In its role as the premier and sole credit information bureau in the country, the Credit Information Bureau India Limited (CIBIL) handles large volumes of financial data and transactions on a daily basis. The company has over 150 million records, each capturing an individual’s detailed credit information. Given the nature of its business, the security and all-time availability of such data is critical for CIBIL, the prime reason that bureau opted for disaster recovery planning exercise in 2009.
Since the company runs its operations out a single primary data centre located in Mumbai, business continuity was at the time ensured by having redundancies at various levels of this primary infrastructure. This was not a long term disaster recovery (DR) option. In mid-2009, CIBIL estimated a recovery time objective (RTO) of four hours as the goal to aim for during disaster recovery planning exercise. As a result, CIBIL considered co-located DR infrastructure as one of the many possible options during its disaster recovery planning stage.
The main reason behind co-location of DR infrastructure with a service provider was information criticality and the fact that IT was not CIBIL’s core competency. It was critical to find a player who had the domain expertise, technological maturity, and could ensure data confidentiality. During the disaster recovery planning stage, the company evaluated several service providers. The search narrowed down to Dun and Bradstreet (D&B).
“Traditional hosted data centre service providers such as Wipro cater to a variety of industry verticals—ranging from banks to e-commerce players like eBay—under a single roof. We needed a service provider who caters to clients specifically in the financial domain, and has expertise in the area we operate in. D&B perfectly fit the bill,” says Sudesh Puthran, CIO at CIBIL.
Due to its disaster recovery planning requirements, CIBIL has hosted DR infrastructure at Dun & Bradstreet’s (D&B) Chennai data centre. The DR infrastructure mirrors the setup at CIBIL’s primary data centre, with HP blade servers (running flavours of Windows, Linux and Unix), along with HP EVA SAN storage in a cluster configuration. The company uses data replication solutions from Oracle and Informix for replication to its DR site.
As part of its disaster recovery plan, CIBIL achieves redundancy at the network level through fiber connectivity, with hi-speed leased lines from Reliance, Tata and VSNL. The DR infrastructure hosts CIBIL’s credit bureau application which is the primary critical application processing an individual’s credit information. Currently, the company’s disaster recovery plan is to replicate only this application and its associated data to the collocated DR infrastructure, and supplement DR with backup on encrypted tapes (stored at offline sites).
CIBIL conducts live DR drills in conjunction with D&B every quarter. Although the RTO has been fixed at four hours as part of CIBIL’s disaster recovery plan, Puthran says that the company can recover within 30 minutes during these drills. As a result, CIBIL’s customers are able to transact live within this timeframe. Close to 150 million records of credit information amounting to 2 TB of data would be fully synchronized within this period. Puthran informs that the data loss is minimal, since the company does not transact during a disaster. As part of its disaster preparedness strategy, CIBIL plans to have a comprehensive business continuity plan in place by mid-2011.