Disaster Recovery & Business Continuity Plan (DR & BCP) – Ensuring Service Stability

1. Introduction
   1. Net Onboard Sdn Bhd is committed to ensuring uninterrupted service availability, data protection, and operational resilience in the event of disasters, cyberattacks, or unforeseen incidents.
   2. This Disaster Recovery & Business Continuity Plan (DR & BCP) establishes:
      1. Preparedness strategies for mitigating service disruptions.
      2. Procedures for rapid recovery of systems and critical operations.
      3. Compliance with industry standards for disaster recovery and business continuity.
   3. This policy applies to:
      1. All cloud services, IT infrastructure, databases, and operational processes managed by Net Onboard.
      2. All employees, customers, vendors, and third-party service providers interacting with Net Onboard’s systems.
   4. This policy aligns with:
      1. ISO 22301 – Business Continuity Management System (BCMS)
      2. ISO 27001 – Information Security Management
      3. National Institute of Standards and Technology (NIST) Disaster Recovery Standards
      4. Bank Negara Malaysia (BNM) Risk Management Standards (for financial service clients)
2. Business Continuity Objectives & Risk Management
   1. Objectives of the Business Continuity Plan (BCP):
      1. Minimize downtime and ensure rapid recovery of IT systems, cloud services, and business operations.
      2. Safeguard customer data and maintain service availability during crises.
      3. Comply with regulatory requirements and industry best practices for business continuity.
   2. Risk Assessment & Disaster Scenarios Covered:
      1. Net Onboard has identified and prepared for the following high-impact risks:
         1. Cybersecurity threats (ransomware, DDoS attacks, hacking incidents).
         2. Natural disasters (floods, earthquakes, power outages).
         3. Hardware/software failures (server crashes, database corruption, data loss).
         4. Human errors or operational failures affecting cloud services.
3. Disaster Recovery (DR) Framework & Implementation
   1. Disaster Recovery Plan (DRP) Overview:
      1. A redundant infrastructure strategy is in place to ensure continuous operations across multiple data centers.
      2. Automated failover mechanisms allow real-time switching to backup systems in case of failure.
      3. Disaster recovery is tested quarterly to validate system resilience and recovery speed.
   2. Data Backup & Replication Strategy:
      1. Daily automated backups with geo-redundant storage in two separate data centers.
      2. Data retention period of 90 days for business-critical systems.
      3. AES-256 encryption for all stored and transmitted data to prevent data breaches.
   3. RTO (Recovery Time Objective) & RPO (Recovery Point Objective) Standards:
      1. Mission-Critical Systems (Cloud & Hosting Services)
         1. Recovery Time Objective (RTO): 1 hour
         2. Recovery Point Objective (RPO): 15 minutes
      2. Business Operations & Financial Systems
         1. Recovery Time Objective (RTO): 4 hours
         2. Recovery Point Objective (RPO): 1 hour
      3. Non-Critical Internal Systems
         1. Recovery Time Objective (RTO): 24 hours
         2. Recovery Point Objective (RPO): 12 hours
4. Business Continuity Plan (BCP) Implementation
   1. BCP Activation & Incident Management Process:
      1. The BCP is triggered in the event of service outages, security incidents, or operational disruptions.
      2. A dedicated Incident Response Team (IRT) is responsible for coordinating recovery and communication efforts.
      3. Stakeholders, customers, and regulators will be notified within 2 hours of a critical incident.
   2. Alternative Work Arrangements & Remote Operations:
      1. Employees are equipped with secure remote access and cloud-based collaboration tools.
      2. Business functions can transition to remote operations within 24 hours in case of facility disruption.
   3. Communication Plan & Stakeholder Updates:
      1. Customers will be updated via:
         1. Email notifications on service status.
         2. Public cloud service dashboards for live system updates.
         3. Dedicated customer support hotlines for high-priority cases.
5. Vendor & Third-Party Continuity Compliance
   1. Vendor Risk Management & Contingency Planning:
      1. All third-party vendors must comply with Net Onboard’s DR & BCP policies.
      2. Cloud and infrastructure vendors must maintain a 99.9% SLA uptime guarantee.
   2. Regular Vendor DR Audits:
      1. Annual disaster recovery tests are conducted to validate vendor compliance and risk management.
      2. Vendors failing to meet reliability standards may face contract termination.
6. Continuous Improvement & Testing
   1. Quarterly Business Continuity Drills:
      1. Tabletop exercises and simulation drills are conducted to test BCP effectiveness.
      2. Employees and technical teams participate in emergency response training.
   2. Post-Incident Review & Policy Updates:
      1. After any major disruption, a root cause analysis (RCA) is conducted to improve response strategies.
      2. The BCP is reviewed and updated annually to align with evolving risks and industry standards.
7. Enforcement & Non-Compliance Consequences
   1. Failure to comply with DR & BCP policies may result in:
      1. Service suspension or termination for vendors failing DR tests.
      2. Legal or financial penalties if non-compliance leads to business losses.
8. Governing Law & Dispute Resolution
   1. This policy is governed by Malaysian law, including:
      1. The Communications and Multimedia Act 1998
      2. Bank Negara Malaysia (BNM) Risk Management Framework
      3. Personal Data Protection Act (PDPA) 2010
   2. Disputes related to disaster recovery obligations will be resolved through mediation before arbitration or litigation.
9. Amendments & Updates
   1. Net Onboard reserves the right to update this Disaster Recovery & Business Continuity Plan (DR & BCP) at any time.
   2. Customers, partners, and vendors will be notified of material changes via email or system notifications.

For business continuity inquiries, contact [email protected].