Virtus Group - Infrastructure Operations Runbook

Executive Summary

This document describes Virtus Group’s standard for this area and how it is applied in practice. It is derived from our internal policies and standards and is intended for both reviewers and operations.

Scope & Assumptions

• In scope: systems and processes directly managed by Virtus Group per contract.
• Out of scope: client-owned or third‑party systems not onboarded to our managed service.
• Dependencies: connectivity, power, and named client contacts for decision making.

Requirements (Key Controls)

• Change Advisory Board (CAB) – Reviews and approves changes, ensures risk and impact assessments, holds regular meetings, and monitors change trends.Head of Security & Compliance – Policy owner, chairs the CAB, and has final authority to accept or reject changes.IT Operations Manager / Principal Engineer – Acts as subject matter expert (SME), provides technical input, supports CAB decision-making, and ensures testing and rollback plans are in place.Managers – Approve changes for their teams, ensure communication of impacts, and verify staff compliance.All Staff – Must follow this policy, participate in approvals or testing where relevant, and report breaches or issues. (VGL.IT.Change.Management.Policy.docx)
• Emergency Change – High-priority changes required to address urgent issues such as outages or vulnerabilities; subject to post-implementation review. (VGL.IT.Change.Management.Policy.docx)
• High Priority – Must be implemented immediately to resolve critical issues impacting services. (VGL.IT.Change.Management.Policy.docx)
• All changes must consider information security risks, compliance requirements, and privacy impacts. (VGL.IT.Change.Management.Policy.docx)
• A risk assessment must be documented for each significant change. (VGL.IT.Change.Management.Policy.docx)
• Changes must be tested in a controlled environment prior to release. (VGL.IT.Change.Management.Policy.docx)
• Rollback procedures must be in place and validated. (VGL.IT.Change.Management.Policy.docx)
• All changes must be scheduled to minimise disruption. (VGL.IT.Change.Management.Policy.docx)
• Stakeholders must be notified of upcoming changes and potential impacts. (VGL.IT.Change.Management.Policy.docx)
• Emergency changes must be communicated immediately upon execution. (VGL.IT.Change.Management.Policy.docx)
• All changes must be documented, logged, and stored in the change management system. (VGL.IT.Change.Management.Policy.docx)
• Change records must include approvals, testing evidence, risk assessments, and rollback plans. (VGL.IT.Change.Management.Policy.docx)
• Documentation must be updated following successful implementation. (VGL.IT.Change.Management.Policy.docx)
• Post-implementation reviews must be conducted for all significant and emergency changes. (VGL.IT.Change.Management.Policy.docx)
• Ensure clear segregation between network zones (Untrusted, Guest, End User, Server, Restricted, DMZ). (VGL.Network.Security.Standard.docx)
• Monitor backup jobs to ensure successful completion, (VGL.Backup.Standard.docx)
• Collaborate with other teams to ensure backup alignment with overall IT and business requirements. (VGL.Backup.Standard.docx)
• For any data where a short-term loss of access could have a huge impact on our business functions and our ability to support our customers, there must be a regular backup and recovery process in place. (VGL.Backup.Standard.docx)
• Generally speaking, and unless more restrictive policies or requirements exist, backups for critical systems must run at least daily, observing the following retention periods: (VGL.Backup.Standard.docx)
• All backups must be tested at least quarterly through full restoration drills to confirm recoverability. (VGL.Backup.Standard.docx)

Procedures / Playbooks

Roles & RACI

KPIs & Reporting

• SLA adherence ≥ 95%
• Change success rate ≥ 98%
• Runbook freshness ≤ 6 months

Evidence & Records

Records are maintained per the VGL Document & Record Control guidelines, including logs, approvals, test outputs, meeting minutes, and reports.