Business Continuity & Disaster Recovery
High‑Level Summary

Statement

Virtus Group maintains comprehensive, current and regularly tested Business Continuity (BC) and Disaster Recovery (DR) plans for in-scope managed services. These plans cover both service restoration and recovery of customer data to agreed targets.

Scope and assumptions

• Applies to in-scope managed services (e.g., Microsoft 365/Azure workloads, managed servers/endpoints, network/security platforms, and SIEM-lite).
• Residency posture: NZ primary, with AU for resilience/DR by explicit agreement.
• Shared responsibility is documented in the SOW/CRA; provider platform recovery is coordinated via provider SLAs.

Targets (RTO/RPO)

• RTO/RPO are defined per workload in the SOW (example ranges: RTO 4–8 hours; RPO ≤ 24 hours) and reviewed annually.
• “Crown-jewel” systems may have tighter targets as agreed with the customer.

Data protection

• Policy-based backups with encryption in transit and at rest (AES-256) and immutability/time-lock where supported.
• Granular restore options (item/container/system/tenant) with approval and full audit trail.
• Default retention: 90-day hot and 12-month total (tailorable; legal holds supported).

Testing and assurance

• Quarterly restore tests (representative workloads) with evidence: job IDs, timings, integrity checks, RTO/RPO attainment.
• Semi-annual table-tops (BC/IR scenarios) and an annual DR exercise (failover/failback or rebuild simulation).
• Findings tracked in a Service Improvement Plan (SIP) to closure; summaries included in the Monthly Service Review Pack.

Invocation and governance

• Clear invocation criteria and escalation paths; named Major Incident Manager coordinates recovery.
• Roles and responsibilities defined via RACI (Vendor/Customer/Provider) and referenced in the Information Security & Privacy Schedule.
• Changes to DR posture pass through CAB; material updates are versioned and notified.

Prioritisation

• Data recovery is prioritised based on impact and the agreed RTO/RPO matrix-crown-jewel datasets first.
• Parallel workstreams reduce time-to-value; customer approvals recorded for sensitive restores.

Monitoring and evidence

• SIEM-lite monitors key signals (backup health, risky sign-ins, privilege changes); incidents follow the Breach Response procedure.
• BC/DR metrics, restore evidence, and deviations are reported in the Monthly Service Review Pack.

Compliance and residency

• Controls align to NZISM and ISO/IEC 27001 Annex A.
• Data residency: NZ primary; AU permitted for resilience/DR by agreement, documented in the CRA/SOW.

Contacts

security@virtusgroup.biz   •   privacy@virtusgroup.biz