Business Continuity & DR Policy

1 · Purpose

This policy ensures Nxt7a can continue or quickly restore critical operations and services after a disruptive event, and protect data and platform availability for clients.

2 · Scope

Applies to the people, systems, data and services critical to Nxt7a's operations and platform, including cloud infrastructure (Google Cloud, BigQuery, Firebase), key SaaS systems, and the Nxt7a app.

3 · Policy Statements

Resilience commitment. Nxt7a maintains arrangements to keep critical functions running, or to recover them within agreed timeframes, during and after disruptions – outages, data loss, cyber incidents, supplier failure, or loss of premises/people.

Business impact and objectives. Critical functions are identified and assigned recovery objectives – a Recovery Time Objective (RTO, how quickly to restore) and Recovery Point Objective (RPO, acceptable data loss). These are set per system and reviewed.

Backups. Critical data is backed up on a defined schedule, stored resiliently (including immutable/off-site copies where appropriate), and backups are periodically tested by restore.

Cloud resilience. We use the resilience features of our cloud platforms (redundancy, multi-zone where justified) proportionate to the criticality and cost.

Continuity plans. Documented plans cover how critical functions continue or recover, including roles, communications and dependencies. Plans address loss of key people and key suppliers, not only technology.

Testing. Continuity and recovery arrangements are tested periodically; results drive improvement.

Coordination with incidents. Where a security incident causes disruption, this policy operates alongside the Incident Response Policy.

4 · Roles & Responsibilities

• CEO approves continuity priorities and recovery objectives.
• Information Security Officer / CTO maintains and tests plans and backups.
• All personnel follow continuity instructions during a disruption.

5 · Compliance, Monitoring & Breach

Plan currency, backup success and test outcomes are monitored. Gaps are tracked to resolution.

6 · Related Documents

Information Security Policy · Incident Response Policy · Access Control Policy · Data Classification & Retention Policy.

7 · Standards Mapping

• B Corp: Governance.
• ISO/IEC 27001:2022: A.5.29 (security during disruption); A.5.30 (ICT readiness for continuity); A.8.13 (backup); A.8.14 (redundancy).

Review note. Set actual RTO/RPO targets per critical system; confirm any availability commitments in client contracts.

8 · Version History