Business Continuity Management Policy

For Eagle Vision Video Productions Ltd. (EVVP) | www.evvp.ca

Policy statement

EVVP is committed to maintaining critical operations during disruptions, protecting people first, meeting client commitments where safely possible, safeguarding information and equipment, and restoring services in an organized, timely way.

This policy establishes EVVP’s Business Continuity Management (BCM) program, including governance, planning requirements, testing, and continual improvement.

Purpose

The purpose of the BCM program is to:

Protect the safety and wellbeing of staff, contractors, clients, and visitors
Reduce downtime and financial impact from disruptive events
Maintain delivery of critical services to clients
Preserve EVVP’s reputation, legal compliance, and contractual obligations
Restore normal operations as quickly and safely as possible

Scope

This policy applies to:

All EVVP staff, leadership, and contractors working for EVVP
All EVVP operations, including production, post-production, project management, sales, client communications, and administration
EVVP systems, data, accounts, equipment, and facilities used to deliver services
Key suppliers and partners essential to service delivery

Definitions

Business continuity: The capability of EVVP to continue delivery of products and services within acceptable timeframes during a disruption.
Disruption: Any event that reduces EVVP’s ability to operate normally (examples include power outage, internet outage, severe weather, illness outbreak, cyber incident, facility loss, or key supplier failure).
Critical activities: Activities that must be maintained or restored quickly to meet safety, legal, and client commitments.
BIA (Business Impact Analysis): A structured assessment of the impact of disruption on EVVP activities.
RTO (Recovery Time Objective): Target time to restore a service or activity after disruption.
RPO (Recovery Point Objective): Maximum acceptable data loss measured in time.

BCM program principles

EVVP’s BCM program is built on these principles:

Safety first
Clear roles and decision-making authority
Risk-based planning and realistic recovery targets
Practical, documented procedures that can be executed under stress
Regular training, testing, and improvement
Strong communication with clients and stakeholders

Governance and accountability

Leadership commitment

EVVP leadership will:

Support the BCM program with time, resources, and authority
Approve continuity priorities and recovery targets
Ensure continuity planning is integrated into daily operations and project delivery

BCM ownership

Policy owner: Operations Lead (or designated leadership role)
BCM coordinator: Assigned by leadership; responsible for maintaining plans, coordinating exercises, and tracking improvements
Approving authority: EVVP President or designate

Roles and responsibilities

EVVP President / Executive Lead

Declares a business continuity event when required
Approves major client commitments, spend, and recovery strategy decisions
Acts as final escalation point for safety and reputational risk

BCM Coordinator

Maintains the BCM program and documents
Coordinates BIA, risk assessments, and plan updates
Schedules exercises and training
Tracks corrective actions and improvement items

IT and Systems Lead (internal or outsourced)

Maintains backups, access controls, and recovery procedures
Leads cyber response coordination with leadership
Verifies restoration of systems and data

Production Lead

Identifies critical production workflows, equipment dependencies, and crew needs
Maintains alternate production options and minimum viable workflows
Supports recovery of field operations and gear readiness

Post-Production Lead

Maintains continuity for editing, storage, collaboration, and exports
Ensures critical project files are protected and recoverable
Activates alternate workflows when primary tools are unavailable

Project Management / Client Services

Maintains client contact lists and communication templates
Prioritizes deliverables based on business continuity guidance
Coordinates schedule changes and client approvals during disruptions

All Staff and Contractors

Follow safety instructions and continuity procedures
Report disruptions quickly
Protect EVVP information and equipment
Participate in training and exercises as required

Business Impact Analysis and recovery targets

EVVP will complete and maintain a BIA to identify:

Critical activities and dependencies (people, tech, equipment, suppliers, facilities)
Maximum tolerable downtime for key services
RTO and RPO targets for critical systems and data
Minimum staffing and skill requirements to deliver essential services

BIA outputs will be reviewed at least annually, and when major operational changes occur.

Risk assessment and prevention

EVVP will maintain a BCM risk register that identifies:

Likely disruption scenarios relevant to operations
Existing controls and gaps
Priority mitigation actions and owners

Preventative controls may include:

Redundant internet options where feasible
Surge protection and safe shutdown procedures for equipment
Standard device security controls and account protections
Vendor alternatives for critical services
Documentation of core workflows and cross-training

Continuity and recovery strategies

EVVP will maintain practical strategies for common disruption types, including:

People and staffing

Cross-training for key roles to reduce single points of failure
Clear delegation of decision authority when leaders are unavailable
Remote work readiness for applicable roles
Health and safety protocols for illness outbreaks

Facilities and work location

Remote work capability for project management and post-production where feasible
Alternate workspace options if the primary workspace is unavailable
Safe storage procedures for gear and media

Technology and communications

Documented access to critical platforms, accounts, and admin consoles
Backup and recovery procedures for project files and business data
Alternate communication channels for staff and clients

Production operations

Minimum viable production kits and checklists
Alternate crew and subcontractor options
Contingency plans for location loss, travel disruption, and weather

Post-production operations

Standardized project folder structure and file naming to support recovery
Defined offline or reduced-capability workflows if systems are degraded
Clear export and delivery process for priority deliverables

Supplier and third-party continuity

EVVP will identify critical suppliers and services and maintain:

Primary and alternate vendor options where possible
Key contacts and escalation paths
Contract or service plan information needed during incidents

Business continuity plans required

EVVP will maintain the following controlled documents:

Business Continuity Plan (BCP) with activation triggers and step-by-step response
Incident Response Plan for cyber and information security incidents (or an integrated section within the BCP)
IT Disaster Recovery procedures (internal or outsourced provider documentation)
Crisis Communications Plan including internal and external messaging workflows
Call tree and contact list (staff, key contractors, key clients, vendors)
Asset and equipment list with ownership and storage locations
Current inventory of critical accounts, subscriptions, and admin access owners

Activation and incident management

When to activate continuity procedures

Continuity procedures may be activated when:

Staff safety is at risk
EVVP cannot access critical systems, files, or communication channels
EVVP cannot operate from normal locations
A cyber incident threatens confidentiality, integrity, or availability of data
A disruption is expected to exceed agreed downtime thresholds

Incident management approach

EVVP will use a simple incident structure:

Incident Lead: directs response and sets priorities
Operations Lead: manages continuity of services and staffing
IT Lead: manages system recovery and cyber actions
Client Communications Lead: manages client updates and commitments

Core response steps:

Assess safety, stabilize, and stop further loss
Confirm what is impacted and what still works
Prioritize critical activities and clients
Execute recovery actions based on documented plans
Communicate clearly with staff and clients
Record decisions, actions, and timelines
Transition back to normal operations and conduct a post-incident review

Communication requirements

EVVP will maintain and use communication procedures that ensure:

Internal updates are timely, factual, and actionable
Client communications are clear, confident, and realistic
One voice approach for public or sensitive communications
Escalation rules for legal, reputational, or privacy-related events

Minimum communication expectations during a material disruption:

Staff notified as soon as practical
Priority clients updated within a reasonable timeframe based on impact and commitments
Ongoing updates provided at intervals set by the Incident Lead

Information management and data protection

EVVP will protect business and client information during disruptions by:

Using role-based access where possible
Maintaining secure backup practices for critical data
Maintaining secure credential management and MFA on critical accounts
Ensuring client media and project files are stored in approved locations
Following EVVP’s privacy and security procedures during incident response

If a security incident may involve client data, EVVP will follow its incident response process, document actions taken, and notify impacted parties as required by law and contract.

Training, testing, and exercises

EVVP will maintain BCM readiness through:

Onboarding coverage of continuity basics for new staff and key contractors
Annual refresher training for all relevant roles
Exercises at least annually, which may include tabletop scenarios and practical recovery tests
Post-exercise improvement tracking with owners and due dates

Maintenance and continual improvement

EVVP will review BCM documentation:

At least annually
After any significant organizational, technology, vendor, or facility change
After any material incident or near miss

Changes must be version-controlled and communicated to affected roles.

Compliance and exceptions

All staff and contractors must follow this policy and related continuity procedures. Exceptions must be documented, risk-assessed, and approved by EVVP leadership.

Enforcement

Failure to follow this policy may result in corrective action, up to and including termination of contract or employment, depending on severity and circumstances.

Document control

Policy title: Business Continuity Management Policy
Organization: Eagle Vision Video Productions Ltd. (EVVP)
Effective date: [Insert date]
Next review date: [Insert date, one year from effective date]
Version: 1.0
Policy owner: Operations Lead
Approved by: EVVP President / Executive Lead
Distribution: Internal staff, key contractors, and approved partners as required

Approval

By approving this policy, EVVP leadership confirms commitment to maintaining an effective BCM program and providing the resources needed to keep EVVP resilient and client-ready.