centres would be provided by the SEZ units. As in such cases the DR/BCP centre would constitute a space with adequate infrastructure including tele-communication links, administrative support systems, data back up and retrieval systems as well as seating/workstations for personnel, which will be activated/operatinalised in the event of a disaster. In addition to the guidelines put into place for setting up DRC/BCP Centres by SEZ Units as per para 3 above, this business model in SEZs calls for additional considerations which are as follows: a) This will be in the nature of a commercial activity as the SEZ unit offers end to end services to the third parties to keep in readiness and operate from a SEZ location in the event of a disaster so as to ensure that their clients can carry out their operations in a seamless un-interrupted manner. b) The charges received / receivable by the SEZ unit in foreign currency will be considered for NFE purposes. This has the approval of Commerce Secretary. (Sanjeet Singh) Director Tel. 23062109 Fax : 23063418 e-mail: [email protected] To: 1. All Development Commissioners of SEZs 2. Department of Revenue (CBDT/CBEC), Govt. of India 3. DG, EPCES 4. Department of Information Technology, Electronics Niketan, 6 CGO Complex, New Delhi. 5. DG, National Disaster Management Authority, New Delhi.