Policy owner: @Salim Semaoune

Effective date: April 3, 2023

Purpose

The purpose of this business continuity plan is to prepare Contrast in the event of extended service outages caused by factors beyond our control (e.g., natural disasters, man-made events), and to restore services to the widest extent possible in a minimum time frame.

Scope

All Contrast IT systems that are business-critical. This policy applies to all employees of Contrast and to all relevant external parties, including but not limited to Contrast consultants and contractors.

The following scenarios are excluded from the BC/DR plan scope:

• Loss of availability for a production hosting service provider (AWS)
• Loss of availability of Contrast communication systems (these will be considered incidents)

In the event of a loss of availability of a hosting service provider, the CTO or CEO will determine an appropriate response strategy.

Policy

In the event of a major disruption to production services and a disaster affecting the availability and/or security of the Contrast employees, senior managers and executive staff shall determine mitigation actions.

In case of an all-remote company like Contrast, it is sufficient to have simple contingency plans in the form of service-level agreements with companies that host our data and services. The advantage of an all-remote workforce like Contrast is that if there are clusters of people or systems that are unavailable, the rest of the company will continue to operate normally.

A disaster recovery test, including a test of backup restoration processes, shall be performed on an annual basis.

Continuity of information security shall be considered along with operational continuity. In the case of an information security event or incident, refer to the Incident Response Plan.

Communications and Escalation

Executive staff and senior managers should be notified of any disaster affecting Contrast facilities or operations.

Communications shall take place over any available regular channels including Slack, email, phone and online meeting tools.

Key contacts shall be maintained on the on-call schedule and key contacts:

Roles and Responsibilities