BUSINESS CONTINUITY PLAN

FOR
REQUEST FOR PROPOSAL

PROVISION OF ORACLE M7 & M8 SUPERCLUSTER HARDWARE

SUPPORT CONTRACT
BY

ATLANCIS TECHNOLOGIES LIMITED

Atlancis Technologies Limited, 5th Floor, Top Plaza, Kindaruma Rd, Off Ngong Rd. Kilimani, Nairobi.

Phone: +254 (020) 5132 100 Website: http://www.atlancis.com, Email:

servicedeliveryteam@atlancis.com
Disclaimer: The information contained in this document is confidential information. Its purpose is
to communicate the details of Atlancis Limited. All information is to be kept confidential and used
only to determine the feasibility and acceptability of the proposed solution. This document is the
property of, and is proprietary to Atlancis. It is not to be disclosed in whole or in part without
the express written authorization of Atlancis, shall not be duplicated or used, in whole or in part
for any purpose other than to evaluate Atlancis’s proposal.

©2019
Page 2 of 17 Atlancis Technologies Ltd Is ISO 9001:2015 Certified
Contents
1. PREFACE ..................................................................... 4

2. INTRODUCTION ................................................................ 4

3. OBJECTIVES OF THE PLAN ...................................................... 4

4. KEY ELEMENTS: RESILIENCE, RECOVERY AND CONTINUITY ........................... 5

5. OFFSITE DATA STORAGE ........................................................ 5

6. READINESS PLAN .............................................................. 6

7. RISK MANAGEMENT AND CONTROL ................................................. 7

a) RISK MANAGEMENT ............................................................. 7

b) BUSINESS CONTINUITY MANAGEMENT .............................................. 7

c) BUSINESS CONTINUITY MANAGEMENT PROCESS ...................................... 8

8. COMMUNICATIONS .............................................................. 9

9. HELP DESK SUPPORT .......................................................... 11

11. DISASTER AND EMERGENCY PREPARATION ....................................... 13

12. DISASTER PROCEDURES CHECKLIST ............................................ 15

Page 3 of 17 Atlancis Technologies Ltd Is ISO 9001:2015 Certified

1. PREFACE
The purpose of this plan is to define the recovery process developed to restore
critical business functions. The plan components detail procedures for responding
to an emergency situation, which affects ability to deliver core services to our
customers or our ability to meet investors, legal or regulatory requirements.

2. INTRODUCTION
Business Continuity and Disaster Recovery (BCDR or BC/DR) are closely related
practices that describe an organization's preparation for unforeseen risks to
continued operations. The trend of combining business continuity and disaster
recovery into a single term has resulted from a growing recognition that both
business executives and technology executives need to be collaborating closely
instead of developing plans in isolations.

Business continuity is the processes and procedures an organization must put in

place to ensure that mission-critical functions can continue during and after a
disaster. In this sense, the concept is interchangeable with Disaster recovery
plan (DRP). Atlancis proposes a Business continuity that shall address more
comprehensive planning that focuses on long term or chronic challenges to
organizational success.

Potential business continuity problems may include the illness or departure of

key team members, supply chain breakdowns, catastrophic failures or critical
malware infections.

Atlancis shall work with CO-OPERATIVE BANK to implement a Business continuity

strategy that give the ability to CO-OPERATIVE BANK as an organization to maintain
essential functions during, as well as after, a disaster has occurred. Atlancis
shall document risk management processes and procedures that aim to prevent
interruptions to mission critical services and re-establish full function to the
organization as quickly and smoothly as possible.

3. OBJECTIVES OF THE PLAN

 Facilitate timely recovery of core business functions
 Protect the wellbeing of our employees, their families and customers
 Minimize loss of revenue/customers
 Maintain public image and reputation
 Minimize loss of data
 Minimize the critical decisions to be made in a time of crisis

Page 4 of 17 Atlancis Technologies Ltd Is ISO 9001:2015 Certified

 4. KEY ELEMENTS: RESILIENCE, RECOVERY AND CONTINUITY
Atlancis Technologies limited shall implement a business continuity plan that has
three key elements: Resilience, recovery and contingency:

 Atlancis has designed its solution that enables CO-OPERATIVE BANK as a company to
increase resilience by designing critical functions and infrastructures with various
disaster possibilities in mind; this data redundancy across entire infrastructure
and maintaining a surplus of capacity. Ensuring resiliency against different
scenarios can will also help businesses maintain essential services on location and
off-site without interruption.
 Rapid recovery to restore business functions after a disaster is crucial. Setting
recovery time objective for different systems, networks or applications is paramount
in our design which shall help prioritize which elements need to be recovered first.
Other recovery strategies include resource inventories, agreements with third
parties to take on company activity e.g. back-to-back hardware support with vendors
and using converted spaces for mission-critical functions.
 Atlancis shall discuss during pre-implementation and shall agree with CO-OPERATIVE
BANK, put in place the contingency procedures for a variety of some scenarios that
can include a chain of command that distributes responsibilities within Atlancis as
vender and the CO-OPERATIVE BANK as an organization. These responsibilities can
include hardware replacement, leasing emergency office spaces, damage assessment
and contracting third-party vendors for assistance.

5. OFFSITE DATA STORAGE

Backup data facilities have been identified at the following location:

 Name of company:
 Main contact:
 Phone number:
 Email address:
 Street address:
 City:

The identified location of the backup site will be accessible for a minimum
period of six (6) weeks from initial date of occupancy after disaster
declaration. It will be available for 24-hour access and retrieval and be
protected by: security, fire suppression, water detectors, heating, air and
ventilation.

Page 5 of 17 Atlancis Technologies Ltd Is ISO 9001:2015 Certified

 CO-OPERATIVE BANK will have access to the backup site facility within 3
hours after notification and guaranteed occupancy shall be at least six (6)
weeks.

This storage facility will be reviewed for effectiveness annually.

Offsite storage process will include, but is not limited to, the following. All
documentation of importance to the operations of CO-OPERATIVE BANK will be
stored via this backup site.

 Backup Tapes - Weekly tape backups of ALL your disk files. These include:
Engineered systems, mid-range, servers and PCs (mandatory and with at least
two generations)
 System, program product, and in-house developed software manuals and guides
 Legal - Copies of contracts, leases, legal and critical correspondences
 Insurance – Policies, riders, and addendums
 Financial - General and private ledgers, year-end financial statements, tax
returns, bank records
 Recovery Plans - A complete set
 Assets - Complete fixed asset listings
 Referenced Items - Copies of any item referenced within your recovery team
plans
 Floor plans
 Architectural drawings that should include mechanical plans
 Photos of facility and various work areas
 Other critical documents or data critical to the operation of your business

6. READINESS PLAN
Atlancis relies on CO-OPERATIVE BANK to provide us certain equipment,
supplies, materials, goods or services. Some of these are considered
more critical than others.

To minimize our potential exposure to a disruption by CO-OPERATIVE

BANK there are several steps provided to take in advance:

Atlancis will avoid a single source (sole source) provider of any equipment,
supplies, materials, goods or services. That is, Atlancis will always have
at least two vendors that can provide each of our critical goods and
services required to support our business.

Page 6 of 17 Atlancis Technologies Ltd Is ISO 9001:2015 Certified

7. RISK MANAGEMENT AND CONTROL
Risk and business continuity management is evidenced by integrating risk
identification, risk management and consistent reporting into everyday operations.

The objectives of risk management and business continuity planning are to:

 protect stakeholders from adverse incidents

 reduce risk exposure; mitigate and control loss
 agree on a level of acceptable risk
 ensure the ongoing capacity of the project to achieve its objectives, and to
perform its functions of providing quality service
 reduce the costs of risk
 Protect the stakeholders from loss.

This document provides policy and guidance in identifying, assessing, recording and
treating risks that could impact upon the project and as appropriate, policy and
guidance in the development of business continuity planning.

a) RISK MANAGEMENT
Project manager will:

 identify and assess risks

 develop treatment plans
 monitor and record risks within the risk management system
 Communicate risks to staff, as appropriate.

b) BUSINESS CONTINUITY MANAGEMENT

Project manager will, as appropriate:

 conduct a Business Impact Analysis that identifies the maximum acceptable

outage which lead to critical functions to be reinstated following a major
incident;
 document the Business Impact Analysis in a Business Continuity Management
Plan;
 review the Business Impact Analysis at least every 12 months;
 review and update the Business Continuity Management Plan at least every 12
months;
 conduct exercises on a regular basis to test or validate the plans
 draft the Business Continuity Management Plan that, includes:
 strategies; requirements and procedures for continuity of critical
functions
Page 7 of 17 Atlancis Technologies Ltd Is ISO 9001:2015 Certified
  All resource requirements to support the continuity of identified
functions.

c) BUSINESS CONTINUITY MANAGEMENT PROCESS

Business Continuity Management (BCM) is an integral component of Risk Management. The
BCM program addresses major risk events with the potential to significantly impact
upon the ability to deliver critical services. It positions the project to respond
to any eventualities including damage to property and persons, service interruption,
financial loss, image and reputation loss and situations that impact on project
performance.

STEP 1 - PROGRAM MANAGEMENT

Development of the agency’s overall Risk Management Program requires the formation
of a Risk Management Steering Committee (ideally), an overarching BCM Policy document
and a BCM implementation schedule.

STEP 2 - RISK AND BUSINESS IMPACT ANALYSIS

This step prioritizes the business activities that are time critical and identifies
the resources that are required to support these activities for business continuity
purposes. This involves assessing the potential business impact on the project,
should key business activities be interrupted, determining the timeframes within which
these business activities are to be resumed, and identifying the resources required
for business continuity. The key deliverables are a list of critical business
activities and their corresponding maximum acceptable outage times, and a list of
business continuity resource requirements.

STEP 3 - IDENTIFY RESPONSE OPTIONS

This step involves the identification and assessment of response options to meet
project requirements for business continuity, covering people, IT systems and
networks, premises and facilities, and data backup and offsite storage. The key
deliverables are response options with supporting justifications (pros, cons, and
costing) and a recommendation on the most appropriate option.

STEP 4 - DEVELOP RESPONSE PLAN

This step involves putting in place a response team structure, developing processes
for incident notification and escalation, and documenting the business continuity
action plans. This is also when implementation of the response option is carried
out, such as procurement of backup equipment and commissioning of alternate

Page 8 of 17 Atlancis Technologies Ltd Is ISO 9001:2015 Certified

facilities. The key deliverables are response teams, business continuity action plans
and facilities for business continuity.

STEP 5 - TRAIN, EXERCISE AND MAINTAIN

This step ensures that what has been developed and documented will actually work to
continue delivering critical business activities when a crisis arises. This involves
training relevant employees on the use of the Plan, conducting exercises to validate
the completeness and accuracy of the Plan, and putting in place a schedule for the
on-going maintenance of the Plan. The key deliverables are schedules for training,
testing and maintenance, and the actual conduct of these activities.

8. COMMUNICATIONS
Communications are key within Atlancis’s business environment. A three-prong
approach will be utilized:

 Key Atlancis’s personnel call list

 Identified CO-OPERATIVE BANK for offsite call center operations

 Identified Internet service provider for recovery of communications and

equipment repair/replacement

CO-OPERATIVE BANK will supply offsite call center capabilities to handle

incoming calls. This offsite communications facility will be reviewed for
effectiveness annually.

Main Contact:

Mobile Number

CO-OPERATIVE BANK will provide communication recovery establishing a new

core communications center and equipment. This communication recovery vendor
will be reviewed for effectiveness annually.

Vendor Name:

Phone:

Email address:

Page 9 of 17 Atlancis Technologies Ltd Is ISO 9001:2015 Certified

Act:

Mobile Number:

Page 10 of 17 Atlancis Technologies Ltd Is ISO 9001:2015 Certified

9. HELP DESK SUPPORT
HELPDESK support will facilitate the resolution of Client concerns and
problems as quickly as possible. The HELPDESK will provides a central point
of contact to ensure that all calls are followed up and problems resolved.

Calls that cannot be solved by the HELPDESK on an immediate basis will be

distributed to personnel experienced in the specific applications.

Objectives
 Facilitate the rapid resolution of Client problems through a single
point of contact;
 Maintain a historical log of the support provided to each Client;
 Identify user sites that are experiencing difficulty with a particular
application;
 Track the type of problems encountered for each application;
 Uncover recurring problems and assist in planning a corrective course
of action;
 Generate statistics, such as the number and type of calls by
application.

Hours of Operation
HELPDESK hours of operation are 0800 to 1730 East African time, Monday to
Friday excluding all Statutory Holidays

Call Priorities and Action

HELPDESK calls are assigned a Priority code to indicate the severity of the
problem.
The priority system is as follows:
1. SERIOUS Production stopped. No workaround. Escalation to Service
Delivery Engineer within 60 min. First update to Client within 2 hours
2. PROBLEM Production affected. Workaround available. Escalation to Service
Delivery Manager within 90 min. First update to Client within 4 hours.
Further updates as required.
3. TRAINING Call forwarded to Account Manager to schedule Training.
4. INFORMATION REQUEST Respond to Client within 24 Hours.

Page 11 of 17
 NB: The update to the Client is a means to communicate to the Client about
actions and progress towards finding a solution to the problem. Some problems
may take longer to diagnose and resolve.
HELPDESK Contact
Clients can submit HELPDESK queries by:

Emailing to: servicedeliveryteam@atlancis.com or

Calling: +254 (020) 5132 100

10. INDUSTRIAL DISPUTE

Industrial dispute is any dispute or difference between employers and
employers, or between employers and employees, or between employees and
which is connected with the employment or non-employment or the terms of
employment or with the conditions of labor, of any person.

Resolution of Disputes

Industrial dispute will be resolve amicably by direct informal negotiations

on any disagreement or disputes arising under or in connection with the
contract. Any dispute which arises between the parties shall be referred to
a joint committee of a director of each party or alternates appointed by
them who shall resolve the dispute within thirty (30) days of the dispute
having been referred to them. Should the joint committee fail to meet within
15 days of notification of a dispute or be unable to resolve a dispute in
accordance with the foregoing such dispute will be submitted to and decided
by arbitration under this clause. Subject to the above any dispute arising
from or in connection with this Agreement shall be referred to arbitration
by a single arbitrator to be appointed by agreement between the parties or
in default of such agreement within thirty (30) days of notification of a
dispute upon the application of either Party by the Chairman for the time
being of the Chartered Institute of Arbitrators, Kenya Branch. Such
arbitration shall be conducted in Nairobi in accordance with the rules of
arbitration of the said Institute and subject to and accordance with the
provision of the Arbitration Act 1995 or any modifications thereof. To the
extent permissible by law the determination of the arbitrator shall be final
and binding upon the parties. Nothing in this Clause shall prevent any Party
from obtaining interim relief in a court pending the outcome of the
arbitration

Page 12 of 17
11. DISASTER AND EMERGENCY PREPARATION
All employees will review disaster preparation and emergency action plan
procedures with their Department Heads.

New employees will be introduced to our emergency action plans via employee
orientation.

Mock disaster training will be conducted annually and will involve local
police and fire authorities.

Quarterly training will approach a walk through to functional drills to

an evacuation drill leading to full-scale mock disaster training.

 Walk-Through Drill -- The Business Contingency Planning Team,

Department Heads and Recovery Teams will perform their emergency
response functions.
 Functional Drills -- These drills will test specific functions such
as medical response, emergency notifications, warning and
communications procedures and equipment, though not necessarily at
the same time. Facility shutdown procedures will be tested, reviewed
and modified as needed. Personnel are asked to evaluate the systems
and identify problem areas.
 Evacuation Drill -- Personnel walk the evacuation route to a
designated area where procedures for accounting for all personnel
are tested. Participants are asked to make notes as they go along
of what might become a hazard during an emergency, e.g., stairways
cluttered with debris, smoke in the hallways. Plans are to be
modified accordingly.
 Full-Scale Exercise -- A real-life emergency situation is simulated
as closely as possible. This exercise involves company emergency
response personnel, employees and management, and community response
organizations.

Page 13 of 17
Page 14 of 17
 12. DISASTER PROCEDURES CHECKLIST
Action By whom Comments Check

when done

Receive Communication on
1. emergency Bus Cont log time

situation Planning Team

Leader

2. Contact Atlancis ] Business Bus Cont log time

Contingency Planning Team and Planning Team

Department Team Leader Leader

Contact temporary facilities

site and alert them that
3. disaster may be declared. Bus Cont

Planning Team

Leader

4. Assess Damage Bus Cont Network

Planning Team Equipment

& Dept Heads Building

Employees

5. Estimate Length of Outage Bus Cont Length of outage

Planning Team < 1 Hour

> 1 Hour - ,< 2

& Dept Heads hours

> 2 hours, <12

hours

>12 hours, < 24

hours

Page 15 of 17
 >24 hours, <48
hours

>48 hours

Unknown

6. Estimate Business Risk Bus Cont

Planning Team

& Dept Heads

Make Decision. If no declaration

7. then Bus Cont

contact the temporary facilities

site and Planning Team

inform them alert is over If

decision is to declare, proceed
to step & Dept Heads

Declare Disaster, notify

8. Executive Team Business Log time

immediately and declare disaster

at site operations Contingency

Planning Team

Notify Emergency Response Team

9. Leader Mgmt Team Log time

identified in Emergency
Notification List LEADER

10
. Activate Command Center Business Log time

Contingency

Planning Team

11
. Report to Command Center Business Log time

Page 16 of 17
Contingency

Planning Team

Page 17 of 17