1. Purpose and Relationship to Governing Documents
This Business Continuity Policy ("Policy") is published by VA WORKS, LLC ("Consultant") and forms part of the Governing Policies referenced in the Master Service Agreement (MSA), the MSA Terms and Conditions (https://vaworks.com/MasterServiceAgreement), and any applicable Scope of Work Terms and Conditions (https://vaworks.com/SOWSelection). In the event of conflict, priority shall be determined in accordance with the MSA.
The purpose of this Policy is to establish a framework for business continuity and disaster recovery to ensure uninterrupted service to clients in the event of a system failure, natural disaster, cyberattack, or other unplanned disruption.
2. Scope
This Policy applies to all personnel, systems, and business operations of Consultant, including remote team members and independent contractors performing services under an MSA or SOW.
3. Business Continuity Objectives
Consultant maintains the following objectives:
- Maintain operational readiness for remote personnel.
- Ensure secure access to Company systems when authorized.
- Preserve communication and task management through redundant channels.
- Minimize disruption and client impact during incidents.
4. Disaster Recovery Protocols
- Cloud Infrastructure: Consultant's operations rely on cloud-based systems with redundancy and high availability.
- Workforce Mobility: Personnel are equipped with remote-ready devices and have secondary access methods (e.g., mobile hotspots or alternate locations).
- Device Provisioning: Equipment may be provided either by Consultant or by Company under an executed agreement. In either case, personnel are trained on secure usage and backup access protocols.
- System Backup: All Consultant-issued devices utilize encrypted cloud backups. Sensitive data is not stored locally.
- Data Recovery: In case of device failure, personnel are instructed to recover access using secured credentials from alternate devices.
5. Emergency Communications Plan
- Internal alerts are issued through pre-established secure communication channels.
- Managers initiate personnel check-ins within one (1) hour of a disruption.
- Clients are notified of service impact and recovery estimates within four (4) hours, if applicable.
6. Client Responsibilities
Company remains solely responsible for maintaining its own business continuity and disaster recovery protocols with respect to its proprietary systems, virtual desktop environments, licensed platforms, and third-party software. Consultant does not control or manage such environments and is not liable for downtime, breaches, or failures arising within Company-owned systems.
Consultant's obligations under this Policy are limited to continuity of its own personnel, equipment, and internal processes necessary to deliver services under the MSA and applicable SOW(s).
7. Review Cycle
This Policy is reviewed annually by Consultant's leadership, or sooner if required due to a significant business change, client request, or real-world incident.