Our mission is to ensure information system uptime, data integrity and availability, and business continuity.

This plan aims to minimize interruptions to normal operations, limit the extent of disruptions and damage in disasters, and establish alternative means of operation in the event of emergencies.

Disruptions include product outages, internet outages, economic disruption, loss of key personnel, cyberattacks, and negative publicity. This policy affects all employees of this Nested Knowledge and its subsidiaries, and all contractors, consultants, temporary employees and business partners.

The following covers the types of disruptions planned for, the roles of key personnel in continuity planning and disruption response, the applications that could be disrupted, and the general strategies for ensuring business continuity.

• External Product outage
• File Share goes down
• Unplanned internet outage
• Data loss
• Hardware/software failures
• Economic disruption
• Recession
• Turnover of critical employees
• Cyberattacks
• Negative Publicity (Reputation)

• In the case of the loss of functionality to AutoLit or Synthesis for at 30 or more minutes, the CTO will be notified and we will send out a Site Disruption message to all users. The CTO and development team will assess the extent of any lost capabilities and timeline to restoration, and then communicate with company leadership regarding a recovery plan of specific functions.
• In the case of the loss of functionality to any other key/critical applications, the CTO will be notified; Site Disruption messages will only be sent to users in the case that this impacts end user functions. In consultation with company leadership, the CTO and development team will create a plan to either restore function or shift to a different software provider.
• In case of outages, the CEO or another leader will email account representatives for customers with a proposed restoration timeline and details regarding the outage.

• Our finances are based on private funding and revenue. Our costs are based on already-negotiated contracts with employees and contractors. We would be open to federal support (such as the Payroll Protection Plan) or bank loans, but should not need to dramatically alter financing in a recession.

• In the event that Nested Knowledge loses our CTO, we will elevate our head engineer to replace the duties and hire an additional engineer as soon as feasible.
• In the event that Nested Knowledge loses our COO, we will hire an already trained Operations Manager and Bookkeeper to aid with record keeping and financial operations.

All Employees and Contractors who access Nested Knowledge’s information systems will be provided with and required to review this document. Personnel with central roles in business continuity planning will undergo annual training to ensure competence with business continuity procedures.

In the event of imminent bankruptucy or closing of services, Nested Knowleedge will provide clients with 90 days to export data from the Nested Knowledge application. In the event of an acquisition, clients will continue to have access to their data and functionality.

The goal of the BIA is to provide a framework for evaluating business activities and their associated resource requirements to determine how critical they are for business operations. The BIA quantifies the impacts of disruptions on service delivery, risks to service delivery, and recovery time objectives.

This plan applies to Nested Knowledge employees and contractors.

The BIA is composed of:

Identify the impact of a system disruption to critical business processes

Determine resources required to resume business processes as quickly as possible. Examples of resources that should be identified include facilities, personnel, equipment, software, data files, system components, and vital records.

Establish priority levels for recovery activities and resources.

The BIA should:

• Undergo scheduled review for applicability and appropriate criticality, resourcing, and prioritization.
• Unless determined otherwise, the BIA will be reviewed annually, starting in 2022.
• Undergo changes with major changes to the business or its products, including but not limited to the launch of a new software product, an integration with an existing software product, or the creation of any new services based on the product.
• Undergo changes with major changes to the ownership or oversight, including but not limited to acquisition, joint venture, or transfer of 51% of the voting shares in the company.

Recovery Time Objective (RTO) and Recovery Point Objective (RPO) RTO defines the maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources, supported mission/business processes, and the MTD. Determining the information system resource RTO is important for selecting appropriate technologies that are best suited for meeting the MTD.

For any cause: 48 hours. This estimate represents the RTO for a worst-case failure (permanent outage & transfer off of our current cloud provider), plus an 8 hour Work Recovery Time (WRT) verifying the new system.

Nested Knowledge will perform a Business Impact Analysis on an annual basis, beginning in the first quarter of 2022.

This document explains Nested Knowledge's procedure for mitigating disruption of product and services delivery when disruption due to disaster occurs. In the event of an actual emergency situation, modifications to this document may be made to ensure physical safety of our people, our systems, and our data.

This policy affects all employees and contractors of Nested Knowledge.

There are many potential disruptive threats which can occur at any time and affect the normal business process. We have considered a wide range of potential threats and the results of our deliberations are included in this section. The focus here is on the level of business disruption which could arise from each type of disaster.

The disaster recovery team consists of Kevin Kallmes, Karl Holub, Kathryn Cowie. In the event of an emergency, the team's responsibilities include:

• Respond immediately to a potential disaster and call emergency services
• Assess the extent of the disaster and its impact on the business.
• Notify employees and allocate responsibilities and activities as required
• Restore critical services within four business hours of the incident.
• Recover to business as usual within 8 to 24 hours after the incident

The person discovering the incident should call or email a member of the Emergency and Disaster Recovery Team immediately.

Managers will serve as the focal points for their departments, while designated employees will call other employees to discuss the crisis/disaster and the company’s immediate plans. Employees who cannot reach staff are advised to call the staff member’s emergency contact to relay information on the disaster.

If the incident has resulted in a situation which would cause concern to an employee’s immediate family such as hospitalization of injured persons, it will be necessary to notify their immediate family members quickly.

If applicable, assigned staff will coordinate with the media, working according to guidelines that have been previously approved and issued for dealing with post-disaster communications.

As a mitigation of financial risk, legal exposure, data privacy breach, and other key company functions, the company will maintain the following insurance policies:

• General Business / Professional Liability Insurance
• Network Security and Privacy Liability Insurance
• Cyber Crime Insurance
• System Damage and Business Interruption Insurance

The emergency response team shall prepare an initial assessment of the impact of the incident on the financial affairs of the company. The assessment should include:

• Loss of financial documents
• Loss of revenue
• Theft of check books, credit cards, etc.
• Loss of cash

The immediate financial needs of the company must be addressed. These can include:

• Cash flow position
• Temporary borrowing capability
• Upcoming payments for taxes, payroll taxes, Social Security, etc.
• Availability of company credit cards to pay for supplies and services required post- disaster.

The company lawyer and Emergency and Disaster Response Team will jointly review the aftermath of the incident and decide whether there may be legal actions resulting from the event; in particular, the possibility of claims by or against the company for regulatory violations, etc.

On an annual basis, the executive and engineering management teams will independently develop a set of 10 potential disruptive and disaster scenarios to our product, resources, and external dependencies. 5 scenarios will be randomly selected with the scenario moderator acting as moderator for each exercise. The moderator will accept planned actions & team-level assignments and return outcomes, optionally adding in modifying information or new developments.

Scenarios are carried forward year to year.

Return to Policies