Disaster Recovery BCP

Disaster Recovery & Business Continuity Plan

1. Purpose To ensure the continuity of MFC Safe’s operations and the protection of data and infrastructure in the event of major disruptions, disasters, or system failures. This policy defines the strategies, procedures, and objectives for disaster recovery (DR) and business continuity (BC).

2. Scope Applies to all systems, services, infrastructure, personnel, and processes supporting MFC Safe’s platform, including AWS-hosted services, MongoDB, Didge software components, gateways, and sensor networks.

3. Policy Objectives

• Minimize downtime and data loss in the event of disruption.

• Protect customer and operational data integrity.

• Enable rapid and structured recovery to normal operations.

4. Key Definitions

• RTO (Recovery Time Objective): Max time to restore system after disruption (Target: 4 hours for critical systems).

• RPO (Recovery Point Objective): Max data loss measured in time (Target: 1 hour for transactional systems).

5. Backup Strategy

• Daily automated backups of application databases (MongoDB Atlas) with 7-day retention.

• Weekly encrypted snapshots stored in geographically redundant AWS S3 buckets.

• Version-controlled codebase backups stored in Git repositories with cloud replication.

6. Infrastructure Redundancy

• Active-passive redundancy for core services hosted on AWS.

• Multi-AZ deployment configurations for production clusters.

• Use of AWS Route 53 for DNS failover and service redirection.

7. Disaster Recovery Plan (DRP)

• Trigger Identification: Monitored via automated alerts (AWS CloudWatch, MFC Alert System).

• Initial Assessment: IT and DevOps leads evaluate scope and severity.

• Failover Execution: Redirect services to backup instances or regions.

• Data Restoration: Load latest backup snapshot and validate service.

• Post-Recovery Review: Conduct root cause analysis and update documentation.

8. Business Continuity Measures

• Remote access protocols for critical staff.

• Daily health checks on infrastructure.

• Annual simulation exercises.

• Communication plans for customer and internal stakeholders.

9. Roles & Responsibilities

• Disaster Recovery Lead: Oversees plan execution.

• IT Team: Restores systems and data.

• Security Officer: Validates data integrity and compliance.

10. Review & Updates

• This policy is reviewed annually or after any significant incident.

11. Compliance References

• ISO 22301:2019 (Business Continuity Management Systems)

• ISO 27001 Annex A.17 (Information Security Aspects of BC & DR)