> For the complete documentation index, see [llms.txt](https://docs.glesys.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.glesys.com/security/annex-information-security/5.-operational-continuity-and-crisis-management.md).

# 5. Operational Continuity and Crisis Management

5.1 Glesys maintains operational continuity and crisis management capabilities to ensure services can continue and be restored following major disruptions. Rather than relying on a single standalone plan, Glesys governs operational resilience through established continuity and recovery arrangements for each business-critical activity distributed across its management system. These arrangements cover backup and redundancy management, continuity, and crisis management, including but not limited to:

a) a crisis management model defining distinct crisis phases, including preparedness, response, continuity, recovery and post-crisis review, and providing for the activation of a crisis management team for major events or disruptions;

b) activity-level continuity and recovery arrangements, whereby continuity requirements, recovery strategies and recovery plans are established and maintained for each business-critical activity based on its assessed impact and recovery priorities;

c) resilience through the use of redundancy, backup power, failover mechanisms and regular validation and testing activities; and

d) backup frequency based on system criticality, with backups encrypted and restoration tested regularly.

5.2 Glesys carries out and maintains a business impact analysis for the purpose of identifying and evaluating the potential consequences of significant disruptions. The outcome of each analysis establishes and updates the continuity requirements, including recovery objectives, applicable to the relevant activity and the supporting network and information systems.

5.3 Glesys performs regular testing and reviews of its continuity and crisis management arrangements and the supporting procedures, in order to confirm their effectiveness and update them as appropriate and necessary in accordance with the Cyber Security Rules.

5.4 Where necessary for the security of network and information systems and relevant to the Services provided under the Agreement, Glesys and the Customer shall agree on joint exercises relating to incident management, operational continuity and/or crisis management. The scope, frequency and format of such exercises shall be agreed between the Parties, taking into account the nature of the Services and the associated risks. Glesys shall be entitled to compensation for its participation in such exercises in accordance with Glesys' at the time applicable price list.