Business Continuity & Disaster Recovery Plan

Purpose

This plan establishes arrangements for maintaining essential operations during disruption and restoring services following an incident affecting The SEND Accountability Project Ltd.

Objectives

The organisation seeks to:

• Protect users and stakeholders.
• Protect information and records.
• Maintain critical services.
• Restore operations effectively.
• Support organisational resilience.

Critical Services

Priority services include:

• Website operations
• Family Hub
• Governance Hub
• Dashboard services
• CPD activities
• Email communications
• Data protection oversight
• Governance records

Potential Disruption Events

Disruption may result from:

• Website outage
• Hosting failure
• Cyber incident
• Data breach
• Loss of records
• Technology failure
• Internet failure
• Provider failure
• Unavailability of key personnel

Business Continuity Principles

The organisation shall:

• Assess incidents promptly.
• Prioritise critical services.
• Minimise disruption.
• Protect information assets.
• Restore services safely.
• Review lessons learned.

Website Outage Response

Actions may include:

• Contacting hosting providers.
• Identifying causes.
• Restoring services from backup.
• Communicating service updates where appropriate.

Data Incident Response

Actions may include:

• Immediate containment.
• Notification of the DPO.
• Risk assessment.
• Incident documentation.
• Regulatory notification where required.

Technology Failure

The organisation shall seek to maintain:

• Backup access arrangements.
• Recovery documentation.
• Secure storage of critical records.

Loss of Key Personnel

Should the Founder & Director become unavailable:

• Essential records should remain accessible.
• Governance documents shall remain secure.
• Priority services shall be maintained where possible.
• Activities may be temporarily reduced where necessary.

Information Security

Recovery arrangements shall align with:

• Data Protection Policy
• Information Security & Access Control Policy
• DPIA
• Organisational Risk Register

Recovery Priorities

Incident Review

Following significant incidents, the organisation shall review:

• Causes
• Responses
• Recovery actions
• Lessons identified
• Required improvements

Monitoring & Review

This plan shall be reviewed:

• Annually
• Following significant disruption
• Following technology changes
• Following governance review