Business Continuity & Disaster Recovery Policy

1. Purpose and scope

This policy establishes how UniMatter maintains the continuity of its critical functions and recovers its systems and data following a disruptive event. Its objective is to limit the impact of disruption on clients, protect the integrity and availability of information, and restore normal operation in a controlled and timely manner.

This policy applies to all critical functions, systems, and data of UniMatter, whether operated by the firm or by an approved subprocessor, and to disruptive events arising from any cause, including system failure, cyber incident, supplier failure, or loss of access to premises.

2. Business impact and prioritisation

UniMatter identifies its critical functions and the systems, data, and suppliers on which they depend, and assesses the impact that disruption to each would have on clients and on the firm. This assessment informs the priority and sequence of recovery.

For each critical function the firm sets a recovery time objective, being the target period within which the function is to be restored, and a recovery point objective, being the maximum acceptable period of data loss measured against the most recent recoverable point.

3. Backups

UniMatter maintains regular backups of critical data and configuration sufficient to meet its recovery point objectives. Backups are protected to the same standard as the source data.

1. Backups are encrypted at rest and in transit.
2. Backups are retained across multiple, separated locations so that a single event cannot destroy both the primary data and its backup.
3. At least one backup copy is held in a manner resistant to ransomware and unauthorised deletion.
4. Backup integrity is verified, and restoration is tested periodically to confirm that backups are usable.

4. Recovery arrangements

On a disruptive event, UniMatter activates its recovery arrangements in accordance with the priority established by the business impact assessment. Recovery proceeds from verified, clean backups, and the integrity of restored systems and data is confirmed before they are returned to service.

Where a disruptive event is also a security incident, recovery is coordinated with the Incident Response Policy so that the cause is eradicated before systems are restored.

5. Dependence on suppliers and cloud services

UniMatter relies on third-party cloud and software providers for elements of its operation. The firm assesses the continuity and recovery arrangements of those providers as part of the Third-Party and Vendor Risk Policy, and maintains contingencies for the failure or unavailability of a critical supplier.

Where the firm depends on a single provider for a critical function, that concentration is recorded as a risk and mitigated so far as is reasonably practicable.

6. Communications during disruption

During a disruptive event, UniMatter communicates with affected clients in a timely and accurate manner, describing the nature of the disruption, its expected impact, and the steps being taken to restore service. Communications are honest about what is known and what remains uncertain.

Contact details for clients and critical suppliers are maintained so that communication is possible even where primary systems are unavailable.

7. Testing and maintenance

UniMatter tests its continuity and recovery arrangements through exercises proportionate to its scale and risk profile, including periodic restoration tests of backups. The results of testing are recorded, and any deficiency identified is remediated.

The arrangements are maintained current as the firm’s systems, suppliers, and obligations change.

8. Roles and review

The principal is accountable for the firm’s continuity and recovery arrangements and leads their activation during a disruptive event. This policy is reviewed at least annually and after any significant disruption or test that reveals a material deficiency.

Enquiries concerning this policy may be directed to UniMatter at administrator@unimatter.com.au.