Business Continuity and Disaster Recovery Policy¶
Organization: Cloudnaut Technologies LLP
Classification: Internal
Document status: Effective
Version: 1.0
Owner: Management
Effective date: 2026-10-15
Review cycle: Annual, after each continuity test, and upon material change to services or suppliers
Recovery objectives
Recovery time and recovery point objectives are set by management in the internal business impact analysis and, where they affect a customer, confirmed against the customer contract.
Document control¶
| Role | Name |
|---|---|
| Prepared by | Management / Security Owner (Cloudnaut) |
| Reviewed by | Sandeep AC |
| Approved by | Sandeep AC |
Revision history¶
| Version | Date | Summary | Reviewed by | Approved by |
|---|---|---|---|---|
| 0.1 | 2026-10-15 | Initial draft. | Sandeep AC | — |
| 1.0 | 2026-10-15 | Initial effective release. | Sandeep AC | Sandeep AC |
Purpose¶
This policy defines how Cloudnaut keeps delivering its services to customers through disruptions such as loss of key personnel, endpoint loss, supplier outage, or loss of office or connectivity, and how it supports customers’ own continuity arrangements.
Scope and responsibility split¶
Cloudnaut is a services company. Its continuity concerns its ability to deliver engineering and consulting work, not the availability of customer production systems.
| Area | Responsible party |
|---|---|
| Availability, backup, and disaster recovery of customer infrastructure, applications, and data | Customer, unless a contract explicitly assigns a defined operational responsibility to Cloudnaut |
| Designing or implementing backup/DR architectures when contracted (for example AWS Backup, multi-AZ or multi-region designs) | Cloudnaut delivers to the agreed design; customer operates and tests unless contracted otherwise |
| Continuity of Cloudnaut delivery (people, endpoints, knowledge, access) | Cloudnaut |
| Continuity of Cloudnaut corporate systems and records | Cloudnaut |
See the Engagement Responsibility Model for responsibilities per delivery model.
Roles and responsibilities¶
| Role | Responsibilities |
|---|---|
| Management | Owns this policy; declares a continuity event; approves the business impact analysis and recovery objectives. |
| Security Owner | Maintains the continuity plan and contact list; coordinates tests. |
| Engagement Lead | Maintains engagement continuity arrangements (backup personnel, documentation, customer contacts). |
Policy¶
Business impact analysis¶
Management identifies Cloudnaut’s critical activities and dependencies at least annually. Recovery objectives are recorded in the internal business impact analysis (BIA). Activities in scope:
| Critical activity | Key dependencies | Recovery time objective | Recovery point objective |
|---|---|---|---|
| Customer engineering delivery | Engineers, encrypted endpoints, source control (GitHub/GitLab), customer access paths | Set in BIA | Source of truth is the customer or engagement repository |
| Customer communication | Email and collaboration platform | Set in BIA | Set in BIA |
| Security tooling | CI/CD scanning, endpoint protection console | Set in BIA | n/a |
| Corporate records (contracts, HR, finance, evidence) | Corporate document storage | Set in BIA | Set in BIA |
Continuity measures¶
- No single point of knowledge: each engagement keeps current documentation in the engagement repository or customer-approved location, and identifies a backup engineer where staffing allows.
- Work in shared repositories: code and infrastructure-as-code live in customer or engagement repositories, not only on endpoints, so endpoint loss does not lose work.
- Endpoint loss: a lost or failed endpoint is reported as an incident; a replacement is built to the Endpoint Security Policy baseline and access re-provisioned.
- Remote working: personnel can work from alternate locations using encrypted endpoints and approved access paths, so loss of a single site does not stop delivery.
- Supplier outage: critical suppliers are identified under the Third-Party and Supplier Security Policy with workarounds noted.
- Corporate data backup: Cloudnaut corporate records are held in managed services with backup or version history.
- Communication: an emergency contact list for personnel and customer contacts is maintained and available offline.
Testing¶
The continuity plan is tested at least annually (for example a tabletop exercise of key-person loss or source-control outage). Results and actions are recorded.
Exceptions¶
Customer contracts that require stronger continuity commitments are recorded per engagement and take precedence.
Records¶
Business impact analysis, continuity plan, contact list, test records, and corrective actions, held internally.