1.0    Objective

Infinit-O’s business continuity plan aims to create a comprehensive plan that aims to ensure service delivery in situations where identified potential events occurred. This would encompass procedures to prevent disruptions, controls to ensure availability of information and resources, and testing to ensure reliability of plans that are put in place.

2.0    Position Statement

We understand the importance of providing service continuity for our clients. During the Covid-19 pandemic we were able to provide continuous service to 100% of our clients and continue to meet our SLA commitments. Our BCP is designed to provide continuity of service and protect the health and safety of our team members while safeguarding the data of our clients. We share our BCP with our clients and prospects who are under an NDA. We have found that our BCP will provide sufficient safeguards for most of our clients. However, to be certain our clients have an appropriate BCP, we will offer to conduct a joint Business Impact Assessment (BIA) to determine to risks associated with a loss of service continuity for each process we support. If necessary, based on this assessment, we will provide a customized disaster recovery proposal for our client.

3.0    Crisis Management Command Structure

3.1    To formalize Infinit-O’s Business Continuity Management Program and to provide guidelines for developing, maintaining and exercising its Business Continuity Plan (BCP).

3.2    This policy establishes the basic principles and framework necessary to ensure emergency response, resumption and recovery, restoration and permanent recovery of the organization’s operations and business activities during a business interruption event.

3.3    The Business Continuity Team (BCT) will be composed of members of the Management Committee lead by the VP for Client Solutions Group (VP CSG).

3.4    For purposes of resiliency in the absence or unavailability of the VP CSG decisions will be done by the following:

3.4.1           VP People and Transformation

3.4.2           VP Finance

3.4.3           Director Financial Services and or Senior Operations Manager

4.0    Scope

4.1    This applies to all team members, information-processing facilities and corresponding IT systems when any of the following scenarios, including, but not limited to, natural disaster, power outage, hardware/telecommunications failures, data corruption, force majeure situations, occur.

4.2    This policy provides guidance for the Resumption and Recovery of time sensitive business operations in accordance with pre-established timeframes as well as ensuring that adequate plans are in place for the less time sensitive business operations.

5.0    Provisions

5.1    Business Impact Analysis and Risk Assessment

5.1.1           Business Impact Analysis (BIA) is prepared relative to the established SLA for Infinit-O departments or for established accounts. In case of new implementations this will be done after the first 90 days once SLA’s are established.

5.1.2           BIA will include requirements for Recovery Time Objective (RTO) for departmental processes or operations to resume without impact any impact to agreed SLA’s.         

5.1.3           For Department RTO and SLA, ELT will agree on Risks to Accept and Risks to be mitigated by having a BCP plan for identified events.

5.1.4           For Operations, agree with the client on Risks to Accept and Risks where Infinit-O together with the client will create plans for mitigation of potential impact. This will include agreeing how costs would be billed to the client be it as part of the monthly recurring fee or a pass-through cost in time of activation.

5.2    Business Continuity Plan (BCP) – Admin

5.2.1           BCT will ensure the people in the Admin team will be available during events that trigger BCP to be activated

5.2.2           Finance and Facilities

5.2.2.1      Corporate Cards is issued by the company to BCT with guidelines on usage in case of emergency.

5.2.2.2      Agreements with partners are prearranged to allow seamless activation of BCP

5.2.2.3      Partners includes but not limited  banks, delivery services, hotels, hardware providers, telco and co-working sites

5.2.2.4      In case of an event VP for Finance and Admin and team will coordinate with partners to initiate BCP plans

5.2.3           Information Technology

5.2.3.1      Infinit-O IT team is enabled to deploy software and technology to Infinit-O machines during BCP.

5.2.3.2      As part of resiliency plans, sufficient number of machines are kept in the office in case there is a need to deploy computers to team members or remote sites.

5.3    Business Continuity Plan Operations

5.3.1           Infinit-O Business Continuity Plan (BCP) is designed based on jointly agreed plans as a result of the BIA for risk mitigation for specified events.

5.3.2           BCP should address any organizational, physical or security vulnerability that may compromise the confidentiality, integrity and availability of the company and/or client- supplied data and information.

5.3.3           The recovery plans include appropriate action items for different scenarios. These action items are identified, activated and implemented according to specified conditions and timelines.

5.3.4           Alternate approaches for resumption of work including remote work, working from other office buildings, etc., shall be identified for the affected teams.

5.3.5           BCP includes emergency, fallback, temporary operational and resumption procedures.

5.3.6           BCP should indicate how service restoration is prioritized.

5.4    Costs Related to Execution of BCP Plans

5.5    Billing Options

5.5.1           Option 1: Client will be billed monthly for the duration of the crisis

5.5.2           Option 2: BCP monthly billing surcharge of 1% to be added to SOW 

5.5.3           Option 3: Separate and distinct BCP SOW for customized BCP plans designed for specific clients (hot site, cold site, time-share in co-working sites)

Note: costs for remote worker lodging, meals, transportation, 25% hazard pay during the Covid-19 crisis was approximately $25 per day per person

5.6     Threat Monitoring – BCP Activation

5.6.1           IO Safety Officer(s) will be monitoring areas by geographic region in the Philippines where natural or man-made threat are posing risk to team members in the said location.

5.6.2           Current and Upcoming threats will be communicated to IO ELT with information on the following:

5.6.2.1      What is the threat? (fire, power outage, electricity outage, network outage or upcoming typhoon.)

5.6.2.2      Location of the Event

5.6.2.3      Accounts that may be impacted.

5.6.3           Upon identification VP CSG may activate BCP plans of respective accounts.

5.6.4           In the absence of a decision of VP CSG, the Senior Operations Manager and / or the Director for Operations can make a decision for accounts to go on BCP.

5.7    Resumption and Recovery Plans for People Assets

5.7.1           ELT is responsible for establishing a clear chain of command starting with the ELT for activation of BCP.

5.7.2           Each IO VP’s in the Philippines (Finance, CSG, People and Transformation) is responsible for planning and execution.

5.7.3           OM’s and departmental managers must ensure the fulfillment of chain of command planning by the VPs.

5.7.4           Each project team shall implement and maintain a basic communication plan for all their team members for emergency response and business continuity. Guidance on what constitutes a basic communication plan shall follow a standard to be developed and issued jointly by ELT and BCT. Confidentiality of team members’ personal contact information for this purpose shall be managed in compliance with the Infinit-O’s Security and Human Resources (HR) policies and practices.

5.7.5           OM’s shall identify the designated front-runners for each project teams and the alternate team members who perform functional responsibilities in the absence of the front-runners. Some team members may be required to work from remote offices or from home.

5.7.6           VP’s and OM’s shall work with HR to develop clear guidance on how team members shall work their time during a crisis. These team members may be directed to suspend their regular duties until the operations are restored at a permanent site or provide alternate direction.

5.8    Resumption and Recovery Plans for Facilities and Office Space

5.8.1           BCP Procedures contain the coordinated strategy involving plans, policies, procedures, and technical measures that enable the recovery of IT systems, operations, and data that is identified as critical. ELT shall also work with other teams that are responsible for development and maintenance of the technology and information that support critical business processes of Infinit-O.

5.8.2           ELT must provide a safe, easily accessible and operational location with adequate resources for the team members to report to and initiate operations during a disruption.

5.8.3           The alternate facility must have a power supply, Internet connection and phone lines to support efficient response during a crisis. The alternate facility must prove adequate office space and alternate communication links with the clients.

5.8.4           BCT shall ensure that the level of security controls at the main site is replicated in the alternate site.

5.8.5           For business restoration and permanent recovery, ELT shall work closely with BCT, IT and Shared Services Teams to coordinate the activities in restoring Infinit-O’s operations and ultimately returning to an original or transferring to a new permanent operating site.

5.9    Resumption and Recovery Plans for IT Systems

5.9.1           Infinit-O’s network architecture and telecommunications shall ensure redundancy and ability to cope with a disruption.

5.9.2           The company policy on Business Continuity Management Program is integrated in IT policies, budget and implementation decisions. IT budget guidelines shall take into account good practices concerning continuity planning and readiness.

5.9.3           For any new application development, BCP should be integrated in all phases of the IT project life cycle that includes Business Requirements, System Architecture, Design, Construction, Testing, Implementation, Maintenance and Retirement.

5.10 Testing

5.10.1       BCP should be tested at least annually to ensure credible recovery preparedness. ELT shall determine the scope, objectives, and measurement criteria of each test on a per event basis. Test results shall be shared with ELT.

5.10.2       The testing schedule and results are found in APPENDIX E of this document.

5.11 Corporate Communication

5.11.1       External communication during a time of crisis is very critical. VP-Client Solutions Group, Directors and Operations Managers are responsible for communicating with their respective clients.

5.11.2       HR shall be responsible for communicating with the Managers and Team Leaders who, in turn, will notify their respective team members.

5.11.3       HR must update the Team member directory quarterly.

5.12 Training

5.12.1       Business Continuity training all members of Infinit-O is essential for effective resumption and recovery of operations.

5.12.2       IO VP’s and OM’s shall ensure people are trained to keep current in business continuity and Infinit-O processes, latest technologies, international standards and regulations that guide the development and enhancements of the BCP.

5.12.3       Account specific testing plans will form part of the onboarding process for new hires and refresher training is to be conducted annually to ensure awareness and understanding of the BCP plan.

5.13 BCP Maintenance and Management Reporting

5.13.1       BCP shall be updated annually or as often as changes require. These changes may include acquisition of new equipment, key processes and systems, key team members and their contact numbers, business strategy, resources, suppliers and top clients.

5.13.2       All major updates should be incorporated as soon as possible and is not held to satisfy a pre-arranged schedule.

5.13.3       BCT shall report the status and progress of BCP during the Quality & Information Security Review Meetings with ELT after every test.

5.14 Policy Compliance

5.14.1       Consistent compliance with this policy is essential to its effectiveness. Infinit- O management and team members are expected to adhere to this policy and to follow it consistently.

5.14.2       BCT shall assess the preparedness of the organization and report to ELT during the Quality & Information Security Review Meetings with ELT every six (6) months or after every test. The assessment includes the qualifications of Infinit-O’s exposure, including but not limited to, the resumption of time-sensitive operations and recovery of project teams.

5.14.3       Periodic internal audit is conducted.

5.15Responsibility

5.15.1       ELT is responsible for the approval of the BCP policy, planning and governance. They are also responsible for provision of sufficient financial resources to address the identified requirements during a crisis.

5.15.2       BCT is responsible for disseminating the appropriate announcements to their subordinates and assist ELT and other admin teams in movement of action plans.

5.15.3       Business Continuity Team (BCT), who is composed of the Infinit-O VPs, OMs, IT and Shared Services Teams have the overall responsibility to create the specific plans to provide leadership and guidance that ensures the appropriate consistency, coordination and compliance among the team heads and team members.

5.15.4       IT Team (IT) is responsible for the security of machines and provision of IT resources during a disruption type that needs relocation. IT Team should ensure that any information unavailability/loss is at an acceptable level.

5.15.5       BCT is responsible for the activation of the BCP upon receipt of notice and approval from ELT. This team provides overall support to affected teams to ensure personnel safety and smooth execution of the BCP.

5.15.6       Infinit-O Safety Officer would be responsible for the following:

Monitor the calamities.

Notify ELT on the status of calamities, events and/or disruptions.

Release pertinent advisory to all VPs, Team Leaders, upon receipt of instructions from ELT.

5.15.7       ELT is responsible for activation of BCP outside the agreed plans with individual clients.

5.15.8       VP-Client Solutions Group

Is responsible for composing the email advisory as well as its release to all clients.

If email is unavailable, call all affected clients.

Operation Managers may assist if there’s time constraint.

5.15.9       F&A Team is responsible for the release of any required funds, when necessary.

5.15.10    SSP Team is in charge of provision of any required resources including the relocation area/s.

5.15.11    The IT Team is responsible for setting up offsite offices and restoration of services in the facilities.

6.0    Frequency

6.1    Testing – annually

6.2    Review – annually

6.3    BCP Activation – Adhoc

7.0    Distribution

7.1    Clients

7.2    BCT

7.3    ELT

8.0    Usage

8.1    Activation of BCP plans will be initiated by the BCT

8.2    Communication will be done via Facebook and Infinit-O Call Tree

Information of each team member is saved in a cloud-based system that allows Infinit-O to activate BCP and send an SMS blast to team member during events that would call for BCP to be activated. As designed for each account members will then be instructed via Facebook, Mobile Communication and SMS as to what the next steps would be.

8.3    Coordination will happen between BCT OM’s and Team Members in accordance with the agreed BCP plans created with each client that is based on the client business impact assessment.

8.4    If the event necessitating BCP is severe and unanticipated Infinit-O may opt to stop operations. This will only be called upon in cases where safety of our employees will be put at risk by continuing operations.

Force Majeure

The obligations of the parties shall be suspended to an extent and for the period that performance is prevented by force majeure. “Force Majeure” means acts of God, laws, regulations or orders of any government or governmental entities, judgments or orders of any court of competent jurisdiction, acts of war or conditions arising out of or attributable to war, whether declared or undeclared, riots, terrorism or other criminal activity, insurrections or rebellions, fire, explosions, earthquake, storm, flood, volcanic eruption, drought or other severe and unusual adverse weather conditions; accidents; or any other cause similar to the foregoing.

9.0    Events

9.1    Historical Events on Appendix B

9.2    Generic Plans per BCP event is detailed on Appendix C

APPENDIX A

Business Impact Analysis Template

Business Impact Analysis (BIA) and Risk Assessment Data Gathering Worksheet

Background

Department Overview

The following table captures key department characteristics that may influence the assignment of recovery objectives and the selection of recovery strategies. 

Impact Analysis and Recovery Requirements

The following table describes each department’s activity and the possible impact should it fail to operate.

Critical Records

The following table summarizes the various informational needs necessary to operate – both electronic and hard-copy. 

Key Threats, Vulnerabilities and Risk Treatment Options

The section of the BIA data gathering worksheet is used to “link” the department’s inputs to current-state business continuity risk mitigation efforts (controls), summarize alternate procedures and manual workarounds, estimate impact and likelihood of failure, and identify other possible risk treatments.

Loss of Key Roles/Personnel

The following table summarizes key roles and/or personnel in order to understand their importance and potential impact on department.

Loss of Key Facility or Equipment

The following table summarizes the facilities used and equipment needed for the operation of this department.

Loss of Key Technology

The following table summarizes the key technology (i.e. systems and applications) necessary for the operation of this department.

Loss of Key Supplies/Vendors

The following table summarizes the key supplies or services provided to the department that are necessary to maintain operations.

Recovery Requirements

The following tables summarize various resource requirements and when they are needed following the onset of a disruptive event.

Staffing Resource Requirements

The following table summarizes the quantities, work-from-home capabilities and recovery requirements for those key roles identified above.

Equipment/Supply Requirements

The following table summarized the quantities, offsite availability and recovery requirements for the key equipment and supplies identified above.

Ratings Definitions

Estimated Likelihood

Probable Impact