1. Introduction
This Business Continuity Plan (BCP) defines how Ten Points Education Limited (“Ten Points”) will respond to, manage, and recover from disruptive incidents. Its purpose is to minimise downtime, maintain critical services for schools, and ensure compliance with legal and contractual requirements.
The BCP is activated when normal operations are disrupted beyond acceptable limits, particularly where Recovery Time Objectives (RTOs) or Recovery Point Objectives (RPOs) are at risk.
2. Scope
This plan applies to:
- all critical business functions and systems operated by Ten Points;
- incidents affecting technology, people, or critical suppliers; and
- all employees and contractors supporting Ten Points operations.
3. Recovery Objectives
- Recovery Time Objective (RTO): 4 hours for SaaS platform availability.
- Recovery Point Objective (RPO): 24 hours for data recovery.
4. Critical Business Functions
| Function | Description | Priority | RTO | RPO |
|---|---|---|---|---|
| SaaS Platform Availability | Ten Points web & mobile access | High | 4 hrs | 24 hrs |
| Database Integrity | Neon (serverless PostgreSQL) analytics data consistency | High | 4 hrs | 24 hrs |
| Customer Communication | Status page + email to schools | High | 2 hrs | 0 |
| Analytics & Reporting | Dashboards, BI exports | Medium | 24 hrs | 24 hrs |
| Internal Operations | Staff collaboration (email, docs) | Medium | 24 hrs | 24 hrs |
5. Critical Suppliers (Tiered)
- Tier 1 (Mission-Critical): Cloudflare – DNS/CDN/DDoS and serverless compute (application functions); Bubble.io – application hosting.
- Tier 2 (High Importance): Neon – analytics database (serverless PostgreSQL, EU).
- Tier 3 (Supporting): Wonde – MIS sync (account manager escalation available); Cloudinary – image/media hosting.
6. Risk Scenarios
- Cloudflare or Bubble outage.
- Cloudflare compute outage or Neon database corruption.
- Cybersecurity incident (data breach, ransomware, DDoS).
- Loss of critical staff.
- Wonde unavailability.
- Data corruption or accidental deletion.
- Regional disruption or natural disaster.
7. Roles & Responsibilities
- Incident Commander – declares incidents, activates plan, coordinates recovery.
- Technical Lead – manages IT restoration, liaises with Cloudflare, Neon and Bubble support.
- Comms Lead – updates schools via email, maintains status page, escalates to regulators if required.
- Deputies – provide cover if primary roles are unavailable.
8. Response Procedures
- Incident detected and reported.
- Incident Commander assesses severity and activates BCP if RTO/RPO at risk.
- Technical Lead restores critical services, using point-in-time database restore where required.
- Comms Lead updates status page and emails schools as needed.
- Regulators notified within legal timeframes (e.g. ICO within 72h for data breach).
- Incident log maintained throughout response.
9. Workarounds
Schools are encouraged to maintain their own contingency measures for service downtime (e.g., paper or spreadsheet-based tracking). Data can be re-entered once Ten Points service is restored.
10. Disaster Recovery Procedures
- Platform Outage: Monitor Bubble & Cloudflare status; inform schools; restore service within 4h.
- Database Corruption: Perform point-in-time database restore (Neon); verify integrity.
- Cybersecurity Incident: Isolate systems, revoke credentials, restore from clean backups.
- Supplier Failure: Contact account managers (Wonde) or monitor vendor status (Cloudflare, Neon).
- Staff Loss: Deputies step in; priority functions reassigned.
11. Communication Plan
- Internal: Slack/Teams, email, SMS fallback.
- Schools: Status page + email alerts.
- Regulators: ICO or others notified within legal deadlines.
- Suppliers: Wonde account manager; Bubble/Cloudflare/Neon via public channels.
12. Testing & Maintenance
- Tabletop test twice per year.
- Technical recovery test (database restore) at least annually.
- Lessons learned logged and plan updated.
- Annual Board approval required.
Contact
Business Continuity Manager / Information Security Officer
Ten Points Education Limited
Email: dpo@tenpoints.io