Disaster Recovery (DR) and Business Continuity (BCP) Policy

Cover page layout

Contents

• 1. Purpose
• 2. Scope
• 3. Definitions
• 4. Roles and Responsibilities
• 5. Policy Statement
• 6. Policy Statements
• 6.1. Business Impact Analysis (BIA)
• 6.2. Recovery Objectives
• 6.3. Backup and Data Protection
• 6.4. Resilience
• 6.5. Communication
• 6.6. Continuous Improvement
• 7. Triggering BC/DR
• 8. Insurance
• 9. Testing and Assurance
• 10. Contacts
• 11. Responsibility Matrix
• 12. Any References
• 13. Related documents
• 14. Policy Exceptions
• 15. Policy Enforcement
• 16. Policy Monitoring
• 17. Awareness & Communication
• 18. Version History

Purpose

This Policy establishes LEAP's commitment to maintaining business continuity and recovering critical information and communications technology (ICT) systems following a disruptive event. It defines the principles, obligations, and governance requirements that underpin LEAP's Business Continuity Management System.

Scope

This document applies to Legal Software Holdings Pty Ltd and wholly owned subsidiaries ("LEAP") where IT Ops, DevOps, Infrastructure, CRM and Cybersecurity centrally manage critical systems (e.g., AWS, Azure/Entra ID, CrowdStrike, Intune, Atlassian, Office 365). It covers:

• LEAP Cloud product infrastructure on AWS (EC2/ECS, ALB, RDS/SQL, DynamoDB, S3, OpenSearch)
• Business systems (e.g., Office 365, Azure AD/Entra ID, Atlassian, Slack)
• Key supporting platforms (e.g., LEAPAuth, CI/CD, backups, logging/monitoring)
• Third-party vendors and suppliers that provide services critical to LEAP's operations
• All LEAP employees, contractors, and third parties who manage or operate in-scope systems

Definitions

Roles and Responsibilities

Policy Statement

LEAP is committed to ensuring the continued availability, integrity, and confidentiality of information and systems that are critical to its operations and to its customers. LEAP shall:

• Maintain a documented and actively governed Business Continuity Management System (BCMS)
• Identify, assess, and document the business impact of disruption to critical processes and systems through a formal BIA process
• Define and maintain approved RTO and RPO targets for all critical systems, documented in the BIA
• Implement technical and organisational controls to support recovery within approved targets
• Test recovery capability at least annually and after significant change
• Communicate clearly and promptly with staff, customers, and regulators during and after disruptive events
• Continuously improve the BCMS based on lessons learned from tests, incidents, and audits

Policy Principles

Business Impact Analysis (BIA)

LEAP shall maintain a current Business Impact Analysis that identifies all critical business processes and supporting systems, assesses the impact of disruption across financial, operational, regulatory, and reputational dimensions, and documents management-approved RTO and RPO targets. The BIA shall be reviewed at minimum annually and following any significant change to systems, processes, or the threat environment

Recovery Objectives

RTO and RPO targets shall be defined in the BIA for all systems classified as Critical or High. Targets shall be set based on business need, technical feasibility, and cost, and must be formally approved by the DR/BCP Steering Group. The Policy does not prescribe specific values --- those are the responsibility of the BIA process.

Backup and Data Protection

Critical systems must have documented, tested backup and restore procedures with retention periods that meet business, contractual, and legal requirements. Backup integrity must be verified through regular automated checks and periodic manual restore tests. Backup procedures must support the RPO targets defined in the BIA.

Resilience

Production architecture must employ redundancy and fault tolerance appropriate to the criticality of each service, as determined by the BIA. All significant infrastructure changes must include a DR impact assessment prior to deployment. Single points of failure identified in the BIA must be tracked and remediated through the risk register

Communication

Continuous Improvement

Lessons learned from tests, incidents, audits, and PIRs must be fed back into the BCMS. The risk register and BIA shall be updated following any significant event or exercise finding. Action items must be tracked to closure and reported to the DR/BCP Steering Group

Triggering BC/DR

BC/DR is formally activated when an incident or external event threatens to breach approved RTO or RPO targets, or materially impacts the safety of personnel, access to facilities, critical vendor services, or regulatory obligations. Examples include:

• A production outage, data corruption, or confirmed security incident (including ransomware)
• Loss of or inability to access primary office facilities
• A cloud region or critical service disruption affecting core business functions
• Extended unavailability of a critical vendor platform (identity, email, backup, monitoring)
• A natural disaster, pandemic, or civil event materially affecting LEAP operations

Insurance

Insurance is an important part of LEAP's Risk Management plan to reduce the impact of an event or disaster.

The CFO has responsibility for LEAP Dev's insurance policies and any claims that need to be made, as well as ensuring that we have sufficient coverage in the event of significant disruption

Testing and Assurance

Contacts

Responsibility Matrix

Any References

• ISO/IEC 27001:2022

Related documents

• Incident Management Policy
• Information Security Policy
• Business Impact Analysis
• DR/BCP Standard Operating Procedures

Policy Exceptions

Exceptions in this policy will be risk-assessed by CISO with valid business justification and Policy Owner's approval. Exceptions will be time bound.

Policy Enforcement

Any LEAP employee, contractor, third-party found to have violated any part of this policy may be subject to P&C disciplinary action, up to and including termination of employment.

Policy Monitoring

Compliance with this policy will be monitored through periodic reviews, audits, and management oversight.

Awareness & Communication

This policy is an organisational record. A copy of LEAP security policies is made available to all staff/business units currently employed, or when they join LEAP. Employees requiring further information on any aspects of this Policy should discuss their needs with Trust at LEAP Legal Software trust@leaplegalsoftware.com. Any changes or updates to the policy are immediately communicated to Team Governance, Risk and Compliance (GRC).

Version History