Thru Business Continuity Plan

Thru’s business continuity and disaster recovery plan is to prepare Thru, Inc. in the event of extended service outages caused by factors beyond our control (e.g., natural disasters, human-caused events), and to restore services to the widest extent possible in a minimum time. The plan encompasses all Thru, Inc. system, sites, and operations facilities.

PLAN OBJECTIVES

• Serves as a guide for the Thru, Inc. recovery teams.

• References and points to the location of critical data.

• Provides procedures and resources needed to assist in recovery.

• Identifies vendors and customers that must be notified in the event of a disaster.

• Assists in avoiding confusion experienced during a crisis by documenting, testing, reviewing and recovery procedures.

• Identifies alternate sources for supplies, resources, and locations.

• Documents storage, safeguarding and retrieval procedures for vital records.

• Minimizes interruptions to normal operations.

• Limits the extent of disruption and damage.

• Minimizes the economic impact of the interruption.

• Establishes alternative means of operation in advance.

• Trains personnel in emergency procedures.

• Provides a smooth and rapid restoration of service.

ASSUMPTIONS

• Key people (team leaders or alternates) will be available following a disaster.

• A national disaster such as nuclear war is beyond the scope of this plan.

• Corporate Office – All employees can work from home and continue using cloud services.

• The Thru service relies on Azure data centers, if one of those regions was unavailable for an extended period this would cause an interruption of the service.

• If a whole region were to become permanently unavailable Thru would deploy a new environment and restore the services. (Recovery Time Objective (RTO)= 48 Hours, Thru Recovery Point Objective (RPO) = 1 Hour)

Thru does not publicly share the contents of the business continuity plan as it contains sensitive information about system architectures, applications, data flows, and vendors. Releasing this may offer malicious actors intel that could inform attacks.