Disaster Recovery Policy

2025.1

Reviewed: 12/02/2024
Updated: 12/02/2024

Purpose and Scope:

1. The purpose of this policy is to define IMPLAN's procedures to recover Information Technology (IT) infrastructure and IT services within set deadlines in the case of a disaster or other disruptive incident. The objective of this plan is to complete the recovery of IT infrastructure and IT services within a set Recovery Time Objective (RTO).
2. This policy includes all resources and processes necessary for service and data recovery, and covers all information security aspects of business continuity management.
3. This policy applies to all management, employees and suppliers that are involved in the recovery of IT infrastructure and services within IMPLAN. This policy must be made readily available to all whom it applies to.

Background:

1. This policy defines the overall disaster recovery strategy for IMPLAN. The strategy describes IMPLAN's Recovery Time Objective (RTO), which is defined as the duration of time and service level for critical business processes to be restored after a disaster or other disruptive event, as well as the procedures, responsibility and technical guidance required to meet the RTO. This policy also lists the contact information for personnel and service providers that may be needed during a disaster recovery event.
2. The following conditions must be met for this plan to be viable:
   a. All equipment, software and data (or their backups/failovers) are available in some manner.
   b. If an incident takes place at IMPLAN's physical location, all resources involved in recovery efforts are able to be transferred to an alternate work site (such as their home office) to complete their duties.
   c. The Director of Infrastructure and Technology is responsible for coordinating and conducting a bi-annual (at least) rehearsal of this continuity plan.
3. This plan does not cover the following types of incidents:
   a. Incidents that affect clients or partners but have no effect on IMPLAN's systems; in this case, the client must employ their own continuity processes to make sure that they can continue to interact with IMPLAN and its systems.
   b. Incidents that affect cloud infrastructure suppliers at the core infrastructure level, including Amazon Web Services. IMPLAN depends on such suppliers to employ their own continuity processes.

Controls and Procedures

Disaster Recovery Policy:

1. Relocation
   If the organization's primary work site is unavailable, all employees required for the restoration of service have the ability to work remotely and will be expected to work from their home offices or alternate accommodations of their own choosing.

2. IMPLAN's Recovery Time a. Recovery Time Objective (RTO) is 12 hours. Relocation and restoration of critical services and technologies must be completed within this time period.
   b. Recovery Point Objective (RPO) is one hour. Critical services and technologies must be recoverable within 1 hour of the service incident.

3. Critical Services, Key Tasks and, Service Level Agreements (SLAs)
   a. The following services and technologies are considered to be critical for business operations, and must immediately be restored:

   • RingCentral
   • Zendesk
   • Salesforce
   • Blackthorn
   • Quickbooks Online (recovery options for service, redundancy and resilience)
   • Hubspot

   b. The following services and technologies are critical for the functionality of IMPLAN Cloud, and must be restored to meet the RTO, either through troubleshooting the issue or relocation to a failover datacenter:

   • Amazon Aurora
   • Amazon Elasticache
   • Amazon Redshift and Redshift Data API
   • AWS Elastic Beanstalk
   • AWS Lambda

4. Notification of Plan Initiation
   a. The following personnel must be notified when this plan is initiated:

   • Justin Helmig, CEO; Erik Garrett, Vice President of Product and Technology (VPPT); Candi Clouse, VP of Customer Success; Sandy Boone, Controller; Dan Cain, VP of Sales; Michelle Burton, VP of Marketing

   b. Doug Kolpien, Director of Infrastructure and Technology is responsible for notifying the personnel listed above.

5. Plan Deactivation
   a. This plan must only be deactivated by Doug Kolpien, Director of Infrastructure and Technology; Erik Garrett, VPPT.
   b. In order for this plan to be deactivated, all relocation activities and critical service / technology tasks as detailed above must be fully completed and/or restored. If IMPLAN is still operating in an impaired scenario, the plan may still be kept active at the discretion of Doug Kolpien or Erik Garrett.
   c. The following personnel must be notified when this plan is deactivated:

   • Justin Helmig, CEO; Erik Garrett, Vice President of Product and Technology; Candi Clouse, VP of Customer Success; Sandy Boone, Controller; Dan Cain, VP of Sales; Michelle Burton, VP of Marketing

6. IMPLAN must endeavor to restore its normal level of business operations as soon as possible.

7. During a crisis, it is vital for certain recovery tasks to be performed right away. The following actions are pre-authorized in the event of a disaster recovery event:
   a. VPPT and DIT must take all steps specified in this disaster recovery plan in order to recover IMPLAN's information technology infrastructure and services.
   b. VPPT and DIT are authorized to make urgent purchases of equipment and services.
   c. VPPT and DIT are authorized to delegate communication with clients.
   d. VPPT and DIT are authorized to cooperate with Amazon Web Services.

8. Specific recovery steps for information systems infrastructure and services are recorded in internal documentation.