BUSINESS CONTINUITY & DISASTER RECOVERY POLICY

This Policy establishes the framework for maintaining critical business services and recovering systems, data and operations following disruption, disaster, cyber incident, technology failure, partner outage or other material event affecting CYBERVED AI PRIVATE LIMITED.

• Protect customers, employees, information and critical business operations.
• Reduce downtime and operational impact.
• Define recovery priorities and responsibilities.
• Maintain appropriate backup and recovery arrangements.
• Coordinate with PPI, banking, payment and technology partners.
• Test and improve continuity capabilities.

This Policy applies to critical business processes, employees, facilities, applications, APIs, cloud infrastructure, transaction systems, customer support, payment/voucher operations, data and critical third-party services.

• Cyber-security incident
• System or application failure
• Cloud/infrastructure outage
• Power or connectivity failure
• Natural disaster
• Fire or physical disruption
• Critical vendor/partner outage
• Data loss or corruption
• Pandemic or workforce disruption
• Other material operational event

Critical processes shall be assessed for customer impact, financial impact, regulatory/contractual impact, dependency, recovery requirements and acceptable downtime.

• Customer account and support services
• Payment and transaction processing
• Gift-card/voucher issuance and status systems
• Settlement and reconciliation
• Fraud and security monitoring
• Partner/API connectivity
• Core data and records

Recovery shall prioritise services according to business criticality, customer impact, security considerations, legal/regulatory obligations and operational dependencies.

For critical systems, appropriate recovery time and recovery point objectives should be defined based on risk, technical capability, partner arrangements and business requirements.

• Critical data shall be backed up according to business requirements.
• Backup access shall be restricted.
• Backups should be protected against unauthorised alteration or deletion.
• Recovery procedures shall be periodically tested where appropriate.

Depending on the nature of the disruption, recovery may involve restoration from backup, failover to alternate infrastructure, temporary manual procedures, partner-based continuity arrangements or other approved recovery measures.

1. Identify and assess the disruption.
2. Determine whether continuity activation is required.
3. Notify responsible management and response teams.
4. Prioritise critical services.
5. Activate recovery procedures.
6. Communicate with affected stakeholders.
7. Restore and validate services.
8. Close activation and conduct post-event review.

Management shall coordinate material disruptions, prioritise business decisions, approve external communications and ensure appropriate stakeholder coordination.

During a material disruption, communications shall be coordinated through authorised personnel. Customer, partner, employee and regulatory communications shall be accurate, timely and appropriate to the situation.

Critical vendors and PPI/bank/payment partners shall be considered in continuity planning, including contact information, dependencies, alternate arrangements and escalation paths where available.

Where automated services are unavailable, approved temporary manual or alternate processes may be used when secure and operationally feasible. Such activities shall be documented and reconciled after restoration.

Recovered data shall be checked for integrity, completeness and consistency before being used for critical operations.

Cyber-related disruptions shall be managed jointly with the Cyber Incident Response & Cyber Fraud Policy and Information Security & Cyber Security Policy.

Payment, settlement and reconciliation dependencies shall be incorporated into continuity planning to reduce customer and financial impact during outages.

Critical roles shall have designated backups or alternate arrangements where practical. Essential contact lists shall be maintained securely.

Where necessary, approved alternate working arrangements may be activated, subject to information-security, privacy and access-control requirements.

• Backup restoration tests
• System recovery tests
• Tabletop exercises
• Communication tests
• Partner escalation tests
• Scenario-based continuity exercises

Test results shall document scope, date, participants, findings, recovery performance, gaps and corrective actions.

After a material disruption, the Company shall review the event, identify root causes and implement corrective or preventive actions.

Continuity plans, recovery procedures, test results, incident records, contact lists and corrective actions shall be retained according to applicable requirements.

Continuity plans shall be updated following material technology, process, partner, office, staffing or business changes.

Exceptions to continuity requirements shall be documented, risk-assessed and approved by authorised management.

This Policy shall be reviewed at least annually and following a material disruption, significant test finding, major system/partner change or material change in applicable requirements.