Axelerant, by its remote-only nature, is not easily affected by typical causes of business disruption, such as local failures of equipment, power supplies, telecommunications, social unrest, terrorist attacks, fire, or natural disasters.
For a business continuity plan to be effective, it needs to be triggered as soon as possible; too early or late can reduce its efficacy. Key decision points to consider when a BCP has to be triggered or invoked are given below:
When an incident turns into an event like a disaster, breach, or something which classifies it as a Severity 1
When the estimated time of resolution for a potential breach is greater than the normal estimated time for regular security incidents
When the recovery of an incident is uncertain, a decision must be made to invoke the business continuity plan if the disruption cannot be resolved within the specified incident recovery timelines
When the resolution of an incident with critical customers, depending on their service-level agreements is delayed, then the BC plan must be triggered
We’ve been in business for over 10+ years and have tested our resilience and haven’t across any incident that has been beyond our risk management abilities.
During the normal course of our business, we’ve managed client-specific escalations through our Helpdesk portal which has Service Level Agreements commitments. We’ve maintained zero SLA violations for the last 2 years. Further, any service degradation was restored within the stated SLAs by our vendors.
BCP for Remote Workers
In the case of an all-remote company like Axelerant, it is sufficient to have simple contingency plans in the form of service-level agreements with companies that host our data and services. The advantage of an all-remote workforce like Axelerant is that if there are clusters of people or systems that are unavailable, the rest of the company will continue to operate normally.
Data Continuity Plan
Axelerant uses all third-party SaaS platforms and there’s no infrastructure of its own to manage. The specifics tools and associated subscriptions are cataloged here Tools & Subscriptions. These platform's business continuity has been reviewed prior to adoption. The only business risk known is the degradation of service but no data loss is expected.
Vendor Communication and Service Restoration Plan
All vendors and service provider's support contact details are readily available and logged alongside each of the above subscriptions. Should a disruption of any kind we are able to escalate immediately and get an update on the time frame for service restoration.
Communication Plan and Role Assignments
All our services availability is being monitored proactively by UptimeRobot and escalations managed via https://www.atlassian.com/software/opsgenie. Any disruptions are reported transparently organization-wide via slack, email, and phone.
Further, our people operations team is a 4 member which manages these subscriptions. The admin details of each of the subscriptions are available in LastPass which is a secure way for us to share credentials without exposing them to hackers. The team members are not co-located which further enables us to de-risk and provides a point of contact for our team for any emergencies they may encounter.
We have a decentralized leadership with 9 directors managing separate areas of the business. We have 2 CXOs who operate from different parts of the world and have equal business know-how and legal rights to act on each others' behalf.
Business Continuity Test
After formalizing the business continuity plan, or BCP, the next important step is to test the plan. Testing verifies the effectiveness of the plan, trains plan participants on what to do in a real scenario and identifies areas where the plan needs to be strengthened.
This policy will be reviewed at least annually or when significant business changes occur by the Axelerant Leadership team.