Information Security and Continuity Management Plan

Simplebooklet Marketing Inc. | Effective December 10, 2024

View & Download

Effective Date: December 10th, 2024
Applies To: All employees, contractors, vendors, and systems at Simplebooklet Marketing Inc.

Purpose

This plan ensures that information security is maintained, and the organization can continue critical operations and protect sensitive data during a crisis or disaster.

Scope

This plan applies to all systems, networks, applications, and data managed or used by Simplebooklet Marketing Inc. It covers natural disasters, cyberattacks, system failures, and other crises that may disrupt normal operations.

Key Objectives

1. Ensure the confidentiality, integrity, and availability of information during a crisis.
2. Minimize disruption to critical business operations.
3. Provide a framework for rapid recovery and restoration of services.
4. Maintain compliance with legal, regulatory, and contractual obligations.

Pre-Crisis Preparations

1. Risk Assessment and Business Impact Analysis (BIA)

• Identify critical systems, applications, and data.
• Assess potential threats and vulnerabilities, including natural disasters, cyberattacks, and human errors.
• Determine the impact of various crises on operations.

2. Backup and Recovery

• Ensure regular backups of critical data, stored securely and offsite.
• Test backup and recovery processes periodically to ensure reliability.

3. Incident Response Plan (IRP)

• Develop an IRP with clear steps for identifying, containing, eradicating, and recovering from incidents.
• Define roles and responsibilities for the Incident Response Team (IRT).

4. Redundancy and Failover Systems

• Implement redundant systems for critical services.
• Use failover mechanisms (e.g., secondary servers, cloud-based infrastructure) to ensure availability.

5. Employee Training

• Train staff on emergency procedures, including secure communication protocols, reporting processes, and contingency workflows.

6. Vendor and Third-Party Coordination

• Ensure third-party service providers have their own disaster recovery and information security plans.
• Review and align service-level agreements (SLAs) to ensure continuity during crises.

During a Crisis or Disaster

1. Activation of the Crisis Management Team (CMT)

• The Crisis Management Team (CMT) will oversee and coordinate the response.
• Ensure communication channels remain secure and operational.

2. Incident Containment and Mitigation

• Isolate affected systems to prevent further damage.
• Prioritize actions to protect sensitive data and critical systems.

3. Secure Communication Protocols

• Use encrypted communication channels for sensitive discussions.
• Ensure employees, contractors, and stakeholders are informed of the situation and response plan.

4. Access Control Adjustments

• Restrict or modify access to sensitive systems to prevent unauthorized access.
• Monitor login attempts and other suspicious activities closely.

5. Data Integrity Checks

• Validate that critical data has not been compromised or corrupted.
• Use integrity verification tools as needed.

Post-Crisis Recovery

1. Service Restoration

• Prioritize the recovery of critical services and applications.
• Validate the functionality and security of systems before full operation.

2. Incident Analysis

• Conduct a root cause analysis to identify the source of the crisis.
• Document lessons learned to improve preparedness and response for future events.

3. Communication with Stakeholders

• Notify customers, partners, and regulatory bodies as required.
• Provide updates on the resolution and any preventive measures being implemented.

4. Data Reconciliation and Audit

• Ensure data integrity post-crisis through audits and reconciliation processes.
• Identify and address any data inconsistencies or losses.

Plan Maintenance and Review

1. Periodic Testing

• Test the crisis response plan annually or after major updates to infrastructure or processes.
• Simulate crises (e.g., tabletop exercises, disaster recovery drills) to evaluate the plan's effectiveness.

2. Plan Updates

• Review and update the plan annually or after a significant incident.
• Incorporate lessons learned and feedback from testing and real crises.

3. Documentation and Reporting

• Maintain detailed documentation of the plan, including response procedures, system inventories, and contact lists.
• Share reports on plan updates and test results with leadership.

Roles and Responsibilities

• Crisis Management Team (CMT): Oversee and manage response efforts.
• Information Security Team: Ensure security controls remain effective and implement mitigations.
• IT Team: Execute technical recovery efforts and maintain system availability.
• Management: Approve resources and communicate with external stakeholders.
• Employees: Follow protocols and report any security concerns or unusual activities.

Contact Information

Crisis Management Hotline: @kwasnicki (Slack)
Security Team Email: ken.kwasnicki@simplebooklet.com
IT Support: support@simplebooklet.com

Updated on: 08/09/2026