Training Course 1-APPENDIX B

APPENDIX B

Pdf Summary

Oakleaf Group’s Business Continuity Plan (BCP) defines how the company will maintain or rapidly restore operations following a “significant business disruptive event” affecting facilities, systems, or services. It applies across the organization’s Business Continuity Management System (BCMS) scope and is designed to protect employees and property, assess operational/financial impacts, and safeguard company data and records while resuming services as quickly as possible.<br /><br />The plan is based on Business Impact Analysis and risk assessment/treatment. Unacceptable risks require preventive controls, documented event scenarios, and defined responses within the Incident Response Plan. Maximum Acceptable Outage (MAO) and Recovery Time Objectives (RTO) are established for key services, including: Email (MAO 4 hours), Remote Desktop Services (MAO 24 hours/RTO 4 hours), Internet (MAO 24 hours/RTO 8 hours), file access and SharePoint (MAO 24 hours), Salesforce (MAO 48 hours), and data analytics (MAO 24 hours/RTO 8 hours). Critical systems include redundant Remote Desktop Servers, Domain Controllers, file servers, ADFS, and firewalls, supported by virtualization, redundancy, and backups.<br /><br />Data protection relies on redundant configurations and backups managed by IT. File server data is backed up daily with monthly and annual retention (using CommVault with offsite storage in Google Nearline). Office 365/SharePoint uses real-time Microsoft cloud retention, and local machines are backed up hourly via Backblaze.<br /><br />The plan defines an emergency response structure with named crisis managers, contact lists, and an Emergency Response Team led by the COO (or IT lead if absent). Incident reporting routes IT issues to Dataprise’s Global Service Desk and other incidents to the COO; the CEO controls external media messaging. Evacuation procedures and assembly points are specified for two office locations, along with communication methods prioritized from mobile phones to email/messaging.<br /><br />Recovery sites are mirrored between Chevy Chase and Bethesda with staged networking and equipment; staff may also work from home. Key suppliers include Dataprise and Salesforce, with expectations for continuity capability and contractual obligations. The BCP is tested annually via a walkthrough exercise, with results reviewed by the COO and documented in a testing report.

Keywords

Business Continuity Plan (BCP)

Business Continuity Management System (BCMS)

Business Impact Analysis (BIA)

risk assessment and treatment

Maximum Acceptable Outage (MAO)

Recovery Time Objective (RTO)

Incident Response Plan

data backup and retention (CommVault, Google Nearline, Backblaze)

Remote Desktop Services and critical infrastructure redundancy

Emergency Response Team and crisis communication procedures