Business Continuity & Disaster Recovery (BCDR) Policy

Policy Statement

The Company is committed to ensuring business resilience and operational continuity in the event of a disruption, disaster, or crisis. This Business Continuity & Disaster Recovery (BCDR) Policy establishes a framework for preparedness, response, recovery, and restoration of critical business operations to minimize downtime, data loss, and financial impact.

Objective

• Ensure uninterrupted delivery of essential services and functions during unforeseen events.
• Establish preventive and corrective controls to minimize operational disruptions.
• Protect company assets, customer data, and information systems from disasters.
• Define clear roles, responsibilities, and communication protocols during emergencies.

Scope and Applicability

This policy applies to all departments, employees, systems, vendors, and processes critical to the operations of the Company It covers business continuity planning, disaster recovery measures, and crisis communication protocols for both physical and digital disruptions.

Regulatory Framework

• ISO 22301:2019, Business Continuity Management Systems (BCMS).
• ISO/IEC 27031, ICT Readiness for Business Continuity.
• RBI and CERT-In guidelines for financial and IT continuity management.
• Applicable local laws and data protection regulations.

Business Continuity Management (BCM) Framework

The Company's BCM framework is built on the following components:

• Business Impact Analysis (BIA): Identifies critical business functions and their dependencies.
• Risk Assessment: Evaluates threats such as natural disasters, cyberattacks, and system failures.
• Continuity Strategies: Defines recovery priorities, alternate work arrangements, and backup systems.
• Plan Development: Documents procedures for recovery and resumption of services.
• Testing & Review: Periodically tests the BCP/DRP and updates them based on outcomes.

Disaster Recovery (DR) Framework

The Disaster Recovery framework ensures IT systems, data, and applications can be restored within defined recovery time objectives (RTOs) and recovery point objectives (RPOs). It includes the following key elements:

• Regular data backups and off-site replication.
• Cloud-based disaster recovery solutions with redundancy.
• Emergency access procedures and alternate connectivity channels.
• Restoration of critical systems in a prioritized manner.
• Periodic DR drills to validate readiness and recovery timelines.

Roles and Responsibilities

• Crisis Management Team (CMT): Leads response efforts, decision-making, and stakeholder communication.
• Business Continuity Manager: Oversees the BCP implementation and ensures plan updates.
• IT Disaster Recovery Lead: Manages data backups, system restoration, and DR testing.
• Department Heads: Identify critical processes and maintain departmental continuity plans.
• Employees: Follow BCP procedures and assist during recovery activities.

Emergency Response & Communication

An emergency communication plan shall be maintained to notify employees, clients, vendors, and regulators in case of a disaster. Communication channels include email alerts, SMS notifications, emergency hotlines, and collaboration platforms.

Alternate Work Arrangements

In case of primary site unavailability, employees shall operate from designated alternate locations or remotely. Critical systems shall be accessible through secure VPNs and authenticated access controls.

Testing and Maintenance

The BCP and DRP shall be tested at least annually through simulation exercises, tabletop drills, and failover tests. Test results shall be documented, reviewed by senior management, and used to strengthen the resilience framework.

Data Backup and Restoration

The Company shall perform automated data backups daily with retention schedules aligned with business needs. All backup media and cloud repositories shall be encrypted and periodically tested for successful restoration.

Policy Review

This policy shall be reviewed annually or upon major changes in business processes, IT systems, or regulatory requirements. The Compliance and IT departments shall jointly oversee updates and communication of revisions.

Employee Acknowledgment

I acknowledge that I have read and understood the Business Continuity & Disaster Recovery (BCDR) Policy of the Company I agree to comply with the procedures outlined and actively participate in continuity and recovery initiatives as required.

Employee Name: __________________________

Signature: ______________________________

Date: _________________________________