efficient benefit consulting fsp 48026 business continuity...

93

EFFICIENT BENEFIT CONSULTING – FSP 48026 Business Continuity Plan

1

EFFICIENT BENEFIT CONSULTING

BUSINESS CONTINUITY PLAN

Effective Date: 10 April 2018 March 2018

Business Continuity Plan - EFBC

CONTENTS:

Introduction ..................................................................................................................................................... 2

Scope .............................................................................................................................................................. 2

Aim and Objectives ......................................................................................................................................... 2

Business Description ...................................................................................................................................... 3

Purpose and Policy ......................................................................................................................................... 3

Plan approval, review, location, disbursement ............................................................................................... 4

Key personnel ................................................................................................................................................. 6

Emergency contact persons ........................................................................................................................... 6

Office location ................................................................................................................................................. 8

Operational and financial assessments in the event of a SBD ...................................................................... 9

Critical systems and Recovery Scenarios .................................................................................................... 10

Succession plan ........................................................................................................................................... 10

Communication of SBD to other parties ....................................................................................................... 11

Disclosure of business continuity plan.......................................................................................................... 13

ANNEXURE A – RISK RATING AND SCENARIO ANALYSIS .................................................................. 14

ANNEXURE B – SAMPLE BUSINESS CONTINUITY PLAN DISCLOSURE STATEMENT ..................... 19

ANNEXURE C – IT DISASTER RECPVERY PLAN.................................................................................... 20

2

1. BUSINESS CONTINUITY PLAN

1.1 Introduction:

The purpose of this business continuity plan is to prepare Efficient Benefit Consulting (PTY) LTD

(hereinafter referred to as “the company”) in the event of business disruption caused by

unforeseen circumstances e.g., Natural disasters, Man-made events, Disease, Earthquakes, Fire,

Floods, Cyber-attacks, Utility outages (Water, Banking, Power, and Telecommunications),

Reputational damage, Political Unrest as well as Terrorism, and to restore services to the widest

extent possible in a minimum time frame.

It is expected to implement preventive measures whenever possible to minimise network failure

and to recover as rapidly as possible when a failure occurs.

1.2 Scope:

The scope of this plan is limited to the company’s existing operations and to risks that can

reasonably be expected to occur.

1.3 Aim and Objectives:

1.3.1 The aim will be to identify key processes involving staff, systems, interfaces to other companies

and communications, and measures to insure business continue as usual in emergency, or to

recover business operations as quickly as possible.

The objectives of this plan include the following:

1.3.1.1 To serve as a guide for the responsible persons in terms of business continuity

1.3.1.2 To ensure the health and safety of all staff

1.3.1.3 To minimize interruptions to the organization’s ability to provide its products and services

1.3.1.4 To minimize financial loss

1.3.1.5 To resume critical operations within specified time after the disaster

1.3.1.6 To preserve and maintain relationships with clients

1.3.1.7 To mitigate negative publicity

1.3.1.8 To prevent/minimize reputational damage

1.3.1.9 To identify vendors and customers that must be notified in the event of a disaster

1.3.1.10 To assists in avoiding confusion experienced during a crisis by documenting, testing and

reviewing recovery procedures

1.3.1.11 To identify alternate sources for supplies, resources and locations

1.3.1.12 To document storage, safeguarding and retrieval procedures for vital records

3

2. BUSINESS DESCRIPTION:

2.1 The Company is a registered financial services provider with FSP no 48026 that transacts

business in the following license categories:

2.2 The Company provides advice and intermediary services by making direct or indirect

recommendations to clients or by providing research or opinions on financial services and by

providing the associated intermediary services and support. The Company is compensated for

providing this analysis and advice. The FSP services institutional clients only.

3. PURPOSE AND POLICY:

Efficient Benefit Consulting (“Company”) has adopted this Business Continuity Plan (“BCP”)

pursuant to the requirements of prevailing legislation and in the interests of its clients.

3.1 The purpose of this BCP is to define the strategies and plans that will be used by the Company

during a significant business disruption (“SBD”). An SBD includes any event or situation that

significantly impacts the Company’s ability to provide services to its clients.

3.2 The BCP outlines the Company’s procedures designed to ensure that critical business functions

can continue during and after an SBD and that the Company can resume operations as quickly

as possible after an SBD.

4

3.3 The BCP is prepared to address both internal SBDs, such as a fire in a building or the death of

key personnel, and external SBDs, such as a natural disaster, terrorist attack, or citywide power

disruption. It is also designed to address SBDs of different severities.

3.4 In the event of an SBD, it is Efficient Group policy to do the following to the extent reasonable

and practical under the circumstances:

3.4.1 Safeguard employee lives and Company property;

3.4.2 Make a financial and operational assessment;

3.4.3 Promptly recover and resume operations;

3.4.4 Protect the Company’s hard and soft copy records;

3.4.5 Communicate with its clients and allow them to transact business; and

3.4.6 Communicate with Regulators where necessary.

3.5 Although the Company does not maintain custody of client assets, in the event of an SBD, we

will assist clients to access their assets at the places that have custody of the assets. In the

case of an external SBD, Efficient Benefit Consulting’s ability to react will depend heavily on

access to other organisations and systems, such as the availability of electricity, telephones,

internet and transportation.

3.6 In creating this BCP, Efficient Benefit Consulting has assumed that:

3.6.1 the designated alternate office will be available,

3.6.2 the Company has sufficient personnel, and

3.6.3 government agencies and market systems are operational during and after the SBD.

If any of these assumptions are incorrect, business could be disrupted until matters are

resolved. No contingency plan can eliminate all risk of service interruption, but Efficient Benefit

Consulting will continue to assess and update its plans to mitigate all reasonable risks.

4. PLAN APPROVAL, REVIEW, LOCATION, DISBURSEMENT:

4.1 The BCP will be reviewed annually to determine whether any modifications are necessary in

light of changes to our operations, structure, business or location or new regulatory

requirements.

4.1.1 The Company’s Managing Director is responsible for approving the plan and for

conducting annual reviews. During the fourth quarter of each fiscal year, and

4.1.2 The Company’s Internal Compliance Officer will review the BCP to determine whether any

revisions are needed and will revise the BCP if necessary to ensure it meets the Company’s

needs and regulatory requirements.

5

4.2 Testing:

Efficient Benefit Consulting will test the Business Continuity Plan to identify any weaknesses

and gaps at least once annually. This may include testing of areas such as:

4.2.1 accessing back-up records;

4.2.2 hardware functions at the alternate business location;

4.2.3 verification of current contact information;

4.2.4 any designated duties for employees, clients and business partners;

4.2.5 verification of vendors, service providers, software and equipment; and

4.2.6 confirming the Company’s business practices to the BCP and regulatory requirements.

Effective Date Description of Action Name and Title of Company Employee or Executive

April 2018 Creation of BCP Internal Compliance, Directors of the Company

August of each consecutive year

Annual Review of BCP Managing Director of the Company

Ad-hoc, but at least annually

Update of BCP Internal Compliance, Directors of the Company

4.3 Plan Location and Access

4.3.1 Efficient Benefit Consulting will maintain copies of the BCP, the annual reviews, and any

revisions made to the plan.

4.3.2 An electronic copy of the BCP is located on www.efbc.co.za. Electronic copies are kept at the following locations: Internal SharePoint site/Compliance.

4.4 Disbursement of Plan:

All employees will receive training on the BCP upon beginning their employment. When the

BCP is updated, all employees will receive the revised plan and an updated copy of the BCP

will be distributed to all employees within forty-eight (48) working hours of approval and any

amendment. Efficient Benefit Consulting will periodically train all its employees on the BCP’s

requirements on an annual basis.

6

5. KEY PERSONNEL:

5.1 Our key personnel and persons responsible for executing this BCP in the event of an SBD are:

Name Address Responsibility Mobile/Cell Phone

Marius Du Toit

(Cape Town)

14 Barbigera Close,

Brackenfell 7560 Managing Director EFBC 082 376 0525

Nic Du Toit

(Cape Town)

16 Prima ave, Camps

Bay, 8005

Compliance Officer and Head of

Asset Consulting - EFBC 083 577 4568

Kobus Kunz

(Bloemfontein)

34 Boerneef street,

Langenhoven Park,

Bloemfontein, 9330

MLRO and Head of Consulting -

EFBC 079 288 3267

5.2 In the event that these key personnel die or become incapacitated or otherwise unavailable,

the following persons are authorized to execute this BCP and carry on FSP’s business and/or

wind down the business:

Name Title Email Cell

Heiko Wiedhase Group CEO [email protected] 087 944 7999

Anton de Klerk Group CFO [email protected] 087 944 7999

These persons have been trained on how to execute the provisions of the BCP and carry on

business and/or wind down the business.

6. EMERGNCY CONTACT PERSONS:

6.1 Our Company’s emergency contact persons are:

7

Delegated Persons Contact List

Name Address Responsibility Mobile/Cell Phone

Marius Du Toit

(Cape Town)

14 Barbigera Close, Brackenfell

7560 Managing Director EFBC 082 376 0525

Nic Du Toit

(Cape Town)

16 Prima ave, Camps Bay, 8005 Compliance Officer and Head of

Asset Consulting - EFBC 083 577 4568

Kobus Kunz

(Bloemfontein)

34 Boerneef street,

Langenhoven Park,

Bloemfontein, 9330

MLRO and Head of Consulting -

EFBC 079 288 3267

Server and Computer Equipment Suppliers

Company Name Contact Work Mobile/Cell Phone

B-Logic Christo Nel On-Site technician 0861 26 26 24

B-Logic Werner Kruger Service Delivery Manager 083 278 5274

Efficient Group Stefan Schoeman IT Manager 072 048 5143

Site Security Services

Company Name Contact Work Mobile/Cell Phone

Cape Town Office –

Building Security

Shafieka S 021 508

8753

24 Hours Security Service (Tyco Security)

www.tycosecurity.co.za

Emergency Notification Contacts

Name Address Mobile/Cell Phone

Fire Department/

Accidents/Natural disasters

6 Belraid

Road,

Unclear,

Bellville

021 444 8279

Or 1022 National

Police 10111 (National)

Electricity Department 0860 103 089

Emergency Services 112 (Mobile phone)/ 10177 (Landline)

Head Office Contact Person (Pretoria) 082 450 7968 / 087 944 7999

Company Contact Person Marius du Toit 082 376 0525

Nic du Toit 083 577 4568

Kobus Kunz 079 288 3267

http://www.tycosecurity.co.za/

8

6.2 Updates:

Our Company must:

6.2.1 update the contact information promptly (but no later than 5 business days following any change

in the information) and

6.2.2 annually review and update, if necessary, the information within 10 business days after the end

of each fiscal year. This will be finalized and approved by no later than 15 working days after

the end of the fiscal year.

6.2.3 Ensure that each emergency contact person is an associated person of the Company, and at

least one emergency contact person must be a member of senior management.

6.2.4 Ensure that If our Company designates a second emergency contact person, that contact

person must be a member of senior management who has knowledge of the Company’s

business operations. If we have only one associated person, the second emergency contact

must be an individual, either registered with another Company or non-registered, who has

knowledge of our Company’s business operations (e.g., our attorney, accountant or compliance

officer).

7. OFFICE LOCATION:

7.1 Office Location #1

Our Location #1 Office is located at

Catnia Building, Bella Rosa Village, Bella

Rosa Street, Bellville, 7530

Its main telephone number is 021 276 1987

Our employees may travel to that office by means of foot, car, public, or private transport.

We engage in Front and Back Office activities at this location.

7.2 Office Location #2 Our Location #2 Office is located at

94 ;Kellner Street, Palmpark, Unit 9,

Westdene, Bloemfontein, 9301

Its main telephone number is 051 023 0000

Our employees may travel to that office by means of foot, car, public, or private transport.

We engage in Front and Back Office activities at this location.

7.3 Alternative Physical Locations: 7.3.1 In the event of an SBD, we will move staff from the affected office(s) to temporarily based from their

home or to our Group’s Head Office based at:

81 Dely Road, Hazelwood, Pretoria, 0081.

9

7.3.2 The main telephone number at the alternate location is 087 944 7999

If we cannot return to the primary office within a reasonable amount of time following

the SBD, we will evaluate whether to permanently move to a new primary office

location.

7.3.3 In the event of an SBD involving widespread lack of telecommunications, transportation,

electricity, office space, fuel and water, we will consider its employees’ ability to work remotely

during the SBD, as well as how employees may work in the absence of telephone and/or

Internet access if necessary.

8. OPERATIONAL AND FINANCIAL ASSESSMENTS IN THE EVENT OF A SBD:

8.1 Operational Risk:

8.1.1 In the event of an SBD, the Company will immediately assess and identify what means will

permit it to communicate with clients, employees, regulators, any custodian institution(s) holding

client funds and securities, and critical business constituents and counterparties.

8.1.2 Although the impact of an SBD will determine the means of alternative communication, the

Company may employ website, telephone voice mail, secure email. In addition, the Company

will retrieve key activity records by means of data back-up and recovery (Hard Copy and

Electronic).

8.2 Financial and Credit Risk:

8.2.1 There is an obligation on the Company to remain financially sound as per Board Notice 194 of

2017 (FAIS Fit and Proper requirements) in respect of working capital requirements, liquidity

requirements and additional asset requirements.

8.2.2 In the event of an SBD, the Company will determine its financial ability to continue to operate

and service its clients. We will contact product suppliers, custodian Company, clients and

critical banks to apprise them of the financial status and notify the Regulator if required.

8.2.3 If the Company determines that it is unable to fund its operations, it will request additional

financing from its bank or other credit sources to fulfill its obligations to clients or obtain

instruction from the Regulator in this regard.

8.2.4 Group Finance or the Company MD will contact banks and lenders to determine if they can

continue to provide the financing needed in light of an internal or external SBD.

10

9. CRITICAL SYSTEMS AND RECOVERY SCENARIOS:

9.1.1 A copy of the disaster recovery plan, which describes the critical systems of which the

Company makes use of as well as recovery scenarios is annexed as “ANNEXURE C” and

forms part of the BCP.

9.1.2 The Company will periodically review the third parties’ capabilities to perform the critical

functions contracted to perform for our Company to ensure these are in line with requirements.

10. SUCCESSION PLAN

10.1 In the event of the death of the Key Individual or Directors and where the business is to be wound

down, an updated list of client names and contact details may be accessed at our external

compliance officer Frits Rossouw (“The FAIS Compliance Officer”) who is contactable on 083

675 8083 and/or [email protected].

10.2 Each client must be contacted within 5 working days, by telephone/ by email, by to notify them

of the situation.

10.3 All product suppliers must be contacted by [role of person to contact product suppliers] to notify

them of the situation. Product supplier’s details can be accessed on the product suppliers

register, which is kept at our external compliance officer Frits Rossouw (“The FAIS Compliance

Officer”) who is contactable on 083 675 8083 and/or [email protected].

10.4 Where clients cannot be reached or where deemed necessary, the assistance of product

suppliers should be enlisted, and an appropriate action plan implemented.

10.5 The following actions should be completed by our external compliance officer Frits Rossouw (“The

FAIS Compliance Officer”) who is contactable on 083 675 8083 and/or [email protected].

10.5.1 Notify the Financial Sector Conduct Authority registration department (“FSCA”) and your

compliance practice by email within the required 15-day period to ensure removal of the person

as KI

10.5.2 Notify the FSCA and your compliance practice by email within the required 15-day period to

ensure change of contact person if the KI was the contact person at the FSCA

10.5.3 Notify the FSCA of the new KI, if one is required to be appointed. This entails a new FSP 4

form, required attachments and payment

10.5.4 Where the person is registered as a Director, Shareholder or Member, CIPC will have to be

updated as to the changes which occur as result of the departure of the person

10.5.5 Where the person is registered as a Director, Shareholder or Member, the FSCA will have to

be updated as to the changes which occur as result of the removal/ departure of the person.

This occurs by way of completing the required FSP 3 forms.

10.5.6 Where the person was either a money laundering control officer (“MLCO”) or a money

11

laundering reporting officer (“MLRO”), notify the Financial Intelligence Centre of the change of

within 90 days. This must be processed using the online “GoAML” software accessible at

www.fic.gov.za. Update and obtain new login and password details and ensure a new MLCO/

MLRO is appointed.

10.5.7 Update the MLCO appointment form with the details of the new MLCO - and ensure this is approved/ signed off by the governing authority

10.6 If the KI was a representative:

10.6.1 Notify all clients in writing of the removal/ departure of the person. Enlist the help of product suppliers where required. Ensure that full records of this are retained.

10.6.2 Ensure all unfinished or partly finished business is handed over to either another representative

to complete, or to the client

10.6.3 Notify all product suppliers in writing of the departure of the person and ensure that sub-codes are closed

10.6.4 Notify all product suppliers in writing of alternative contact person/ signatory where the person

was the contract signatory

10.6.5 Notify all vendors, business insurers etc. where the business is being wound down

10.6.6 Update the business' conflict of interest policy where required

10.6.7 Update the business' risk plan where required

10.6.8 Update business stationery where required

10.6.9 Update the business' disclosure document where required

10.6.10 Update the business' email signature where required

10.6.11 Update the business' website where required

10.6.12 Notify and update third party providers where the person was a contact person/ signatory

10.6.13 Cancel any personal subscriptions where required

10.6.14 Notify and cancel associations such as the FPI where required

10.6.15 Update or change internal telephone extensions/ cellphone contracts where required

11. COMMUNICATION OF SUDDEN BUSINESS DISRUPTION TO OTHER PARTIES

11.1 In the event of an SBD, including the death or unavailability of key personnel, the persons

executing this BCP will determine the persons that need to be notified about the SBD, including

employees, clients, regulators, custodians, and critical business constituents. The persons who

need to be notified, and how, will vary with the circumstances of the SBD.

http://www.fic.gov.za/

12

During an SBD, we will ensure, to the extent possible, that the website reflects the Company’s

operational status and contact information. The Company may place status messages on its

website indicating to clients, for instance, the nature of the SBD or the status of its services to

clients. See ANNEXURE B for a sample of formal communication to be sent to clients.

11.2 Clients

11.2.1 The Company currently communicates with clients using: telephone, email, website, mail, in-

person visits.

11.2.2 In the event of an SBD, the Company will assess which means of communication are still

available, and use the means closest in speed and form (written or oral) to the means used in

the past to communicate with the other party. For example, if the Company has primarily

communicated with a party by email, but the internet is unavailable, the Company will call the

client on the telephone and follow up using email, where a record is needed, once

communications have been restored.

11.2.3 In the case of an expected SBD, such as a forecasted storm, or power outage, the Company

will consider proactively contacting clients (for instance, by email blast) to determine whether

they need to execute any transactions (e.g., fund transfer, instructions) in case of an extended

outage.

11.3 Employees:

11.3.1 The Company currently communicates with clients using: telephone, email, website, mail, in-

person visits.

11.3.2 In the event of an SBD, the Company will assess which means of communication are still

available, and use the means closest in speed and form (written or oral) to the means used in

the past to communicate with the other party is available for central messaging and employee

communications.

11.3.3 The Company may employ a call tree so that senior management can reach all employees

quickly during an SBD if email and cellular phones (including texting) is not available. The call

tree includes all staff home, office and cell phone numbers.

The person to invoke use of the call tree is: MD of the Company – Marius du Toit

Caller Call recipients Marius Du Toit

Company directors (Kobus Kunz and Nic du Toit

Kobus Kunz

Direct reporting employees

Nic du Toit Direct reporting employees

13

11.4 Regulators:

11.4.1 Efficient Benefit Consulting is currently registered as an FSP with the Financial Sector

Regulatory Authority and an accountable institution with the Financial Intelligence Centre.

11.4.2 The Company’s primary persons of contact with its regulators are the following:

External compliance officer Frits Rossouw (“The FAIS Compliance Officer”)

who is contactable on 083 675 8083 and/or [email protected].

11.4.3 It currently communicates with its regulators using telephone, email, and via website. In the

event of an SBD, the Company will assess which means of communication are still available,

and use the means closest in speed and form (written or oral) to the means used in the past to

communicate with the other party, including to make any necessary filings, disclosures, etc.

11.4.4 In the event that the Company cannot contact its regulators, it will continue to file required

reports to the extent possible using the communication means available to it.

11.4.5 In the event of a formal or informal inquiry made by any Regulator during an SBD, the Internal

Compliance Officer will be responsible for receiving all calls and/or all other requests for further

review.

12. DISCLOSURE OF BUSINESS CONTINUITY PLAN:

12.1 All clients will receive a copy of a BCP summary disclosure statement as part of the initial disclosures and annually thereafter in order to apprise them of the procedures which will be followed in the event of business interruption.

12.2 A copy of the BCP summary disclosure is attached to the BCP as “ANNEXURE B”. The

Internal Compliance officer also posts its BCP on its website located at www.efbc.co.za and will mail it to clients upon request.

14


Business Continuity Plan ANNEXURE A – RISK RATING AND SCENARIO ANALYSIS

RISK RATING CRITERIA

Severity: Possible consequence 4 Liquidation / closure (cannot pay debts) 3 Insolvency (liabilities exceed assets) 2 Sustained deterioration of profitability and/or cash flow 1 Temporary deterioration of profitability and/or cash flow 0 No impact of business

Probability: Likelihood of occurrence 4 Happens often 3 Happens infrequently (here or elsewhere) 2 Likely to happen 1 Highly unlikely but possible 0 Virtually impossible

Exposure: Frequency / duration of exposure

4 Continuously (24 hours a day) 3 Daily or weekly 2 Monthly or quarterly 1 Annually or less frequently 0 No exposure

Mitigation: degree to which risk is mitigated or controlled

4 Risk is eliminated 2 Some controls in place 0 No mitigation or control

15

Risk = (severity + probability – mitigation) * exposure Risk Rating 21 – 32 High 13 – 20 Medium 0 – 12 Low

Example (Guide to risk table) Fire: Risk = (severity + probability – mitigation) * exposure Risk= (4 + 4 – 2) * 4 Risk Rating: 24 (rating- HIGH)

16

Threat Impact on the organization Severity Probability Exposure Mitigation OVERALL LEVEL OF RISK

Procedures address/prevent disaster

Disease (e.g. swine flu)

Staff illness, weakened workforce and/or death

1 1 1 2 0 IT systems are designed to be accessible via an off-site connection. Personnel can work from home. In the event of a contagious disease, operations can continue with minimal impact on business. In the event of a death, a succession plan is in place to ensure key functions continue. Supporting services can continue unhindered as capacity and personnel capabilities allow for integration of job roles.

Earthquakes, fire, flood and natural disasters

Damage to buildings and equipment Utility outages Injury and/or death of employees

1 1 1 2 0 Natural Disasters -Uninjured personnel are able to work from home. Systems are of such a nature that personnel are able to connect from home WiFi connection except in severe circumstances where technological systems are wiped out in the entire country. Disaster Recovery Procedures: • Create an image of the system and files • Back up critical system elements • Verify backup generator fuel status and operation • Create backups of e-mail, file servers, etc. Fire- Health and Safety committee to assess the situation and determine the severity. Appropriate action to be taken. In extreme situations, fire brigade will be contacted immediately and building evacuated. Minor fires will be dealt with by personnel who are trained to use the fire extinguishers located in central areas. Whether fire damages a section of a building or the entire building, work processes will be interrupted temporarily while new hardware is obtained for personnel who do not work from laptops. Due to the IT services being off-site, personnel safety is of prime concern in any emergency situation.

Cyber attacks/ Technological risk

Disruption of services Theft of company information Damage to hardware

3 1 1 2 2 IT and IT Security Policy –. Virus, Encryption and Firewall protection in place. Full and incremental backups preserve corporate information assets and are performed on a regular basis for audit logs and files that are irreplaceable, have a high replacement cost, or are considered critical. Backup media stored in a secure, geographically separate location from the original and isolated from environmental hazards.

17

Data and document retention policies are in accordance with applicable legislation which specifies what records must be retained and for how long. IT Technical Support- Facilitate technology recovery and restoration activities, providing guidance on replacement equipment and systems, as required Coordinate removal of salvageable equipment at disaster site that may be used for alternate site operations.

Electricity interruptions and Utility Outages

Water Electricity Telecommunications

1

3

1

2

2

Water: Temporary supply available from swimming pool for sanitation purposes. Not sustainable though. Electricity: Backup generator to be installed. Telecommunications: Cellular communication allows for temporary alternative interaction during electricity outages.

Day Zero

Water

3

3

2

2

3

Water: 3 options to be considered:

1) All staff to work from home 2) The Company will source a property with a borehole and

all staff to work from there. 3) Staff to relocate to an area in the Western Cape that is

not affected by Day Zero.

Reputational damage

Bad publicity Inappropriate actions key/public person

1 1 1 2 0 Damage control process in place – directors convene emergency meeting, agree on appropriate action and issue a communication via the company’s designated spokesperson. The objective is to limit possible occurrences of reputational damage by having reputable individuals as Key Personnel who have been appointed following a strict HR selection process which includes proper background verifications. Signed Codes of Ethics and Executive Service Level Agreements are in place. All personnel must subscribe to the company’s Code of Ethics. In addition the company’s HR policies provide guidance on employee conduct. Good corporate governance is an integral part of the company’s operations. We are fully committed to the principles of the Code of Corporate Practices and Conduct set out in the King Report on Corporate Governance (King III). The company has a zero tolerance approach to financial crime and promotes an ethical work environment and attitude.

18

Political Unrest Utility outages (Water, electricity, telecommunications) Disruption of transport services Staff injuries/casualties

2 1 1 2 1 See Utility Outages above. The majority of our personnel are not dependent on public transport services and all key services can continue via uninjured personnel from home.

19


Business Continuity Plan ANNEXURE B - SAMPLE BUSINESS CONTINUITY PLAN DISCLOSURE STATEMENT

Efficient Benefit Consulting has adopted a Business Continuity Plan (“BCP”). The purpose of the BCP is to define the strategies and plans that will be used by Efficient Benefit Consulting during a significant business disruption (“SBD”). The BCP is prepared to address both internal SBDs, such as an internal flood or fire, and external SBDs, such as a natural disaster, terrorist attack, or citywide power disruption.

OUR BUSINESS CONTINUITY PLAN:

In the event of an SBD, Efficient Benefit Consulting will safeguard employee lives and Company property. Efficient Benefit Consulting will work to re-establish the systems necessary to quickly recover and resume operations, protect records and allow clients to transact business to the extent reasonable and practical under the circumstances. The BCP addresses:

1. alternate office locations 2. client access to funds and securities financial and operational assessments 3. data backup and recovery, 4. critical systems, 5. alternative communications

CONTACTING US:

If you are not able to contact Efficient Benefit Consulting through our regular telephone number 087 944 7999, please contact us at our alternate number 021 276 1987. For questions relating directly to your portfolio, please contact Marius du Toit at 082 376 0525.

VARYING DISRUPTIONS:

SBDs can vary in their scope, from only our offices to a single building housing the offices, the business district where our Company is located, the city where we are located, or the whole region. Within each of these areas, the severity of the disruption can also vary from minimal to severe.

In a disruption to only our Company or a building housing our Company, we intend to transfer our operations to a local site when needed and expect to recover and resume business within a four-hour period. In a disruption affecting our business district, city, or region, we intend to transfer our operations to a site outside the affected area, and recover and resume business within a 24-hour period.

In either situation, we plan to continue in business. However, the ability to fully function is dependent on outside sources outside of our control, including the availability of electricity, telephones, Internet, transportation, and the functioning of institutions and markets worldwide.

Nothing in our BCP or this disclosure statement is intended to provide a guarantee or warranty regarding the actions or performance of Efficient Benefit Consulting.

ADDITIONAL INFORMATION:

If you have questions about our business continuity planning, please contact us at 087 944 7999.

20


Business Continuity Plan ANNEXURE C – IT DISASTER RECPVERY PLAN

DISASTER RECOVERY FOR EFFICIENT GROUP 1

Compiled by: Andrew Bremmer (B-Logic)

Leon Goslett (B-Logic)

Stefan Schoeman (Efficient Group)

Last Updated: 14 March 2018

This document serves for reference purposes and an agreed set of processes

and procedures for dealing with potential disasters relating to ICT services.

ICT Disaster Recovery Plan


Contents Introduction ............................................................................................................................................................................... 3

Plan objectives ...................................................................................................................................................................... 3

Plan scope ............................................................................................................................................................................. 3

Testing schedule ................................................................................................................................................................... 3

Review schedule ................................................................................................................................................................... 3

Analysis ...................................................................................................................................................................................... 4

ICT Services - RPO and RTO Targets ...................................................................................................................................... 4

Technical Dependency Map .................................................................................................................................................. 5

Server List.............................................................................................................................................................................. 6

Backup strategy .................................................................................................................................................................... 7

Licensing ............................................................................................................................................................................... 8

Gap Analysis & Risk Assessment ........................................................................................................................................... 9

Roles and responsibilities ........................................................................................................................................................ 10

Internal Key Contacts .......................................................................................................................................................... 10

External contacts ................................................................................................................................................................ 10

Incident response .................................................................................................................................................................... 12

DR procedures ......................................................................................................................................................................... 13

1) Plan for Damage to Local Area Network (LAN) [Pretoria] ......................................................................................... 13

2) Plan for Damage to Local Area Network (LAN) [Bellville] .......................................................................................... 15

3) Plan for Damage to Local Area Network (LAN) [Port Elizabeth] ................................................................................ 17

4) Plan for Loss of Shared Files/Folders ......................................................................................................................... 19

5) Plan for Loss of Internet Connectivity ....................................................................................................................... 21

6) Plan for Loss of Email Service .................................................................................................................................... 23

7) Plan for Loss of Printing ............................................................................................................................................. 25

8) Plan for Loss of Telephony ........................................................................................................................................ 26

9) Plan for Loss of Payroll (VIP / ESS) ............................................................................................................................. 28

10) Plan for Loss of Silica ............................................................................................................................................ 30

11) Plan for Loss of Pastel Evolution ........................................................................................................................... 31

12) Plan for Loss of Moonfire ..................................................................................................................................... 33

13) Plan for Loss of Workpool .................................................................................................................................... 34

14) Plan for Loss of Futuresight .................................................................................................................................. 35

15) Plan for Loss of Fraxion......................................................................................................................................... 36

16) Plan for Loss of Sharepoint ................................................................................................................................... 38

Appendices .............................................................................................................................................................................. 39

Alternate work locations ..................................................................................................................................................... 39

Insurance policies................................................................................................................................................................ 39

Record of DR activities ........................................................................................................................................................ 39

Location of DR resources .................................................................................................................................................... 39


Introduction

This document details the policies and procedures for Efficient Group Ltd. in the event of a disruption

to critical IT services or damage to IT equipment or data. These processes will ensure that those assets

are recoverable to the right level and within the right timeframe to deliver a return to normal

operations, with minimal impact on the business.

Plan objectives ● Documented guideline and review process for Disaster Recovery Procedures

● Defined scope of services relating to ICT to be included as part of the DR Plan

● Recovery Point (RPO) and Recovery Time Objectives (RTO) for ICT Services

● Gap Analysis and Risk Register

● Key Contacts, Roles and Responsibilities

● Guidelines and actions for recovery scenarios

Plan scope ● As per the defined list of ICT services, made mention in the document, and utilized by

Efficient Group Ltd..

Testing schedule ● The DR plan will be tested once every 4 months

● Recovery process for IT service will be tested once every 6 months

Review schedule ● The DR plan itself will be formally reviewed once every 12 months and/or when changes are

applied to the ICT infrastructure.


Analysis ICT Services - RPO and RTO Targets

ICT service RPO RTO Priority

Local Area Network (LAN) Same Day High

Internet NBD High

Inter-office VPN (MPLS) Connectivity NBD Medium

Company Shared Files/Folders 24hrs NBD Medium

Printing NBD Medium

Company Websites 24Hrs NBD Medium

Company Email 24Hrs Same Day High

Telephony Same Day High

Payroll: ESS & VIP 24Hrs NBD Medium

Accounting: Sage Evolution 24hrs NBD Medium

Business Application: Silica (Bellville Only) 1 to 4Hrs High

Business Application: Moonfire 24hrs NBD Medium

Business Application: WorkPool 24hrs Same Day High

Business Application: Futuresight 24hrs Same Day High

Business Application: Fraxion 24hrs NBD Medium

Business Application: SharePoint 24hrs Same Day High


Technical Dependency Map

ICT Service Dependent Service Database Service Provider Server Platform (VM) Server Platform (Physical) Core Networking/Other Connectivity

LAN Access (PTA) DHCP

AD, DNS

B-Logic EFGPTASV01 HP 1920 24 PoE (x2)

LAN Access (BLV) DHCP

AD, DNS

B-Logic EFGBELSV01 HP 1910 24 PoE

HP 2610-48-PWR (x2)

HP 2530-24

LAN Access (PE) DHCP

AD, DNS

B-Logic EFGPESV01 HP 2626

HP 2600

File & Folder Sharing (PTA) LAN Access (PTA) B-Logic EFGPTASV01

File & Folder Sharing (BLV) LAN Access (BLV) B-Logic VERSO-IS-ADHV

File & Folder Sharing (PTA) LAN Access (PTA) B-Logic EFGPESV01

Print Services (PTA) LAN Access (PTA) Venditor Minolta

Print Services (BLV) LAN Access (BLV) Ricoh SA

Print Services (PE) LAN Access (PTA) Ricoh SA

MPLS Network

(PTA-BLV-PE)

LAN (PTA; BLV; PE) Macrolan Hosted UTM Firewall Appliance Fibre: 60Mbps DC

Breakout

Internet (PTA) MPLS Network Macrolan Mikrotik Router (Macrolan

Router)

Fibre: 30Mbps to

DC

Failover - Wireless

(10MB)

Internet (BLV) MPLS Network Macrolan Mikrotik Router (Macrolan

Router)

Fibre: 30Mbps to

DC

Failover - Wireless

(10MB)

Internet (PE) MPLS Network Macrolan Mikrotik Router (Macrolan

Router)

ADSL: 10Mbps to

DC

Failover - None

Email (O365 Ex. Online) Internet (PTA; BLV; PE) ExchangeDB B-Logic

Company Websites Internet (PTA; BLV; PE) Liquid Edge /

ThoughtCorp

Telephony (PTA) Internet (PTA) Kinetix Group Hosted (Kinetix)

Telephony (BLV) Internet (BLV) Uthetha Epygi

Telephony (PE) Internet (PE) Macrolan Hosted PBX (Macrolan)

Payroll (ESS & VIP) LAN Access (PTA); MPLS

Network

SQL

(EFGDCSV02)

Sage EFGDCSV03 Hosted (Macrolan)

Accounting: Sage Evolution

(PTA)

MPLS Network SQL

(EFGDCSV02)

Sage EFGDCSV04 Hosted (Macrolan)

Accounting: Sage Evolution

(BLV)

LAN Access (BLV) SQL

(VIS-SQL)

Sage VIS-Pastel VERSO-IS-ADHV

Application: Silica LAN Access (PTA); MPLS

Network

Silica Hosted (Silica)

Application: Moonfire LAN Access (PTA); MPLS

Network

Macrolan (Server);

Moonfire (AppSupport)

MORNINGSTAR-PC VERSO-IS-ADHV

Application: WorkPool LAN Access (PTA); MPLS

Network

Macrolan (Server);

Workpool (AppSupport)

Hosted (Workpool)

Application: FutureSite LAN Access (PTA); MPLS

Network

Macrolan (Server)

Stefan (AppSupport)

WIN-JF83J4AEV23 Hosted (Macrolan)

Application: Fraxxion LAN Access (PTA); MPLS

Network

SQL

(EFGDCSV02)

Macrolan (Server)

Stefan (AppSupport)

EFGDCSV01 Hosted (Macrolan)


Server List Location Device Name

Network Address

Make / Model OS and Service Pack

Warranty Expiry

BACKED UP?

Efficient Group (PTA)

EFGDCSV01 192.168.50.2 Virtual Server (Datacentre)

Server 2012 R2 Standard

Non- Critical Server – 3rd

Party Backups & 24hr

Snapshot




Image-Based Cloud Backups




Image-Based

Cloud Backups






WIN-JF83J4AEV23 (Naviga/Futuresight)

129.205.135.34 Virtual Server (Datacentre)




WIN-N51DQIDSH81 (New Naviga Server)

192.168.50.5 Virtual Server (Datacentre)


Non- Critical Server – 3rd

Party Backups & 24hr

Snapshot


EFGPTASV01 192.168.10.5 Dell Inc. / PowerEdge R230


May 12, 2021 Cloud Image with On-premise

SpeedVault


EFGPTASV05 192.168.10.59 Hewlett-Packard / HP EliteDesk 800 G1 TWR

7 Professional SP1

Mar 28, 2017 Onsite Services

Server. No Data Stored.

Efficient Wealth (BVL)

EFGBELSV01 192.168.2.160 Dell Inc. / PowerEdge R230


May 12, 2021 Cloud Image with On-premise

SpeedVault


EFGCPTSV01 (Stale Server)

192.168.2.19 Dell Inc. / PowerEdge R230


May 12, 2021 No Backup – Server on

Hold. Awaiting Redeployment


EFGBVLSV03 (SQL) 192.168.2.220 Virtual Server (BLV)


Sept 30, 2019

Cloud Image

with On-

premise

SpeedVault


EFGBELSV04 (Moonfire)

192.168.2.200 Virtual Server (BLV)

8.1 Professional SP1

Sept 30, 2019

Cloud Image with On-premise

SpeedVault


EFGBELSV02 (FS) 192.168.2.217 Virtual Server (BLV)


Sept 30, 2019

Cloud Image with On-premise

SpeedVault

Efficient Wealth (PE)

EFGPESV01 192.168.161.22 HP / ProLiant DL380e Gen8


Mar 01, 2016 Onsite SpeedVault with Offsite

Rotaion


Backup strategy 1) Datacentre: Server Backups

Backup Solution: Image Based Cloud Backups

Backup Application(s): Solarwinds MSP Backups

Backup Destination: Cloud

Offsite Backups: Cloud

Backup Retention: 28 Days

Restore Testing: Scheduled Ad Hoc

Inclusions (Servers): WIN-JF83J4AEV23(Futuresight); EFGDCV02; EFGDCSV03;

EFGDCSV04

Exclusions (Servers): WIN-N51DQIDSH81(Naviga test Server)* EFGDCSV01*

*Recovery from Datacentre Virtual Host Snapshot (Overwritten every 24hrs)

2) Pretoria: Server Backups

Backup Solution: Cloud Image with Onsite SpeedVault(Network Attached Storage)

Backup Application(s): Solarwinds MSP Backups – Cloud Solution

Backup Destination: Cloud and Onsite SpeedVault




Inclusions (Servers): EFGPTASV01

Exclusions (Servers): EFGPTASV05

3) Bellville: Server Backups

Backup Solution: Cloud Image with Onsite SpeedVault(Network Attached Storage)

Backup Application(s): Solarwinds MSP Backups – Cloud Solution

Backup Destination: Cloud and Onsite SpeedVault




Inclusions (Servers): EFGBELSV01; EFGBELSV02; EFGBELSV03; EFGBELSV04

Exclusions (Servers): EFGCPTSV01

4) Port Elizabeth: Server Backups

Backup Solution: Onsite SpeedVault(Network Attached Storage) With Offsite Rotation

Backup Application(s): StorgeCraft ShadowProtect

Backup Destination: Onsite SpeedVault

Offsite Backups: Rotational External Drives



Inclusions (Servers): EFGPESV01

Exclusions (Servers): N/A


Licensing Specify license agreements, types, credentials and locations for each business application and

licensing

Microsoft Licensing

• Office 365 on CSP (Billed Monthly by B-Logic)

• Windows Server Licensing on SPLA (Billed Monthly by B-Logic)

Other

• Sage: VIP; ESS; Evolution

• Workpool

• Moonfire


Gap Analysis & Risk Assessment

Risk no.

Business Risk Description

Implications Severity

(1-5) Probability

(1-5) Inherent

Risk Remedial Action

1 Backups: Datacentre EFGDCSV01 2 3 6 Implement a Backup Solution for the test servers

2 Backups: Datacentre Naviga Test Server 2 3 6 Implement a Backup Solution for the test servers

3 Uninterruptable Power: BLV

Faulty UPS and No Generator, poses a risk to recovery time objectives and business continuity.

4 5 20 Replace UPS.

Consider Generator.

4 Telephony: BLV

Legacy phone system, poorly supports and reliant on rare parts is a risk to business continuity and telephony.

4 4 16 Review telephony solution for better support alternative, or Hosted PBX


Roles and responsibilities The following individuals are stakeholders and team members when the DR plan is activated:

Internal Key Contacts

Name Role/Function Contact details DR Responsibility

Heiko Weidhase Owner/CEO 082 450 2180 / [email protected]

Notify, DR Approver

Anton De Klerk Group Finance Director [email protected] Notify, DR Approver

Yazeed Patel Group Finance Manager [email protected] Notify

Stefan Schoeman Group IT Manager 072 048 5143 / [email protected]

Notify, DR Approver

Aneen Human Operation Manager: EF Wealth

083 747 2244 / [email protected]

Notify

Britta Weidhase Operations Manager: EF Advise


Notify

Rudi Barnard Managing Director: Efficient Advise and Efficient Wealth


Notify

Pierre De Klerk Managing Director: BIP 082 894 9380 / [email protected]

Notify

Gregory Abrahams Managing Director: BCIS 071 112 3255 / [email protected]

Notify

Robert Walton CEO: Efficient Invest 083 327 139 / [email protected]

Notify

Diaan van Rensburg Managing Director: Naviga 084 576 2256 / [email protected]

Notify

Louise De Jager SharePoint Administrator 087 944 7999 Notify

External contacts

Name Organisation Contact details DR Responsibility

IT Service Desk B-Logic 0861 26 26 24 /

[email protected]

Notify, Manage System

Recovery

Leon

(Account Mgr)

B-Logic 083 685 5522 /

[email protected]

Account Manager & DR

Coordinator

Werner Kruger

(Operations Mgr)

B-Logic 083 278 5274 / wernerk@b-

logic.co.za

Escalation 1

Andrew Bremner B-Logic 076 314 7657 / andrewb@b- Escalation 2


(CTO) logic.co.za

Internet & WAN

(Macrolan)

Macrolan 0861 855 855 /

[email protected]

Internet &

Telephony

VIP & ESS (Sage) Sage VIP 0861 55 44 33 / 012 420 7000 Payroll System

Evolution (Sage) DB Fusion 082 386 1030 /

[email protected]

Telephones (PTA) Kinetix 087 230 8740 /

[email protected]

Kinetix Hosted PBX

Telephones (BLV) Uthetha 021 597 2660 /

[email protected]

Uthetha Epygi

Telephones (PE) Macrolan 0861 855 855 /

[email protected]

Macrolan Hosted PBX

Printers (Ricoh) Ricoh SA 011 723 5444 /

[email protected]

Printers (Minolta) Venditor Minolta 012 681 0000 / 653 2207

[email protected]

Hosted Backups

(Marion)

Marion 0861 627 466 /

[email protected]

Marion Online Backups

(Files Only)

Hosted Backups

(Macrolan)

Macrolan 0861 855 855 /

[email protected]

Macrolan Online

backups (Files Only)

Web Developer Liquid Edge 021 982 2415 efwealth.co.za

Web Developer ThoughtCorp 011 253 2980 efgroup.co.za

rudiarius.co.za

Website Hosting Hetzner 0861 0861 08 /

[email protected]

Domains registered in

Heiko’s name

Silica Jayesh Gopal 011 302 4023 /

[email protected]

Silica Support (EFW)

Moonfire Alison du Plessis

(Account Mgr)

021 762 3866 /

[email protected]

Workpool Andrew Moore 021 592 4488 /

[email protected]

Futuresight Stefan Schoeman 072 048 5143 /

[email protected]


Fraxion Kevin Laing

086 137 9457 / 083 325 2569

[email protected]

Fraxion Imraan Abderoef 086 137 9457 [email protected]

Sharepoint Experts Inside (Hilton

Giesenow)

[email protected] Sharepoint (Expertise

& Consulting)

Incident response The DR plan is to be activated when one or more of the following criteria are met:

● Significant or total disruption of ICT service(s) that in turn impact business productivity and/or

processes

● Damage to systems from physical effects such as nature, environmental related circumstances

● Damage to systems from malicious activities such as theft or virus/malware-based threats to

information or data

The person discovering the incident must notify the following DR stakeholders, who collectively

assume responsibility for deciding which - if any - aspects of the DR plan should be implemented, and

for establishing communication with employees, management, partners and customers.

A disaster recovery event can be broken out into three phases, the response, the resumption, and the

restoration. These phases are also managed in parallel with any corresponding business continuity

recovery procedures.

•Disaster Recovery Team informed (1st Priority: B-Logic)•Decision made around recovery strategies to be taken•Full recovery team identified

Response Phase: The immediate actions following a significant event.

•Recovery procedures implemented•Coordination with other departments executed as needed

Resumption Phase: Activities necessary to resume services after team has been notified.

•Rollback procedures implemented•Operations restored

Restoration Phase: Tasks taken to restore service to previous levels.


DR procedures Depending on the incident, and on the number and nature of the IT services affected, one or more of

the following DR procedures may be activated by the DR team:

1) Plan for Damage to Local Area Network (LAN) [Pretoria]

Scenarios Scenario 1: Server Room/Cabinet Destruction

Scenario 2: Damage to Network Switch(es)

Scenario 3: Damage to Physical Server Platform

Scenario 4: Power Related

Possible causes • Core Networking Equipment Failed hardware; theft; or damage

• Server Equipment Failure or Loss

IT services and data at risk • Printing

• File & Folder Sharing

• Internet Access

• Email (Office 365 Exchange Online)

• Telephony

• Inter-Site MPLS VPN Access

• Website

• Payroll (VIP & ESS)

• Evolution

• Moonfire

• Workpool

• Futuresight

Impact Loss of access to the network and IT services for all staff

Estimated Mean Time to Repair (MTTR)

Scenario 1: 1 Week Scenario 2: 24-72hrs Scenario 3: 24-72hrs Scenario 4: 0-8hrs

Plan of action • Notify B-Logic Service Desk

• Notify DR Team

• Check server room & clarify extent of damage to: o Server Cabinet o Network Switches o Physical Servers o Uninterruptable Power

• Take action relative to Scenario

Scenario 1: Server Room/Cabinet Destruction 1. Assess extend of damage 2. Retrieve hosted backup data (MARION) 3. Quote and approve replacement infrastructure 4. Procure and replace damaged server room

infrastructure 5. Nominate spare hardware / platform 6. Build New Windows Server


7. Configure networking 8. Recover Windows Role(s) & Patch 9. Test OS and Applications

Scenario 2: Damage to Network Switch(es) 1. Assess extend of damage 2. Procure replacement switches (same make and model) 3. Deliver and Install into the cabinet 4. Retrieve & restore switch config from backups 5. Re-patch cabling into new switches

Scenario 3: Damage to Physical Server Platform 1. Assess extend of damage 2. Procure replacement physical server (modern

equivalent) 3. Retrieve hosted backup data (Macrolan) 4. Configure replacement server, deliver and install into

the cabinet 5. Build New Windows Server 6. Configure networking 7. Recover Windows Role(s) & Patch 8. Import Backups 9. Configure networking 10. Test OS and Applications

Scenario 4: Power Outtage 1. Assess extend of damage (Local Equipment vs General

Area Outtage) 2. Local Equipment:

o Confirm Uninterruptable Power Supply (UPS / Generator) in good working order.

o Confirm Generator (if applicable) in good working order

o Notify Electrical Contractor 3. General Area Power Outtage:



o Notify local municipal authorities

Key contacts 1) B-Logic (Support Desk) - 0861 26 26 24

2) Macrolan 0861 855 855

3) Local Municipality (Area Power)

4) Local Electrical Contractor (Local Power Outtage)

5) DR Notify; DR Approvers


2) Plan for Damage to Local Area Network (LAN) [Bellville]

Scenarios Scenario 1: Server Room/Cabinet Destruction Scenario 2: Damage to Network Switch(es) Scenario 3: Damage to Physical Server Platform Scenario 4: Power Related





• Internet Access


• Telephony


• Website


• Evolution

• Silica

• Moonfire

• Workpool

• Futuresight





• Notify DR Team



Scenario 1: Server Room/Cabinet Destruction 1. Assess extend of damage 2. Retrieve hosted backup data (MARION) 3. Quote and approve replacement infrastructure 4. Procure and replace damaged server room

infrastructure 5. Nominate spare hardware / platform 6. Build New Windows Server 7. Configure networking 8. Recover Windows Role(s) & Patch 9. Test OS and Applications


Scenario 2: Damage to Network Switch(es) 1. Assess extend of damage 2. Procure replacement switches (same make and model) 3. Deliver and Install into the cabinet 4. Retrieve & restore switch config from backups 5. Re-patch cabling into new switches


equivalent) 3. Retrieve from onsite or cloud backup 4. Configure replacement server, deliver and install into


Scenario 4: Power Outage 1. Assess extend of damage (Local Equipment vs General

Area Outage) 2. Local Equipment:



o Notify Electrical Contractor 3. General Area Power Outage:






3) Local Electrical Contractor (Local Power Outage)



3) Plan for Damage to Local Area Network (LAN) [Port Elizabeth]

Scenarios Scenario 1: Server Room/Cabinet Destruction Scenario 2: Damage to Network Switch(es) Scenario 3: Damage to Physical Server Platform Scenario 4: Power Related





• Internet Access


• Telephony


• Website


• Evolution

• Silica

• Moonfire

• Workpool

• Futuresight





• Notify DR Team



Scenario 1: Server Room/Cabinet Destruction 1. Assess extend of damage 2. Retrieve Backups from Rotational Drive 3. Quote and approve replacement infrastructure 4. Procure and replace damaged server room

infrastructure 5. Nominate spare hardware / platform 6. Build New Windows Server 7. Configure networking 8. Recover Windows Role(s) & Patch


9. Test OS and Applications

Scenario 2: Damage to Network Switch(es) 1. Assess extend of damage 2. Procure replacement switches (same make and

model) 3. Deliver and Install into the cabinet 4. Retrieve & restore switch config from backups 5. Re-patch cabling into new switches


equivalent) 3. Retrieve backup data from Rotation External

Drives 4. Configure replacement server, deliver and install

into the cabinet 5. Build New Windows Server 6. Configure networking 7. Setup Windows Role(s) & Patch 8. Configure networking 9. Test OS and Applications

Scenario 4: Power Outage 1. Assess extend of damage (Local Equipment vs

General Area Outage) 2. Local Equipment:



o Notify Electrical Contractor 3. General Area Power Outage:






4) Local Electrical Contractor (Local Power Outage)



4) Plan for Loss of Shared Files/Folders

Scenario Scenario 1: LAN down Scenario 2: PTA - Server Offline - EFGPTASV01 Scenario 3: BLV - Server Offline – EFGBELSV02 Scenario 4: PE - Server Offline - EFGPESV01



IT services and data at risk • Company Shares

Impact Access to, or loss of, shared company data


Scenario 1: See "Plan for Damage to Local Area Network (LAN)" Scenario 2: 48-72hrs Scenario 3: 48-72hrs Scenario 4: 48-72hrs


• Notify DR Team

• Check extent of damage to: o File Server (PTA / BLV / PE)


Scenario 1: LAN down

• PTA: Damage to Local Area Network (LAN) [Pretoria]

• BLV: Damage to Local Area Network (LAN) [Bellville]

• PE: Damage to Local Area Network (LAN) [PE]

Scenario 2: PTA - Server Offline 1. Assess extend of damage 2. Procure replacement physical server (modern

equivalent) 3. Retrieve hosted backup data (MacroLan) 4. Configure replacement server, deliver and install into


Scenario 3: BLV - Server Offline 1. Assess extend of damage 2. Procure replacement physical server (modern

equivalent) 3. Retrieve hosted backup data (MARION) 4. Configure replacement server, deliver and install into

the cabinet


5. Build New Windows Server 6. Configure networking 7. Recover Windows Role(s) & Patch 8. Import Backups 9. Configure networking 10. Test OS and Applications

Scenario 4: PE - Server Offline 1. Assess extend of damage 2. Procure replacement physical server (modern

equivalent) 3. Retrieve backup data from Rotation External Drives 4. Configure replacement server, deliver and install into

the cabinet 5. Build New Windows Server 6. Configure networking 7. Setup Windows Role(s) & Patch 8. Configure networking 9. Test OS and Applications




5) Plan for Loss of Internet Connectivity

Scenario Scenario 1: LAN down Scenario 2: MPLS Connectivity down Scenario 3: Firewall appliance affected (Hosted UTM) Scenario 4: Router appliance affected

Possible causes Equipment failure

IT services and data at risk • Internet

• Email

• Telephony

• MPLS VPN Access

Impact Internet and services dependent on external access


Scenario 1: See "Plan for Damage to Local Area Network (LAN)" Scenario 2: 24hrs Scenario 3: 24hrs Scenario 4: 24hrs


• Notify DR Team

• Check extent of damage to: o Firewall Appliance (Macrolan DC) o Router Appliance






Scenario 2: MPLS Connectivity down 1. Contact B-Logic 2. Report to Macrolan to resolve to completion

Scenario 3: Firewall appliance affected (Hosted UTM) 1. Contact B-Logic 2. Report to Macrolan to resolve to completion 3. Macrolan swap out if equipment failure

Scenario 4: Router appliance affected [PTA / BLV / PE] 1. Contact B-Logic 2. Report to Macrolan 3. Check router in server/networking cabinet 4. Macrolan to ship replacement if equipment failure


2) Macrolan 0861 855 855


6) Plan for Loss of Email Service

Scenario Scenario 1: LAN down Scenario 2: Internet down Scenario 3: Office 365 Exchange Online Service Interruption Scenario 4: Domain Hosting issue


• Microsoft Service Interruption

• Domain Hosting Expired

IT services and data at risk • Company Email

Impact Access to, or loss of, company email. Unable to send or receive email.


Scenario 1: See "Plan for Damage to Local Area Network (LAN)" Scenario 2: See "Plan for Loss of Internet Connectivity" Scenario 3: up to 8hrs Scenario 4: 24 to 48hrs


• Notify DR Team

• Check Domain Hosting (Hetzner)






Scenario 2: Internet down • Loss of Internet Connectivity

Scenario 3: Exchange Online Service Interruption 1. Contact B-Logic 2. Log to Microsoft to resolve to completion

Scenario 4: Domain Hosting issue 1. Contact B-Logic 2. Check MX Records 3. Check with Hetzner 4. Confirm Billing Related vs Technical Related issue 5. If DNS registration required – allow up to 48hrs for

propagation



2) Hetzner 0861 0861 08



7) Plan for Loss of Printing

Scenario Scenario 1: LAN down Scenario 2: Equipment Failure

Possible causes • Equipment failure affecting all network printing


Impact Loss of access to network printers for all staff


Scenario 1: See "Plan for Damage to Local Area Network (LAN)" Scenario 2: Up to 24hrs


• Notify DR Team

• Check extent of damage to: o Printer Equipment

• Take action





Scenario 2: Equipment Failure (Printer) 1. Contact B-Logic 2. Log to Printer Support to resolve to completion

a. PTA - Minolta b. BLV - Ricoh c. PE - Ricoh


2) Venditor Minolta 012 681 0000

3) Ricoh SA 011 723 5444



8) Plan for Loss of Telephony

Scenario Scenario 1: LAN down Scenario 2: Internet Down Scenario 3: Equipment Failure (BLV) Scenario 4: Hosted PBX Service Interruption (PTA) Scenario 5: Hosted PBX Service Interruption (PE)


• Equipment Failure or Loss

IT services and data at risk • Telephony

Impact Loss of inbound or outbound calling on the telephones


Scenario 1: See "Plan for Damage to Local Area Network (LAN)" Scenario 2: See "Plan for Loss of Internet Connectivity" Scenario 3: BLV - Up to 1 Week Scenario 4: PTA - Up to 24hrs Scenario 5: PE - Up to 24hrs


• Notify DR Team

• Check extent of damage to: o On-premise PBX (BLV Only)

• Take action





Scenario 2: Internet down

• Loss of Internet Connectivity

Scenario 3: Equipment Failure (BLV Only) 1. Contact B-Logic 2. Report to Uthetha to resolve to completion 3. Procure/Replace Unit if hardware failure 4. Restore config (Uthetha)

Scenario 4: Hosted PBX Service Interruption (PTA) 1. Contact B-Logic 2. Log to Kinetix Group to resolve to completion

Scenario 5: Hosted PBX Service Interruption (PE) 1. Contact B-Logic 2. Log to Macrolan to resolve to completion



2) Kinetix Group (PTA) 087 230 8740

3) Uthetha (BLV) 021 597 2660

4) Macrolan (PE) 0861 855 855



9) Plan for Loss of Payroll (VIP / ESS)

Scenario Scenario 1: LAN down Scenario 2: Internet/MPLS Down Scenario 3: VIP/ESS Virtual Server Offline - EFGDCSV03 [Macrolan Datacentre] Scenario 4: SQL Server Offline - EFGDCSV02 [Macrolan Datacentre]


• Internet or MPLS down

• Virtual Server Failure or Loss

IT services and data at risk • Payroll Applications (VIP and ESS)

Impact Loss of access to, or loss of, Payroll system (VIP / ESS)


Scenario 1: See "Plan for Damage to Local Area Network (LAN)" Scenario 2: See "Plan for Loss of Internet Connectivity" Scenario 3: 1 to 4hrs Scenario 4: 1 to 4hrs


• Notify DR Team

• Check extent of damage (site specific vs entire business)






Scenario 2: Internet/MPLS Down

• Plan for Loss of Internet Connectivity

Scenario 3: VIP/ESS Virtual Server (EFGDC03) Offline 1. Notify Macrolan 2. Assess extent of damage to Virtual Server 3. Determine OS Repair vs Total Server Recovery 4. Rollback to previous Backup (if OS Repair not an option) 5. Test OS and Applications

Scenario 4: SQL Server Offline (EFGDCSV02) 1. Notify Macrolan 2. Assess extent of damage to Virtual Server 3. Determine OS Repair vs Total Server Recovery 4. Rollback to previous Backup (if OS Repair not an option) 5. Test OS and Applications



2) Sage 0861 55 44 33



10) Plan for Loss of Silica

Scenario Scenario 1: LAN down Scenario 2: Internet/MPLS Down Scenario 3: Silica Host Offline



• Silica hosted system down

IT services and data at risk • Company Shares

Impact Loss of access to, or loss of, Silica system


Scenario 1: See "Plan for Damage to Local Area Network (LAN)" Scenario 2: See "Plan for Loss of Internet Connectivity" Scenario 3: 1 to 4hrs


• Notify DR Team

• Check extent of damage








Scenario 3: Silica Host Offline

• Report to Silica to resolve hosted service to completion


2) Silica 011 302 4023



11) Plan for Loss of Pastel Evolution

Scenario Scenario 1: LAN down Scenario 2: Internet/MPLS Down Scenario 3: Evolution Virtual Server Offline - EFGDCSV03 [Macrolan Datacentre] Scenario 4: SQL Server Offline - EFGDCSV02 [Macrolan Datacentre] Scenario 5: BLV: Pastel Virtual Server Offline – VIS-Pastel [BLV on premise Host]




IT services and data at risk • Accounting System (Evolution)

Impact Loss of access to, or loss of, Evolution system


Scenario 1: See "Plan for Damage to Local Area Network (LAN)" Scenario 2: See "Plan for Loss of Internet Connectivity" Scenario 3: 1 to 4hrs Scenario 4: 1 to 4hrs Scenario 5: 24 to 48hrs


• Notify DR Team









Scenario 3: Evolution Virtual Server (EFGDC04) Offline 1. Notify Macrolan 2. Assess extent of damage to Virtual Server 3. Determine OS Repair vs Total Server Recovery 4. Rollback to previous Backup (if OS Repair not an option) 5. Test OS and Applications

Scenario 4: SQL Server Offline (EFGDCSV02) 1. Notify Macrolan 2. Assess extent of damage to Virtual Server 3. Determine OS Repair vs Total Server Recovery 4. Rollback to previous Backup (if OS Repair not an option) 5. Test OS and Applications



2) Macrolan 0861 855 855



12) Plan for Loss of Moonfire

Scenario Scenario 1: LAN down Scenario 2: BLV - Virtual Server Offline (EFGBELSV04)



IT services and data at risk • Moonfire

Impact Access to, or loss of, Moonfire


Scenario 1: See "Plan for Damage to Local Area Network (LAN)" Scenario 2: 48-72hrs


• Notify DR Team







Scenario 2: Moonfire Virtual Server (EFGBELSV04) Offline

• Assess extent of damage to Virtual Server

• Determine OS Repair vs Total Server Recovery

• Rebuild OS and Restore from backup (if OS Repair not an option)

• Test OS and Applications


2) Moonfire (Alison) 021 762 3866



13) Plan for Loss of Workpool

Scenario Scenario 1: LAN down Scenario 2: Internet/MPLS Down Scenario 3: Workpool Host Offline



• Silica hosted system down

IT services and data at risk • Workpool System

Impact Loss of access to, or loss of, Workpool system




• Notify DR Team









Scenario 3: Workpool Host Offline

• Report to Workpool to resolve hosted service to completion


2) Workpool 021 592 4488



14) Plan for Loss of FutureSight

Scenario Scenario 1: LAN down Scenario 2: Internet/MPLS Down Scenario 3: FutureSight Virtual Server Offline - WIN-JF83J4AEV23 [Macrolan Datacentre]



• FutureSight hosted virtual server down

IT services and data at risk • FutureSight System

Impact Loss of access to, or loss of, FutureSight system




• Notify DR Team









Scenario 3: Futuresight Virtual Server (WIN-JF83J4AEV23) Offline

1. Notify Macrolan 2. Assess extent of damage to Virtual Server 3. Determine OS Repair vs Total Server Recovery 4. Recover and Deploy server from Cloud Backups 5. Test OS and Applications


2) Stefan Schoeman (Futuresight)

3) Macrolan 0861 855 855



15) Plan for Loss of Fraxion

Scenario Scenario 1: LAN down Scenario 2: Internet/MPLS Down Scenario 3: Fraxion Virtual Server Offline - EFGDCSV01 [Macrolan Datacentre] Scenario 4: SQL Server Offline - EFGDCSV02 [Macrolan Datacentre]




IT services and data at risk • Fraxion System

Impact Loss of access to, or loss of, Fraxion system


Scenario 1: See "Plan for Damage to Local Area Network (LAN)" Scenario 2: See "Plan for Loss of Internet Connectivity" Scenario 3: 1 to 4hrs Secnario 4: 1 to 4hrs


• Notify DR Team









Scenario 3: Fraxion Virtual Server (EFGDC01) Offline 1. Notify Macrolan 2. Assess extent of damage to Virtual Server 3. Determine OS Repair vs Total Server Recovery 4. Test OS and Applications

Scenario 4: SQL Server Offline (EFGDCSV02) 1. Notify Macrolan 2. Assess extent of damage to Virtual Server 3. Determine OS Repair vs Total Server Recovery 4. Recover and Deploy server from Cloud Backups 5. Test OS and Applications



2) Macrolan 0861 855 855



16) Plan for Loss of SharePoint

Scenario Scenario 1: LAN down Scenario 2: Internet/MPLS Down Scenario 3: Microsoft 365 Online Disruption




IT services and data at risk • Fraxion System

Impact Loss of access to, or loss of, Fraxion system




• Notify DR Team









Scenario 3: Microsoft O365 Online Service Interruption 1. Contact B-Logic 2. Log to Microsoft to resolve to completion


2) Macrolan 0861 855 855

3) Louise de Jager 087 944 7999



Appendices

The appendices to your DR plan may include the following:

Alternate work locations

Site Address Contact details Facilities available

Insurance policies

Insurer: Santam Policy Number: 786/20268990

Brokerage: Indwe Risk Services

Contact Person: Ian Kettlety

E-mail: [email protected]

Phone: 012 471 1000

Contact Person: Mpho Hlatywayo

E-mail: [email protected]

Phone: 012 471 1000

Record of DR activities

Date Activity Outcome Actions

28 Feb 2018 Revised Document Included Cloud Backup Nothing further.

12 March 2018 Revised Document Reviewed and Amended with changes

Nothing further

Location of DR resources

Resource Location

Emergency Contact details - B-Logic - Members of DR team

Cloud Storage (B-Logic) On-premise Network Attached Storage - Onsite

- Onsite IT Person (B-Logic Representative)

efficient benefit consulting fsp 48026 business continuity...

Documents