Business Continuity Plan

Document owner: Chief Operating Officer (COO) with CISO as technical co-owner Version: 3.0 Effective date: January 1, 2026 Last updated: January 15, 2026 Classification: Public — Trust Center Review cadence: Annual full review; quarterly tabletop exercises; ad hoc review upon material changes Company: Acme Cloud, Inc. Address: 1200 Market Street, Suite 400, San Francisco, CA 94103, USA Primary contacts: trust@acmecloud.com | security@acmecloud.com | privacy@acmecloud.com

---

1. Document Purpose and Objectives

This Business Continuity Plan (BCP) establishes a comprehensive framework for maintaining essential operations, protecting customer data, and restoring services during disruptive events affecting Acme Cloud, Inc. The plan provides structured procedures for crisis management, operational continuity, disaster recovery, and stakeholder communication across a wide range of potential disruption scenarios while maintaining compliance with regulatory requirements and contractual commitments to customers.

The primary objectives of this Business Continuity Plan include the following strategic and operational goals that guide all continuity activities across the organization:

Objective	Description	Success Metric
Customer Data Protection	Ensure customer data confidentiality, integrity, and availability are maintained during disruptions	Zero customer data breaches during continuity events
Service Restoration	Restore critical customer-facing services within defined Recovery Time Objectives	100% achievement of RTO targets during actual events
Communication Effectiveness	Provide timely, accurate information to customers, employees, and stakeholders during disruptions	Customer notification within 60 minutes of confirmed impact
Workforce Safety	Prioritize employee safety and well-being during crises affecting physical locations or health	Zero employee injuries during continuity events
Regulatory Compliance	Maintain compliance with contractual SLAs, regulatory requirements, and industry standards	Zero regulatory findings related to availability failures
Operational Resilience	Build organizational capability to anticipate, respond to, and recover from disruptive events	Annual improvement in continuity metrics
Financial Stability	Minimize financial impact of disruptions through preparation, insurance, and rapid recovery	Business interruption costs within insurance coverage
Stakeholder Confidence	Maintain customer, investor, and partner trust through demonstrated continuity capability	Post-event satisfaction score above 4.0/5.0

This plan aligns with SOC 2 Trust Services Criteria A1.1-A1.3 (Availability), ISO 27001:2022 Annex A.5.29-A.5.30 (Information security during disruption), ISO 22301:2019 (Business continuity management systems), HIPAA Security Rule §164.308(a)(7) (Contingency plan), NIST SP 800-34 Rev. 1 (Contingency Planning Guide), and AWS Well-Architected Framework reliability pillar. This plan complements the Backup and Recovery Policy, Incident Response Plan, and Security Overview.

---

2. Definitions and Terminology

This section establishes standard terminology used throughout the Business Continuity Plan to ensure consistent interpretation and application across all continuity activities.

Term	Definition
Business Continuity	The capability of an organization to continue delivery of products and services at acceptable predefined levels following a disruptive incident
Business Continuity Plan (BCP)	Documented procedures that guide organizations to respond to, recover from, and restore operations following disruption
Disaster Recovery (DR)	The process of restoring IT systems, applications, and data following a significant disruption or disaster
Business Impact Analysis (BIA)	Process of identifying critical business functions and the resources required to support them, along with the impact of disruption
Maximum Tolerable Downtime (MTD)	The maximum period of time that a business function can be disrupted before the organization suffers unacceptable consequences
Recovery Time Objective (RTO)	Target time for restoring a business function or IT system following a disruption
Recovery Point Objective (RPO)	Maximum acceptable data loss measured in time, determining backup and replication frequency requirements
Crisis Management Team (CMT)	Cross-functional group responsible for strategic decision-making and coordination during a crisis
Executive Incident Commander (EIC)	Senior leader with overall authority for crisis decisions, external communications, and resource allocation
Technical Incident Commander (TIC)	Technical leader responsible for directing recovery operations and technical resource coordination
Warm Standby	A disaster recovery configuration where backup systems are running but not serving production traffic
Hot Standby	A disaster recovery configuration where backup systems are synchronized and ready for immediate failover
Failover	The process of switching from a primary system to a backup system
Failback	The process of returning operations to the primary system after recovery
Single Point of Failure (SPOF)	A component whose failure would cause the entire system to fail
Tabletop Exercise	A discussion-based exercise where participants walk through their roles and responses to a scenario
Functional Exercise	A hands-on exercise where participants execute actual procedures in a controlled environment
Full-Scale Exercise	A comprehensive exercise simulating real conditions as closely as possible
Invocation	The formal activation of the Business Continuity Plan in response to a disruption
Stand-Down	The formal deactivation of the Business Continuity Plan when normal operations resume

---

3. Scope and Applicability

This Business Continuity Plan applies to all Acme Cloud production systems, supporting infrastructure, critical corporate functions, and personnel responsible for continuity execution. The plan governs response to disruptions regardless of cause, duration, or geographic scope.

3.1 Systems and Operations in Scope

Category	Scope Coverage	Primary Owner	Continuity Priority
Production SaaS Platform	Customer-facing application, APIs, authentication, data storage	VP Engineering	Tier 1 Critical
Customer Data	All customer content, configurations, and account information	VP Engineering	Tier 1 Critical
Infrastructure	AWS us-east-1 (primary), eu-west-1 (DR), networking, security controls	Director of SRE	Tier 1 Critical
Support Operations	Customer support portal, ticketing, knowledge base, communication channels	VP Customer Success	Tier 2 Significant
Billing Systems	Payment processing, subscription management, invoicing	VP Finance	Tier 2 Significant
Security Monitoring	SIEM, endpoint protection, threat detection, incident response capability	CISO	Tier 2 Significant
Corporate IT	Email, collaboration, identity management, employee productivity tools	VP IT	Tier 3 Standard
Marketing and Sales	Website, CRM, marketing automation, sales tools	VP Marketing	Tier 3 Standard
Office Facilities	San Francisco headquarters, remote work infrastructure	VP Operations	Tier 4 Low Priority

3.2 Disruption Scenarios Addressed

Scenario Category	Example Events	Likelihood	Potential Impact	Primary Response
Technology Failure	Hardware failure, software bug, database corruption, network outage	Medium	High	Technical recovery procedures
Cyber Attack	Ransomware, DDoS, data breach, infrastructure compromise	Medium	Critical	Incident Response Plan
Cloud Provider Outage	AWS regional outage, service degradation, API failures	Low	Critical	DR failover procedures
Natural Disaster	Earthquake, severe weather, flooding affecting facilities or regions	Low	High	Facility and regional recovery
Pandemic/Public Health	Extended workforce unavailability, travel restrictions, office closures	Low	Medium	Remote operations procedures
Utility Failure	Power outage, telecommunications disruption, internet connectivity loss	Medium	Medium	Redundancy activation
Supply Chain Disruption	Critical vendor failure, software dependency compromise	Low	High	Vendor contingency procedures
Civil Disruption	Protests, civil unrest, transportation disruption	Low	Low	Remote operations, facility security
Key Personnel Loss	Sudden unavailability of critical personnel	Medium	Medium	Succession and cross-training
Regulatory Action	License suspension, compliance order, legal injunction	Very Low	Critical	Legal response procedures

3.3 Geographic Scope

Region	Operations Present	Infrastructure	Continuity Consideration
United States (Primary)	Headquarters (San Francisco), primary AWS region (us-east-1), majority workforce	Primary production infrastructure	Full BCP coverage
European Union	Customer data processing, DR region (eu-west-1), distributed workforce	Disaster recovery infrastructure	Regional failover capability
Global (Remote)	Distributed workforce, customer base	N/A	Remote work resilience

---

4. Governance Structure and Roles

Effective business continuity requires clear authority, defined responsibilities, and established escalation paths. This section defines the governance structure, key roles, and decision-making authority for continuity activities.

4.1 Crisis Management Team Structure

Role	Primary Responsibilities	Default Assignment	Backup Assignment	Activation Response Time
Executive Incident Commander (EIC)	Overall crisis decisions; external communications approval; resource authorization; Board liaison	CEO or COO	CTO	30 minutes (business hours); 60 minutes (off-hours)
Technical Incident Commander (TIC)	Technical recovery coordination; DR failover authorization; infrastructure decisions	CISO or VP Engineering	Director of SRE	30 minutes (business hours); 60 minutes (off-hours)
Business Continuity Manager	BCP maintenance; exercise coordination; post-event reporting; documentation	COO or designee	VP Operations	60 minutes
Communications Lead	Customer, employee, and media messaging; status page management; notification execution	VP Marketing	Director of Communications	30 minutes
Legal and Compliance Lead	Regulatory notification assessment; contractual obligation review; legal hold management	General Counsel	External counsel	60 minutes
Customer Success Lead	Enterprise customer outreach; customer impact assessment; SLA tracking	VP Customer Success	Director of Customer Success	30 minutes
Finance Lead	Insurance coordination; emergency expenditure authorization; financial impact tracking	CFO	Controller	60 minutes
HR Lead	Employee safety coordination; workforce availability; benefits and leave administration	VP People	HR Director	60 minutes
Facilities Lead	Physical facility management; safety coordination; logistics	VP Operations	Office Manager	30 minutes for facility events

4.2 Activation and Escalation Matrix

Event Severity	Activation Trigger	Initial Responder	CMT Activation	Executive Notification
Level 1 (Critical)	Production down over 1 hour; data breach confirmed; regional disaster affecting primary site	On-call SRE/Security	Immediate full CMT activation	CEO within 15 minutes; Board within 4 hours
Level 2 (Major)	Significant service degradation; security incident contained; key vendor failure	On-call SRE/Security	Core CMT activated within 30 minutes	COO and CISO within 30 minutes
Level 3 (Moderate)	Partial service impact; potential escalation risk; localized facility issue	On-call SRE/Facilities	CMT Manager notified; selective activation	Daily briefing to executives
Level 4 (Minor)	Limited impact; managed through normal operations; monitoring situation	Operational teams	Monitor only; no CMT activation	Included in regular reporting

4.3 Decision Authority Matrix

Decision Category	Level 1/2 Events	Level 3/4 Events	Documentation Required
Invoke Business Continuity Plan	EIC	CMT Manager	Invocation log with timestamp
Authorize DR failover	TIC with EIC approval	TIC	Change ticket and approval record
Customer notification content	EIC with Legal review	Communications Lead	Approved message copy
Media statement	EIC with Legal review	Communications Lead with EIC awareness	Approved statement copy
Emergency expenditure under $50K	EIC	CMT Manager	Purchase authorization
Emergency expenditure over $50K	CEO with CFO concurrence	CEO	Board notification
Office closure	EIC	CMT Manager	Closure notice
Return to normal operations	EIC	CMT Manager	Stand-down notice

---

5. Business Impact Analysis

Acme Cloud conducts formal Business Impact Analysis (BIA) annually to identify critical business functions, assess disruption impacts, and establish recovery priorities.

5.1 BIA Methodology

Phase	Activities	Participants	Output
Function identification	Inventory all business functions; document processes and dependencies	All department heads	Function catalog
Impact assessment	Evaluate financial, operational, regulatory, and reputational impacts of disruption	Function owners, Finance, Legal	Impact ratings by function
Dependency mapping	Identify technology, personnel, vendor, and facility dependencies	Function owners, IT, Procurement	Dependency matrix
Recovery prioritization	Establish MTD, RTO, and RPO for each function	CMT, function owners	Recovery objectives
Resource requirements	Determine minimum resources needed for recovery	Function owners	Resource requirements
Gap analysis	Compare current capabilities to requirements	CMT, GRC	Gap register
Plan update	Incorporate findings into BCP	CMT Manager	Updated BCP

5.2 Critical Business Functions

Business Function	Criticality Tier	Maximum Tolerable Downtime	Recovery Time Objective	Recovery Point Objective	Key Dependencies
Core SaaS Application	Tier 1	4 hours	4 hours	1 hour	AWS, Cloudflare, PostgreSQL, Redis
Customer Authentication	Tier 1	2 hours	2 hours	15 minutes	Okta, internal auth service, database
Customer API	Tier 1	4 hours	4 hours	1 hour	Application tier, database, CDN
Data Backup and Recovery	Tier 1	4 hours	4 hours	Per backup schedule	AWS RDS, S3, cross-region replication
Security Monitoring	Tier 2	8 hours	6 hours	1 hour	Datadog, CrowdStrike, AWS
Customer Support Portal	Tier 2	8 hours	4 hours	4 hours	Zendesk, status page, email
Background Job Processing	Tier 2	8 hours	6 hours	1 hour	SQS, worker fleet, database
Billing and Invoicing	Tier 2	24 hours	12 hours	24 hours	Stripe, internal billing service
Employee Productivity	Tier 3	48 hours	24 hours	24 hours	Google Workspace, Okta, Slack
Marketing Website	Tier 3	72 hours	24 hours	N/A	Vercel, Cloudflare

5.3 Financial Impact Assessment

Impact Category	Tier 1 (per hour)	Tier 2 (per hour)	Tier 3 (per day)	Calculation Basis
Direct revenue loss	$15,000-25,000	$5,000-10,000	$1,000-5,000	MRR prorated by affected services
SLA credit exposure	Variable per contract	Variable per contract	Minimal	Enterprise contract terms
Operational cost	$2,000-5,000	$1,000-2,000	$500-1,000	Response team labor
Reputational impact	Difficult to quantify	Moderate	Minimal	Customer churn correlation
Regulatory exposure	Variable	Minimal	None	Notification requirements

---

6. Recovery Strategies

This section defines the strategies and procedures for maintaining operations and recovering from various disruption scenarios.

6.1 Technology Recovery Strategies

Component	Primary Strategy	Secondary Strategy	RTO	Dependencies
Database (PostgreSQL)	Cross-region read replica promotion	Point-in-time recovery from snapshots	2 hours	AWS RDS, network connectivity
Application Tier	Pre-deployed container images in DR region	Fresh deployment from CI/CD	2 hours	Container registry, secrets
Object Storage (S3)	Cross-region replication (active-active)	Manual restore from replicated bucket	30 minutes	AWS S3, replication
CDN and Edge	Cloudflare multi-region failover	Route 53 DNS failover to origin	15 minutes	DNS propagation
Authentication	Okta multi-region; cached session fallback	Emergency local authentication	30 minutes	Okta availability
Monitoring	Multi-region Datadog; backup metrics pipeline	Manual monitoring procedures	1 hour	Datadog availability

6.2 Disaster Recovery Failover Procedure

Phase	Step	Actions	Duration	Responsible
Detection	1	Automated monitoring detects regional impact; alerts generated	0-15 min	Automated/SRE
Assessment	2	TIC assesses scope; confirms primary region unrecoverable within RTO	15-30 min	TIC
Authorization	3	EIC authorizes DR failover; CMT notified	5 min	EIC
Database Failover	4	Promote eu-west-1 read replica to primary; verify data consistency	15-30 min	SRE
Application Deployment	5	Deploy application containers in DR region; configure endpoints	30-60 min	SRE/Engineering
Traffic Failover	6	Update DNS records; verify propagation; enable traffic to DR	15-30 min	SRE
Validation	7	Execute smoke tests; verify critical functions; customer spot-check	30-60 min	Engineering/QA
Communication	8	Update status page; notify customers; internal communication	15 min	Communications
Monitoring	9	Enable enhanced monitoring; document event timeline	Ongoing	SRE
Total			2-4 hours

6.3 Workforce Continuity Strategies

Scenario	Strategy	Implementation	Testing
Office inaccessibility	Full remote work capability; distributed workforce	All employees equipped for remote work; VPN/SSO access	Monthly remote work verification
Regional workforce impact	Geographic distribution; time zone coverage	Distributed hiring; cross-regional team structure	Quarterly coverage analysis
Key personnel unavailability	Succession planning; cross-training; documentation	Identified successors for critical roles; documented procedures	Annual succession review
Extended absenteeism (over 25%)	Essential function prioritization; contractor surge capacity	Contractor relationships; prioritized function list	Tabletop exercise
Communication disruption	Multiple communication channels; out-of-band contact methods	Slack, email, phone tree, SMS; personal contact info	Quarterly contact tree test

6.4 Vendor Continuity Strategies

Vendor Category	Primary Vendor	Contingency	Failover Capability	Testing
Cloud Infrastructure	AWS	Multi-region within AWS; documented exit strategy	4-hour regional failover	Semi-annual DR test
CDN/Edge	Cloudflare	Route 53 + origin direct	15-minute failover	Quarterly failover test
Identity Provider	Okta	Cached sessions; emergency local auth	30-minute degraded mode	Annual failover test
Email Delivery	SendGrid	AWS SES (transactional fallback)	1-hour configuration change	Annual test
Payment Processing	Stripe	Manual invoicing for continuity	Degraded mode	Documented procedure
Customer Support	Zendesk	Direct email support	4-hour email configuration	Annual procedure review

---

7. Communication Procedures

Timely and accurate communication is essential during disruptions. This section defines communication procedures for all stakeholder groups.

7.1 Communication Channels

Channel	Primary Use	Backup	Owner	Activation Time
Status Page (status.acmecloud.com)	Customer-facing service status	Direct email; support portal banner	Communications	15 minutes
Email (automated)	Customer notification broadcasts	Manual email; phone tree for enterprise	Communications	30 minutes
Slack (internal)	Internal coordination; war room	Phone bridge; SMS	CMT Manager	Immediate
Phone Bridge	Executive communication; off-Slack backup	Mobile phones direct	CMT Manager	15 minutes
Enterprise CSM Outreach	Dedicated enterprise customer communication	Backup CSM; support escalation	Customer Success	30 minutes
Media (PR agency)	Press inquiries; proactive statements	In-house communications	Communications/EIC	2 hours
Investor Relations	Board and investor notification	Direct CEO communication	CFO/CEO	4 hours

7.2 Customer Communication Requirements

Customer Tier	Notification Trigger	Initial Notification SLA	Update Frequency	Channel
Enterprise	Any Tier 1/2 service impact	Within 30 minutes	Every 30 minutes during impact	Dedicated CSM + status page + email
Business	Tier 1 service impact	Within 60 minutes	Every 60 minutes during impact	Status page + email
All Customers	Confirmed data security event	Within 24 hours of confirmation	As material updates occur	Email + status page
All Customers	Extended outage (over 4 hours)	Within 60 minutes of impact	Every 60 minutes	Status page + email

7.3 Communication Templates

Pre-approved communication templates are maintained for the following scenarios:

Scenario	Template ID	Approval Status	Last Reviewed
Service degradation (initial)	COMM-001	Pre-approved	January 2026
Service degradation (update)	COMM-002	Pre-approved	January 2026
Service degradation (resolution)	COMM-003	Pre-approved	January 2026
Full service outage (initial)	COMM-004	Pre-approved	January 2026
Full service outage (update)	COMM-005	Pre-approved	January 2026
Full service outage (resolution)	COMM-006	Pre-approved	January 2026
Security incident (customer notification)	COMM-007	Legal review required	January 2026
Planned maintenance	COMM-008	Pre-approved	January 2026
DR failover notification	COMM-009	Pre-approved	January 2026
Post-incident summary	COMM-010	Legal review required	January 2026

7.4 Regulatory and Contractual Notifications

Requirement	Trigger	Timeline	Responsible	Process
Enterprise SLA notification	SLA threshold breach	Per contract (typically 24-48 hours)	Customer Success	Automated SLA tracking + CSM outreach
GDPR availability notification	Extended unavailability of personal data	Without undue delay if processing impacted	Privacy Officer	Legal assessment; DPA notification if required
HIPAA notification	PHI availability impact	Per BAA terms	Privacy Officer	BAA customer notification
Contractual force majeure	Qualified force majeure event	Per contract notice provisions	Legal	Formal notice if invoking
Insurance notification	Potential claim event	Within 72 hours	CFO	Carrier notification per policy

---

8. Plan Maintenance and Testing

Regular testing and maintenance ensure the BCP remains current and effective.

8.1 Testing Schedule

Exercise Type	Frequency	Last Completed	Next Scheduled	Scope	Participants
Tabletop (executive)	Annual	November 2025	November 2026	Regional outage scenario	CMT, executive team
Tabletop (technical)	Quarterly	January 2026	April 2026	Technical recovery scenarios	SRE, Security, Engineering
Technical DR failover	Semi-annual	December 2025	June 2026	Full regional failover	SRE, Engineering
Backup restore validation	Quarterly	January 2026	April 2026	Database and file recovery	SRE
Contact tree verification	Quarterly	January 2026	April 2026	CMT contact accuracy	All CMT members
Communication drill	Annual	October 2025	October 2026	Customer notification process	Communications, Customer Success
Vendor failover test	Annual per vendor	Q3 2025 (Cloudflare)	Q3 2026	Secondary vendor activation	SRE, Vendor Management
New hire orientation	Upon onboarding	Continuous	Continuous	BCP awareness and role orientation	CMT Manager

8.2 Exercise Evaluation Criteria

Criterion	Evaluation Method	Success Threshold	Remediation Timeline
CMT activation time	Timestamp from notification to acknowledgment	Under 30 minutes (business hours)	30 days for process improvement
Decision-making effectiveness	Observer assessment; participant feedback	Clear authority; timely decisions	60 days for clarification
Communication accuracy	Message review; timing measurement	Accurate content; within SLA	30 days for template/process update
Technical recovery success	RTO/RPO achievement	100% within objectives	14 days for technical remediation
Documentation completeness	Post-exercise document review	All required documentation produced	30 days for template update
Participant knowledge	Quiz or discussion assessment	80% procedural accuracy	60 days for training

8.3 Plan Maintenance Triggers

Trigger	Review Scope	Timeline	Responsible
Annual review	Full BCP review and update	January annually	CMT Manager
Organizational change	Affected roles and responsibilities	Within 30 days of change	CMT Manager
Technology change	Affected systems and procedures	Within 30 days of change	TIC
Vendor change	Affected vendor procedures	Within 30 days of change	Vendor Management
Exercise findings	Identified gaps and improvements	Within 14 days of exercise	CMT Manager
Actual event	Lessons learned incorporation	Within 30 days of event closure	CMT Manager
Regulatory change	Compliance requirements	Within 60 days of requirement	Legal/GRC

---

9. Supply Chain and Vendor Continuity

Critical vendor dependencies are managed through the Third-Party Risk Management program with specific continuity requirements.

9.1 Critical Vendor Dependencies

Vendor	Service Provided	Criticality	Redundancy Strategy	Monitoring
AWS	Infrastructure hosting	Critical - Tier 1	Multi-region architecture	AWS Health Dashboard; Datadog
Cloudflare	CDN, DDoS protection, edge	Critical - Tier 1	Route 53 + origin fallback	Cloudflare status; synthetic monitoring
Okta	Identity and access management	Critical - Tier 1	Cached sessions; emergency auth	Okta status; authentication monitoring
Stripe	Payment processing	Significant - Tier 2	Manual invoicing continuity	Stripe status; payment monitoring
Datadog	Monitoring and observability	Significant - Tier 2	Backup CloudWatch metrics	Datadog status; self-monitoring
SendGrid	Transactional email	Significant - Tier 2	AWS SES fallback	Delivery metrics
Zendesk	Customer support	Significant - Tier 2	Email support fallback	Ticket system monitoring

9.2 Vendor SLA Requirements

Vendor Tier	Required Availability SLA	BCP/DR Documentation	Incident Notification	Annual Review
Tier 1 Critical	99.9% or higher	Required for assessment	Within 1 hour	Full assessment
Tier 2 Significant	99.5% or higher	Requested	Within 4 hours	Questionnaire
Tier 3 Standard	99.0% or higher	Optional	Within 24 hours	Certification review

9.3 Vendor Incident Coordination

Phase	Acme Cloud Action	Vendor Expectation	Timeline
Detection	Monitor vendor status; correlate with internal monitoring	Status page update; proactive notification	Within 15 minutes
Assessment	Assess customer impact; evaluate workarounds	Scope and ETA communication	Within 30 minutes
Mitigation	Implement workarounds; activate redundancy if available	Progress updates; technical support	Ongoing
Resolution	Verify restoration; update customers	Root cause and prevention communication	Within 24 hours of resolution
Review	Incorporate learnings; assess vendor performance	Post-incident report	Within 5 business days

---

10. Financial Continuity

Financial resilience measures ensure Acme Cloud can sustain operations during extended disruptions.

10.1 Financial Reserves

Reserve Category	Target	Current Status	Review Frequency
Operating runway	18 months cash reserves	Maintained per Board policy	Quarterly CFO review
Emergency fund	$500K immediately accessible	Maintained in operating account	Monthly verification
Credit facility	Available credit line	Maintained with banking partner	Annual renewal

10.2 Insurance Coverage

Coverage Type	Coverage Limit	Deductible	Key Coverages	Carrier
Cyber liability	$10M per occurrence	$100K	Breach response, business interruption, regulatory fines	[Confidential]
Business interruption	$5M per occurrence	24-hour waiting period	Revenue loss, extra expense	[Confidential]
Technology E&O	$5M per occurrence	$50K	Service failures, professional liability	[Confidential]
D&O	$10M aggregate	Per policy	Director and officer liability	[Confidential]

10.3 Emergency Expenditure Authorization

Expenditure Level	Authorization Required	Documentation	Notification
Under $10K	CMT Manager	Verbal approval; documented post-event	CFO within 24 hours
$10K - $50K	EIC	Written approval	CFO concurrent
$50K - $250K	CEO with CFO concurrence	Written approval with justification	Board within 48 hours
Over $250K	CEO with Board notification	Board approval if time permits	Board concurrent

---

11. Pandemic and Public Health Continuity

Acme Cloud's remote-first operating model provides inherent resilience to public health disruptions.

11.1 Pandemic Response Levels

Level	Trigger	Measures	Decision Authority
Level 1 (Monitoring)	Public health advisory; regional concern	Enhanced monitoring; travel guidance	VP People
Level 2 (Precaution)	Confirmed cases in workforce region	Optional remote work; enhanced cleaning; travel restrictions	COO
Level 3 (Activation)	Widespread community transmission	Mandatory remote work; office closure; event cancellation	CEO
Level 4 (Extended)	Prolonged public health emergency	Sustained remote operations; workforce support programs	CEO with Board

11.2 Remote Operations Capability

Capability	Current State	Maximum Duration	Dependencies
Full remote workforce	All employees remote-capable	Indefinite	Home internet; employee equipment
Virtual collaboration	Slack, Zoom, Google Workspace	Indefinite	SaaS provider availability
Secure remote access	VPN, SSO, MFA for all access	Indefinite	Okta, VPN infrastructure
Customer support	Fully distributed team	Indefinite	Zendesk, phone system
Engineering and development	All tools cloud-accessible	Indefinite	GitHub, CI/CD, cloud resources
Finance and HR	Cloud-based systems	Indefinite	Financial systems, HRIS

---

12. Metrics and Continuous Improvement

Business continuity effectiveness is measured through defined metrics reported to the CMT quarterly and the Board Audit Committee annually.

12.1 Key Performance Indicators

Metric	Target	FY2025 Actual	Trend
Unplanned downtime (Tier 1 services)	Under 4 hours annually	1.2 hours	Improving
DR test success rate	100%	100% (2/2 tests)	Stable
CMT activation time (tabletop average)	Under 30 minutes	18 minutes	Exceeds target
Customer notification SLA compliance	100%	100%	Meets target
Exercise completion rate	100%	100%	Meets target
BCP training completion (CMT)	100%	100%	Meets target
Vendor continuity assessment completion	100% Tier 1	100%	Meets target
Post-event action item closure	100% within SLA	100%	Meets target

12.2 FY2025 Improvement Actions Completed

Finding Source	Finding	Improvement Implemented	Verification
November 2025 tabletop	Status page update delay	Automated status page integration	Tested in December DR exercise
December 2025 DR test	DNS propagation delay	Pre-staged DNS records with low TTL	Propagation time reduced to under 5 minutes
Q3 2025 vendor review	Cloudflare failover untested	Cloudflare to Route 53 failover tested	Successful Q3 2025 test
Annual BIA review	Support function MTD too aggressive	Revised support MTD to 8 hours	Updated in BCP v3.0

12.3 FY2026 Improvement Roadmap

Initiative	Objective	Timeline	Owner	Success Criteria
Automated failover enhancement	Reduce DR failover time to under 2 hours	Q2 2026	Director of SRE	Demonstrated in June DR test
Multi-cloud assessment	Evaluate secondary cloud provider for critical services	Q3 2026	VP Engineering	Assessment report delivered
Customer self-service recovery	Enable customer-initiated data recovery for common scenarios	Q4 2026	Product	Feature launched
Enhanced vendor monitoring	Real-time vendor health dashboard	Q1 2026	SRE	Dashboard operational

---

13. Framework Compliance Mapping

Requirement	SOC 2 TSC	ISO 27001:2022	ISO 22301:2019	HIPAA	Implementation Reference
Availability commitments	A1.1	A.5.29	8.1	§164.308(a)(7)(i)	Section 5.2
Recovery planning	A1.2	A.5.29, A.5.30	8.2, 8.3	§164.308(a)(7)(ii)(B)	Section 6
Backup procedures	A1.2	A.8.13	8.2	§164.308(a)(7)(ii)(A)	Backup and Recovery
Recovery testing	A1.3	A.5.29	8.5	§164.308(a)(7)(ii)(D)	Section 8
Redundancy	A1.2	A.8.14	8.2	§164.308(a)(7)(ii)(C)	Section 6.1
Incident handling	CC7.4, CC7.5	A.5.24-A.5.28	8.4	§164.308(a)(6)	Incident Response
Crisis communication	CC2.3	A.5.29	8.4	§164.308(a)(6)(ii)	Section 7
Business impact analysis	A1.1	A.5.29	8.2	§164.308(a)(7)(ii)(E)	Section 5

---

14. Document Control and Distribution

Distribution Category	Recipients	Access Method	Update Notification
Full BCP	CMT members, Board Audit Committee	GRC document repository	Email upon update
Executive summary	All directors and above	Internal wiki	Quarterly briefing
Role-specific procedures	Relevant team members	Team documentation	Team lead communication
Customer-facing summary	Enterprise customers (under NDA)	Trust Center request	Upon material update
Audit evidence	External auditors	Secure document room	Per audit request

---

Related Trust Center documents

backup recovery, incident response, security overview, third party risk, data retention, compliance frameworks, subprocessor list

---

Document revision history

Version	Date	Author	Summary of changes
1.0	2024-06-01	Legal & Compliance	Initial Trust Center publication
2.0	2025-03-15	GRC Program	SOC 2 Type II alignment refresh; expanded subprocessors
2.5	2025-09-01	Security Engineering	Encryption standards update; ISO 27001 mapping
3.0	2026-01-15	Trust Center Program	Full procurement-grade expansion; 34-document set

---

Contact

Acme Cloud, Inc. 1200 Market Street, Suite 400 San Francisco, CA 94103, USA

Channel	Email	Use case
Trust & procurement	trust@acmecloud.com	Security questionnaires, trust reviews
Security	security@acmecloud.com	Incidents, vulnerabilities, control questions
Privacy	privacy@acmecloud.com	DSRs, privacy assessments
Legal	legal@acmecloud.com	Contractual, DPA, legal notices

---

Business continuity inquiries: trust@acmecloud.com Emergency contact: security@acmecloud.com (24/7 monitored) Service status: status.acmecloud.com