This policy provides the framework for maintaining essential operations when a crisis disrupts systems, infrastructure or communications. Its primary objective is to preserve the availability and integrity of information systems and enable critical business services to resume in a controlled manner.
The Board requires the disaster recovery plan to be reviewed at least annually, supported by regular risk assessments and updated as technology, risks and business operations change. Critical systems, networks and infrastructure must be covered, and employees must understand their assigned roles.
Preventive safeguards include secure equipment rooms, restricted system access, uninterruptible power supplies, secondary connectivity, redundant hardware and on-site and remote backups. The plan considers natural disasters, power failures, internet or network outages, and server or hardware failure.
Regular simulations test recovery procedures, improve staff readiness and identify weaknesses. Updates follow controlled change procedures and must be reflected in training materials, while recovery documentation and emergency contacts are maintained at secure locations.
This summary is for convenience and does not replace the approved document. If there is any difference, the complete PDF governs.