Study Guide-APPENDIX J - Business Continuity Plan

APPENDIX J - Business Continuity Plan

Pdf Summary

Oakleaf Group’s Business Continuity Plan (BCP) defines how the company will maintain or quickly restore operations after a “significant business disruptive event” affecting facilities, systems, or services. It applies across the Business Continuity Management System (BCMS) scope and focuses on protecting employees and property, assessing financial/operational impacts, and safeguarding data and records to resume operations as fast as feasible.<br /><br />The plan is based on Business Impact Analysis and risk assessment/treatment. Unacceptable risks require preventive actions (to reduce likelihood and impact), scenario planning, and documented responses in the Incident Response Plan.<br /><br />Key recovery targets are defined via Maximum Acceptable Outage (MAO) and Recovery Time Objectives (RTO). Examples include: Email MAO 4 hours (Office 365 dependent), Remote Desktop Services MAO 24 hours/RTO 4 hours, Internet MAO 24 hours/RTO 8 hours, file access MAO 24 hours/RTO 8 hours, and Salesforce MAO 48 hours. Critical systems (e.g., remote desktop servers, domain controllers, file servers, ADFS, firewalls) generally have MAO 24 hours with 4-hour RTOs, supported through redundancy, virtualization, and image/file backups.<br /><br />Backup strategy includes CommVault daily backups for file servers with monthly/annual retention and offsite storage in Google Nearline; Office 365 SharePoint uses real-time cloud retention; local machines are backed up hourly via Backblaze.<br /><br />An Emergency Response Team led by the COO (or IT Lead as alternate) is empowered to make recovery decisions, coordinate reporting (IT incidents via Dataprise GSD; others to COO), manage public communications (CEO), and liaise with authorities. Evacuation assembly points and prioritized communication methods (mobile, phone, email, messaging) are defined.<br /><br />Oakleaf maintains mirrored recovery locations between Chevy Chase and Bethesda, with staged network equipment. The BCP is tested annually via walkthrough exercises, with results reviewed by the COO and documented in a report with corrective actions.

Keywords

Business Continuity Plan (BCP)

Business Continuity Management System (BCMS)

significant business disruptive event

Business Impact Analysis (BIA)

risk assessment and treatment

Maximum Acceptable Outage (MAO)

Recovery Time Objective (RTO)

Incident Response Plan

backup and disaster recovery (CommVault, Backblaze, Google Nearline)

Emergency Response Team and recovery locations (Chevy Chase, Bethesda)