Training Course 1-APPENDIX A

APPENDIX A

Pdf Summary

Oakleaf Group’s Business Continuity Plan (BCP) defines how the company will maintain or rapidly resume operations after a “significant business disruptive event” affecting facilities and/or services. It applies to the full Business Continuity Management System (BCMS) scope and focuses on protecting employees and property, assessing operational/financial impact, and safeguarding data and records so operations can restart as quickly as possible.<br /><br />The plan covers data backup and recovery, critical applications/systems, alternative communications, alternate employee work locations, critical suppliers, and regular exercising/testing. Risk management aligns to the Business Impact Analysis (BIA), risk assessment/treatment, event scenarios, and the Incident Response Plan. Maximum Acceptable Outage (MAO) and Recovery Time Objectives (RTO) are set for key services (e.g., Email MAO 4 hours; Remote Desktop MAO 24 hours/RTO 4 hours; Internet MAO 24 hours/RTO 8 hours; File access MAO 24 hours/RTO 8 hours; Salesforce MAO 48 hours).<br /><br />Critical systems include Remote Desktop Servers, Domain Controllers, File Servers, ADFS, and firewalls, supported by redundancy and image/file backups. Data protection uses CommVault daily server/file backups with offsite storage to Google Nearline (plus monthly and annual retention), real-time Office 365 retention for SharePoint, and hourly local-machine backups via Backblaze.<br /><br />An Emergency Response Team (led by the COO as Emergency Response Manager; IT lead as alternate) is empowered to make recovery decisions, coordinate insurance/facilities/equipment/logistics, and manage staffing. IT incidents are reported to Dataprise’s Global Service Desk; other incidents to the COO; the CEO controls public/media communications. Coordination with authorities is assigned (e.g., FBI cyber crime: CISO/CEO). Evacuation assembly points are defined for Chevy Chase and Bethesda offices, with prioritized communication methods (mobile, phone, email, messaging).<br /><br />Recovery sites are mirrored between Chevy Chase and Bethesda with staged network/security equipment. Key suppliers/partners include Dataprise and Salesforce, with expectations for continuity capability and contractual obligations. The BCP is tested annually via a plan walkthrough; results are reviewed and corrective actions documented by the COO.

Keywords

Business Continuity Plan (BCP)

Business Continuity Management System (BCMS)

Significant business disruptive event

Business Impact Analysis (BIA)

Maximum Acceptable Outage (MAO)

Recovery Time Objective (RTO)

Data backup and disaster recovery

CommVault backups to Google Nearline

Emergency Response Team (COO-led)

Alternate work locations and recovery sites