Business Continuity Policy

Document Number: ISMS-POL-BCP-01

Classification: L1 — Policy (Domain)

Version: 0.1.2

Effective Date: February 18, 2026

Author: Lucas Shin — Security Director

Approved By: Richard — CISO

Next Review Date: February 2027

Parent Policy: Information Security Policy (ISMS-POL-ISP-01)

1. Purpose

This policy defines the business continuity and resilience requirements for Cybercraft to ensure that critical business functions can continue during and recover from disruptions — including personnel loss, system failures, and security incidents.

As a 3–5 person SMB, Cybercraft's primary continuity risks are key person dependency and cloud service availability, rather than traditional physical disaster scenarios. This policy is designed to be proportionate and operationally sustainable.

2. Scope

2.1 Applicable Systems and Services

• Microsoft 365 tenant (email, Teams, SharePoint, OneDrive) — Cybercraft's primary business platform
• SaaS tools on the Approved SaaS Register (Notion, Slack, Jira, etc.)
• Client engagement data stored within Cybercraft's M365 environment
• BYOD devices used by personnel to access Cybercraft systems

2.2 Applicable Personnel

• All Cybercraft employees, contractors, and directors
• Particular focus on key person roles where single points of failure exist

2.3 Out of Scope

• Client-side business continuity (responsibility of the client)
• Physical office continuity (Cybercraft operates as a fully remote organisation)

3. Key Person Risk

3.1 Risk Assessment

Derived from BYOD Security Policy (ISMS-POL-BYOD-01) Section 4 — single Security Director dependency:

Cybercraft's most significant continuity risk is key person dependency. The following roles represent single points of failure:

3.2 Mitigation Measures

4. Emergency Policy Deviation

4.1 When Emergency Deviations Apply

Derived from BYOD Security Policy (ISMS-POL-BYOD-01) Section 7.1:

When a temporary operational need requires deviation from established security policies — for example:

• The Security Director is unavailable and a critical security action is needed
• A system outage prevents normal access control enforcement
• A security incident requires immediate actions that conflict with standing policy

4.2 Emergency Deviation Process

5. Data Backup and Recovery

5.1 M365 Data Protection

Note: Cybercraft uses AFI Backup as a third-party M365 backup solution to supplement Microsoft's native retention capabilities. AFI Backup provides automated backup of Exchange Online, SharePoint, OneDrive, and Teams data to an independent infrastructure, ensuring recovery capability beyond Microsoft's native retention limits. Backup scope and retention settings are reviewed annually or upon significant platform changes.

5.2 SaaS Data

• Each approved SaaS tool on the register should have a documented data export capability
• Critical SaaS data (e.g., Notion workspace, project management data) should be exported quarterly as part of the evidence retention cycle
• Export responsibility: Security Director

5.3 BYOD Device Data

• Corporate data on BYOD devices is logically isolated (managed volume on macOS, Work Profile on Android)
• If a device is lost or destroyed, corporate data is recoverable from M365 cloud services — no local-only data should exist
• User is responsible for personal data backup on their own device

6. Emergency Contact Chain

Contact details are maintained in a separate Emergency Contact Register stored both in SharePoint and offline (printed copy held by CEO and CISO).

7. Service Availability

7.1 Dependency on Microsoft 365

Cybercraft's operations are heavily dependent on Microsoft 365 availability. In the event of a prolonged M365 outage:

• Communication fallback: Personal email and phone for urgent matters
• File access: Local cached copies in managed apps (limited, read-only for recent files)
• Client communication: Direct phone/personal email with clients as needed
• Recovery: Resume normal operations once M365 services are restored

7.2 Acceptable Downtime

• Email/Teams: Maximum 24 hours before fallback communication is activated
• SharePoint/OneDrive: Maximum 48 hours — work can continue with locally cached files
• SaaS tools (Notion, Jira): Maximum 72 hours — not immediately business-critical

8. Roles and Responsibilities

9. Compliance Mapping

10. Document Control

Review Schedule

• Quarterly: Emergency contact register verification, break-glass account test
• Annually: Full BCP review, key person risk reassessment, backup strategy evaluation
• Ad-hoc: After any business disruption, personnel change in key roles, or significant platform change

[End of Policy Document]