Training Course 1-APPENDIX A

APPENDIX A

Pdf Summary

Oakleaf’s Business Continuity Plan (BCP) defines how the company will maintain or quickly restore operations after a “significant business disruptive event” that threatens or interrupts normal facilities and services. The plan applies across the full Business Continuity Management System (BCMS) scope and focuses on protecting employees and property, assessing operational/financial impact, and safeguarding company data and records so operations can resume as quickly as practicable.<br /><br />The strategy is based on Business Impact Analysis and risk assessment/treatment. Unacceptable risks require preventive controls, scenario planning, and aligned incident response procedures. Maximum Acceptable Outage (MAO) and Recovery Time Objectives (RTO) are defined for key services: Email (MAO 4 hours), Remote Desktop, Internet, SharePoint, file access, and data analytics (generally MAO 24 hours with RTOs commonly 4–8 hours), and Salesforce (MAO 48 hours). Critical systems include remote desktop servers, domain controllers, file server, ADFS, and firewalls, with redundancy and backups as primary recovery strategies.<br /><br />Data protection relies on redundant configurations and structured backups: Oakleaf file servers are backed up daily with monthly and annual retention (including long-term retention up to seven years) via CommVault with offsite storage in Google Nearline; Office 365/SharePoint uses real-time cloud retention; local machines are backed up hourly via Backblaze.<br /><br />The plan establishes an Emergency Response Team and decision-making structure led by the COO (or IT Team Lead if absent), with defined roles for incident reporting, plan activation, public communications (CEO), and coordination with authorities. Evacuation assembly points are listed for Chevy Chase and Bethesda offices, and communications prioritize mobile/phone, then email and messaging.<br /><br />Recovery sites are mirrored between Chevy Chase and Bethesda, with staged networking and computing equipment; employees may also work from home. Key suppliers/partners (e.g., Dataprise, Salesforce) are managed through contacts, contractual continuity expectations, and potential insourcing options. The BCP is tested annually via a walkthrough, with results reviewed by the COO and documented in an exercising/testing report.

Keywords

Business Continuity Plan (BCP)

Business Continuity Management System (BCMS)

significant business disruptive event

Business Impact Analysis (BIA)

risk assessment and treatment

Maximum Acceptable Outage (MAO)

Recovery Time Objective (RTO)

data backup and retention (CommVault, Google Nearline, Backblaze)

critical IT systems redundancy (ADFS, domain controllers, firewalls, remote desktop)

Emergency Response Team and incident response testing