Instructor Resources-APPENDIX J - Business Continuity Plan

APPENDIX J - Business Continuity Plan

Pdf Summary

Oakleaf Group’s Business Continuity Plan (BCP) defines how the company will maintain or rapidly resume operations after a “significant business disruptive event” affecting facilities, systems, or services. It applies to the full Business Continuity Management System (BCMS) scope and focuses on protecting employees and property, assessing operational/financial impact, and safeguarding data and records to restore service as quickly as possible.<br /><br />The plan is based on Business Impact Analysis and risk assessment/treatment. Unacceptable risks require preventive controls, documented incident scenarios, and defined responses in the Incident Response Plan. Maximum Acceptable Outage (MAO) and Recovery Time Objectives (RTO) are set for key services: Email (MAO 4 hrs), Remote Desktop (MAO 24 hrs, RTO 4 hrs), Internet (MAO 24 hrs, RTO 8 hrs), SharePoint and File Access (MAO 24 hrs), Salesforce (MAO 48 hrs), and Data Analytics/Processing (MAO 24 hrs, RTO 8 hrs). Critical systems include redundant/virtualized Remote Desktop servers, domain controllers, file servers, ADFS, and firewalls with support warranties and image-based/file backups.<br /><br />Backups are managed via CommVault with daily backups, monthly retention for 12 months, annual retention for 7 years, and offsite storage in Google Nearline; Office 365/SharePoint relies on Microsoft cloud retention; local machines are backed up hourly via Backblaze.<br /><br />An Emergency Response Team (led by the COO or IT lead as backup) is empowered to make recovery decisions, coordinate incident reporting (IT incidents through Dataprise GSD; others to COO), manage communications, and liaise with authorities. Evacuation assembly points are defined for Chevy Chase and Bethesda offices. Recovery relies on mirrored alternate sites (Chevy Chase and Bethesda), staged network/security equipment, and the ability to shift staff to alternate offices or home offices. The plan addresses supplier continuity (notably Dataprise and Salesforce) through contacts, contractual obligations, and contingency options.<br /><br />Testing is conducted annually via a walkthrough exercise; results are reviewed by the COO with corrective actions documented.

Keywords

Business Continuity Plan (BCP)

Business Continuity Management System (BCMS)

Business Impact Analysis (BIA)

risk assessment and treatment

Incident Response Plan

Maximum Acceptable Outage (MAO)

Recovery Time Objective (RTO)

CommVault backups

Google Nearline offsite storage

Emergency Response Team (ERT)