# BUSINESS CONTINUITY PLAN
Date: 9 September 2030
Parties: Northmoor Analytics Limited and its Business Recovery Team
## 1. Purpose and parties
This plan covers Northmoor's Leeds office, Bristol office and cloud analytics service. Its objectives are to protect people, maintain lawful customer service, preserve data and recover priority functions. The Business Recovery Team (BRT) owns activation; the separate IT Disaster Recovery Plan provides technical runbooks.
## 2. Facts, scope and terms
The business-impact analysis classifies customer dashboard and data processing as critical: RTO four hours and RPO one hour. Payroll, customer support and order administration are important: RTO 24 hours and RPO four hours. Routine projects have RTO 72 hours. Maximum tolerable period of disruption is five days for critical services.
## 3. Process and responsibilities
Priority scenarios are ransomware, cloud outage, loss of premises, utility failure, supplier insolvency and mass absence. The risk register records likelihood, impact, dependencies and controls. A single cloud region and key-person dependency are accepted residual risks with documented mitigations, not silently ignored assumptions.
## 4. Evidence, records and safeguards
Gold (Managing Director Priya Shah) decides strategic activation; Silver (Operations Director Oliver Grant, CTO Maya Shah and HR Director Helen Ward) coordinates tactics; Bronze team leads run workarounds. Activate on Priya's decision, a four-hour critical outage, confirmed ransomware or premises exclusion. Any manager may escalate through the 24-hour contact tree.
## 5. Review, escalation and outcome
On activation, account for staff, contact emergency services where needed, isolate compromised systems, notify the insurer and assess UK GDPR or sector notifications. Communications use the emergency Teams channel, phone tree and approved spokesperson; customers receive a factual update without speculation. HR arranges welfare and a safe remote-working rota.
## 6. Reservations and practical protections
Workarounds include read-only customer status from the replicated store, manual order logs, alternate payroll processing, reciprocal office space and approved supplier substitution. The BRT logs decisions, data loss, costs and recovery milestones. Return to normal requires security approval, reconciled records, customer notice where needed and a documented lessons review.
## 7. England and Wales law and completion
The plan owner tests the phone tree quarterly, runs a tabletop exercise twice yearly and reviews the plan after an incident, major supplier change or annual risk assessment. Contact details are stored in the controlled register, not this public copy. England and Wales law applies; the board approves on 9 September 2030.