...
For a business continuity plan to be effective, it needs to be triggered as soon as possible; too early or late can reduce its efficacy. Key Critical decision points to consider when a BCP has to be triggered or invoked are given belowis activated follow:
When an incident turns into an event like a disaster, breach, or something which that classifies it as a https://axelerant.atlassian.net/wiki/spaces/OA/pages/2983624719/Security+Incidents#Incident-Severity level 1.
When the The estimated time of resolution for a potential breach is greater than the normal standard estimated time for regular security incidentsSecurity Incidents.
When the recovery of an incident is uncertain, a decision must be made decide to invoke the business continuity plan if the disruption cannot be resolved within the specified incident recovery timelineswhen unable to resolve the situation within the specified https://axelerant.atlassian.net/wiki/spaces/OA/pages/2983624719/Security+Incidents#Incident-Recovery-Timelines.
When the resolution of an incident with critical customers, depending on their service-level agreements, is delayed, then we must trigger the BC plan must be triggered.
We’ve been in business for over 10+ years and have tested our resilience and haven’t come across any incident that has been beyond our risk management abilities.
During the normal ordinary course of our business, we’ve managed client-specific escalations through our Helpdesk support portal, which has Service Level Agreements commitments. We’ve maintained zero SLA violations for the last 2 two years. Further, any service degradation was restored within the stated SLAs by our vendors.
...
In the case of an all-remote company like Axelerant, it is sufficient to have simple contingency plans in the form of service-level agreements with companies that host our data and services. The advantage of an all-remote workforce like Axelerant is that if there are clusters of people or systems that are unavailable, the rest of the company will continue to operate normally.
...
Axelerant uses all third-party SaaS platforms, logged at Tools & Subscriptions, and there’s no infrastructure of its own ours to manage. The specifics tools and associated subscriptions are cataloged here Tools & Subscriptions. These platform's business continuity has been reviewed prior to adoption. The only business risk known is the degradation of service but no service degradation without data loss is expected.
Vendor Communication and Service Restoration Plan
All vendors vendors’ and service provider's providers’ support contact details are readily available and logged alongside each of the above subscriptions. Should a disruption of any kind, we are able to can escalate immediately and get an update on the time frame for service restoration.
...
All our services availability is being monitored proactively by UptimeRobot, and we manage escalations managed via https://www.atlassian.com/software/opsgenie. Any disruptions are reported transparently organization-wide via slack, email, and phone.
Further, our people operations team is a 4 four-member which manages these subscriptions. The admin details of each of the subscriptions subscription are available in LastPass, which is a secure way for us to share credentials without exposing them to hackers. The team members are not co-located, which further enables us to de-risk and provides a point of contact for our team for any emergencies they may encounter.
We have a decentralized leadership with 9 nine directors managing separate business areas of the business. We have 2 CXOs who operate from different parts of the world and have equal business know-how and legal rights to act on each others' others’ behalf.
Business Continuity Test
After formalizing the business continuity plan, or BCP, the next important step is to test the planmethod. Testing verifies the strategy’s effectiveness of the plan, trains plan participants on what to do in a real scenario, and identifies areas where to strengthen the plan needs to be strengthened.
This policy will be reviewed We review this policy at least annually or when significant business changes occur by the Axelerant Leadership team makes significant business changes.