Business Continuity Policy

The purpose of Netspective Communications LLC’s business continuity policy is to establish suitable measures to mitigate any disruptions to business activities and safeguard critical business processes from the impact of major information system failures or disasters. It also aims to ensure the timely resumption of these processes. [FII-SCF-003-BCD-01]

Netspective Communications LLC business continuity planning will incorporate controls to proactively identify and mitigate risks, contain damaging incidents, and ensure the availability of necessary information for business processes within Netspective Communications LLC. This document exclusively presents the information technology and information security policies for the information technology needs of Netspective Communications LLC. It has been developed in accordance with international information technology standards and best practices.

Including Information Security in the Business Continuity Management Process - Planning

• While developing business continuity management for the environment operated by Netspective Communications LLC or contracted with a third party by Netspective Communications LLC, Netspective Communications LLC should consider information security aspects. Here are some key elements of Business Continuity Management:
  • Establishing a Business Continuity Planning Framework
  • Conducting Business Impact Analysis and Risk Management
  • Developing and Implementing Continuity Plans
  • Testing, Maintaining, and Reassessing Business Continuity Plans
  • Formulating a formal business continuity strategy
  • Creating a Disaster Recovery and Resumption Plan
  • Implementing redundancies

Business Continuity and Risk Assessment

• Netspective Communications LLC shall actively implement appropriate Business Continuity Management (Contingency Plans) to minimize the impact on the organization and achieve an acceptable level of recovery from the loss of information assets. This will be accomplished through a combination of preventive and recovery controls. The loss can occur due to natural disasters, accidents, equipment failures, deliberate actions, and other factors.
• Business Continuity Planning will be conducted based on identified risks that have the potential to cause interruptions to business processes (such as equipment failure, fire, etc.). An impact analysis will be performed to assess the probability, impact, time, damage scale, and recovery period associated with such interruptions.
• The IT Department, in collaboration with business process owners and other relevant resources, will periodically conduct risk assessments or conduct them after significant changes in the information systems environment. This will be followed by an impact analysis.
• The risk assessment will identify, quantify, and prioritize risks based on Netspective Communications LLC’s criteria and business objectives. It will consider the impact of disruptions, allowable outage times, and recovery priorities.

Developing and Implementing Continuity plans Including Information Security

• As part of Business Continuity Plans, Netspective Communications LLC must actively implement workable contingency plans for their systems. These plans should enable the maintenance or recovery of operational capabilities in case of sudden emergencies, such as the loss of staff, premises, equipment, or key services.
• It is essential to make contingency arrangements that facilitate the continuity of business processes and supporting information processing/network services.
• The event of business recovery interruptions or failure of critical business processes at Netspective Communications LLC, appropriate procedures must be implemented to enable the timely recovery and restoration of business operations and availability of required information.
• The responsibility of ensuring that the Business Continuity Management in place addresses the information security requirements lies with the Information Security Department. They must ensure that sufficient financial, organizational, technical, and environmental resources are identified to meet these requirements.
• The BCP Department should develop an overall approach to business continuity aligned with the outcomes of the business continuity analysis and risk assessment.
• The business continuity plans contain sensitive information and should be securely protected. They should be stored in a remote location, sufficiently distant from the main site to avoid damage in the event of a disaster. Other materials necessary for executing the continuity plans should also be stored at the remote location.
• Critical components essential for service continuity must be identified, and the business continuity plan should include arrangements to promptly resume services in the event of their failure. Specific measures may include provision for standby power supplies, duplication of processors and online storage, automatic re-routing of communications, fallback to alternative internet carrier services, duplication of network operations centers, and contract-based maintenance to ensure timely repair.
• Business continuity plans should undergo review and updates every 12 months.

Business Continuity Planning Framework

• The BCP Department is responsible for maintaining a unified framework of business continuity plans. This ensures consistency across all plans and enables consistent addressing of information security requirements. It also helps in identifying priorities for testing and maintenance.
• Netspective Communications LLC’s business continuity planning framework should encompass the following elements:
  • Clearly defined conditions for activating the plans, including the assessment of the situation and the involvement of relevant parties, before each plan is put into action.
  • Emergency procedures outlining immediate actions to be taken in the event of incidents jeopardizing business operations and/or human life. This includes arrangements for media handling and effective communication with appropriate public authorities such as the police, fire service, and local government.
  • Fallback procedures for relocating essential business activities or support services to temporary alternative locations and bringing business processes back into operation within the required timeframes.
  • Procedures for resuming normal business operations.
  • A maintenance schedule specifying how and when the plan will be tested, as well as the process for keeping the plan up to date.
  • Awareness and education activities designed to foster understanding of the business continuity processes and ensure their ongoing effectiveness.
  • Clearly defined responsibilities of individuals, including their roles in executing different components of the plan. Alternates should be designated as necessary, and contact information such as telephone numbers and addresses should be provided for these individuals.
  • Identification of critical assets and resources necessary to perform emergency, fallback, and resumption procedures.
• The Business Continuity Plan should have a designated custodian.
• The appropriate business owner is responsible for emergency procedures, manual fallback plans, and resumption plans.

Testing, Maintaining and reassessing Business Continuity Plan & Redundancies [FII-SCF-003-BCD-11.1]

• Regular testing of Business Continuity Plans is necessary to ensure their up-to-date and effective nature. It is essential to develop a test schedule for the Business Continuity Plan, indicating how and when each element of the plan will be tested.
• The Business Continuity Plan should undergo regular reviews and updates to accommodate changes in the business environment. These changes may include personnel, addresses or telephone numbers, business strategy, location, facilities, resources, legislation, contractors, suppliers, key customers, processes, and operational risks.
• Netspective Communications LLC will establish redundancies to sustain operations in the event of a disaster. The decision on the extent of redundancies will be based on cost, requirements, and risks. Critical elements such as software code, databases, and data must be securely stored and retrievable in the event of a disaster.