Disaster Relief Plan (DRP)

OVERVIEW
The DATABASICS Disaster Recovery Plan (DRP) provides for the full restoration of our services as quickly as possible in the event of a non-transitory disruption. Our DRP is part of an overall business continuity strategy that emphasizes avoiding disruptions in the first place.
Sources of non-transitory disruption risks include:

• Natural Disasters (storms, earthquakes, floods, wild fires, solar radiation etc.)

• Damage to infrastructure from fire, sprinklers, power fluctuations, structural failure

• Intentional human agency

• Human error

• Hardware failure

• Data lost.

RISK MITIGATION
The risks identified above fall into five mitigation categories: Co-location Data Center Providers, Application Security, Personnel Management, Redundancy and Back-up. DATABASICS specific mitigations not only lower risk probability but facilitate rapid recovery from a non-transitory disruption occurrence.

DATABASICS - DATA CENTER PROVIDERS
DATABASICS provides services through co-location agreements with two Data Center providers. Their facilities are at a sufficient distance from each other that focused catastrophic incidents such as an airplane crash or a terror attack would not be expected to affect both at the same time. Their locations are characterized by low seismic, hurricane and tornado activity, and are not threatened by flooding.

The facilities themselves are rated Tier 4. Features include:

• Recovery Time Objective (RTO): 30 min

• Fault-tolerant site infrastructure with electrical power storage and distribution facilities with expected
  availability of 99.995%.

• Built to withstand earthquakes, flooding, and other natural disasters

• Diesel generator runtime in excess of 9 days

• NCR on county Critical Infrastructure Restoration list to assure priority in fueling to extend the seven-day run time if required.

• Fire protection:
  o High sensitivity smoke detectors
  o Sprinklers = structure protection and building life safety.
  o Clean agents = business continuity and asset protection.
  o No water = no collateral damage or clean up.

• 10 ft. earth berm surrounding the entire campus with 150 ft. building set-backs.

• Compliant fencing, video monitoring, and electronic passage technology.

• Roving perimeter security guards and operating building security guards.

• U.S. Department of Defense-trained antiterrorism personnel on staff.

• Tiered Access Control Protocols–compliant and flexible to conform to all levels of established threat. conditions.

• Primary entrance processing point outside the protected berm.

• Isolated shipping/receiving and freight inspection facility.

• No vehicle traffic in the vicinity of data centers.

APPLICATION SECURITY
DATABASICS software is guarded against unauthorized access by industry-leading security products, strict coding controls, rigorous monitoring, and third-party testing and certification. DATABASICS is fully compliant with prevailing standards for protection of personal data, credit card information, ACH transmissions and the control of financial information processing.
PERSONNEL MANAGEMENT
DATABASICS checks the backgrounds of all employees. It maintains a written customer confidentiality and personal data policy. Regular briefings are conducted regarding emerging security issues. Personnel directly involved in disaster recovery are trained in the process and readiness is regularly tested-
REDUNDANCY AND BACK-UP
Redundancy is the core of DATABASICS disaster recovery/business continuity strategy. At every process level--hardware, communications, software, data centers, and key personnel--DATABASICS maintains at least dual, independent capability. Data backup is performed automatically within a data center and between data centers. This approach not only enables rapid recovery from data center incapacitation, but minimizes downtime from unplanned, transient events.
DATABASICS APPROACH TO BUSINESS CONTINUITY
When you first implement DATABASICS, we create a test/development site (Project Site) for you. The Project Site is used to configure and test your solution before you go live. When it’s time to begin production, we switch you to another site, your Production Site. The Project Site and Production Site run in separate data centers, managed by different vendors. The sites are sufficiently distant from each other that it would be highly improbable that an incident that would result in the incapacitation of one data center would bring down the other as well. The two sites share a common hardware/software/communications configuration. Production Site databases are synchronized with the Project Site every 12 hours. As a result, the Project Site is always ready to take over for the Production Site with minimal disruption.
In the event of a non-transitory disruption of service, DATABASICS uses state of the art technologies and monitoring systems to provide real-time notifications to our customers via email and phone and to DATABASICS’s Emergency Management Team (EMT). The EMT’s mission is to fully restore service as quickly as possible. It does this through the execution of DATABASICS Disaster Recovery Plan (DRP).

The DRP provides for the three-stage plan action summarized below:

PLAN OF ACTION

Open

STAGE 1: EVALUATION
The EMT evaluates the incident and, depending on its nature, decides whether to shift service from the Production Site to the Project Site. The probable duration of the service disruption is then estimated. With this estimate, the EMT directs DATABASICS Support to begin notifying our customers every 15 minutes with respect to status. Users of the service are redirected to a page that also provides status updates. If the incident is determined to be non-transitory requiring a shift to
the Project Site, the EMT proceeds to Stage 2. Email & Web Status updates will be issued every 15 minutes.

STAGE 2: RESTORE & RECOVERY SERVICE
In this stage, the EMT redirects traffic from the Production Site to the Project Site (DR Site). First the EMT brings all Project Site systems to a production-ready, operational state. Then it restores the individual services that comprise DATABASICS solutions in a predetermined order. If telephone communications have been affected, a backup phone and email system is activated.
Email & Web Status updates will be issued every 15 minutes. The Project Site will be inaccessible to customers during the restoration process.
Recovery Point Objective (RPO) <= 6 hours
Recovery Time Objective (RTO) <= 12 hours

Open

STAGE 3: RECOVERY & CONFIRMATION
The EMT, with DATABASICS Support, will verify that service have been restored. Logins are then enabled and notification of restoration is sent to the customers.
All customer issues and concerns regarding DATABASICS software should be addressed to support@data-basics.com and also status update will be available on our support site DATABASICS System Status Page.