WSM Business Continuity Plan

Business Continuity Plan

Version: 2.1 | Effective Date: Feb 1, 2026

Purpose

This Business Continuity Plan establishes the procedures required to maintain business operations during and after a disruption affecting the Company’s personnel, communications, systems, or access to data. The goal of this plan is to ensure that client service, internal coordination, and access to critical business systems continue with minimal interruption.

Scope

This plan applies to all Company personnel, contractors, systems, and business activities. Because the Company operates as a fully remote boutique implementation firm, this plan is primarily focused on continuity of remote work, communications, secure system access, and preservation of client and operational data.

Operating Environment

The Company operates in a fully remote model. Primary business systems and communication tools include:

  1. Google Workspace for email and remote meetings
  2. Slack for internal communications and operational coordination
  3. Telegram as a backup communication channel if primary tools are unavailable
  4. Salesforce for CRM and client/project data
  5. Google Drive for document storage and file collaboration

All business data is stored in enterprise-grade cloud systems. The Company expects all personnel to maintain secure internet access sufficient to perform their duties, including primary ISP service and one or more backup access methods such as mobile tethering or alternate providers.

Plan Objectives

The objectives of this plan are to:

  1. Maintain the Company’s ability to communicate internally and externally during a disruption
  2. Preserve access to critical client, project, and operational information
  3. Continue core service delivery with minimal downtime
  4. Protect confidential and business-sensitive information
  5. Provide clear responsibilities and escalation procedures during an incident
  6. Restore normal operations in an orderly manner after a disruption

Critical Business Functions

The following functions are considered critical to ongoing operations:

  1. Client communications and responsiveness
  2. Delivery of implementation, consulting, and support services
  3. Access to Salesforce records and client-related data
  4. Access to project files and documentation in Google Drive
  5. Internal team communication and coordination
  6. Scheduling and hosting remote meetings
  7. Management of active opportunities, engagements, and CRM records

Key Risks and Disruption Scenarios

This plan addresses, at minimum, the following disruption scenarios:

  1. Loss of internet connectivity for one or more team members
  2. Outage of Google Workspace services
  3. Outage of Slack
  4. Outage of Telegram
  5. Unavailability of Salesforce
  6. Unavailability of Google Drive
  7. Endpoint device failure or loss
  8. Cybersecurity incident, including account compromise or phishing
  9. Regional power outage affecting one or more remote workers
  10. Temporary personnel unavailability due to illness, emergency, or travel disruption
  11. Widespread disruption affecting multiple vendors or communication channels

Continuity Strategy

The Company’s continuity strategy is based on the following principles:

Remote-First Redundancy

Because all personnel work remotely, continuity is supported through geographically distributed staff rather than dependence on a single office or physical location.

Cloud-Based Systems

Critical data and communications are maintained in enterprise cloud platforms rather than local servers. This reduces dependence on a single location and supports continuity from any secure internet connection.

Multiple Communication Channels

The Company maintains multiple communication methods:

  1. Primary: Google Workspace email and Google Meet
  2. Secondary: Slack
  3. Tertiary: Telegram

If one communication platform is unavailable, the Company will move to the next available approved channel.

Secure Connectivity

All personnel are responsible for maintaining secure internet access through at least one primary method and one backup method where feasible, such as:

  1. Standard ISP connection
  2. Mobile hotspot or phone tethering
  3. Alternate provider such as Starlink

Data Security

The Company requires that business data remain protected during normal operations and continuity events. Data must be transmitted using encrypted connections and stored only in approved enterprise systems that provide encryption in transit and at rest.

Roles and Responsibilities

Leadership

  1. Declaring when this plan is activated
  2. Prioritizing business activities during a disruption
  3. Approving temporary process changes
  4. Coordinating external communications for significant incidents
  5. Determining when normal operations have resumed

All Personnel

  1. Maintaining secure, reliable remote access
  2. Following approved communication fallback procedures
  3. Protecting credentials, devices, and client information
  4. Reporting incidents, outages, or suspected security events immediately
  5. Maintaining awareness of where critical files and communications are located
  6. Keeping backup communication methods accessible

Technical/System Owners

  1. Monitoring system availability and vendor notices
  2. Assessing operational impact when a platform is unavailable
  3. Coordinating workarounds where possible
  4. Supporting restoration of normal workflows once services recover

Incident Severity Levels

Level 1 - Minor Disruption

A limited issue affecting one user or one non-critical workflow with minimal business impact.

Examples: single employee internet outage, local device issue, temporary meeting disruption.
Response: local workaround, alternate connectivity, notify relevant team members.

Level 2 - Moderate Disruption

An issue affecting multiple users, a critical platform, or a client-facing process, but with partial workarounds available.

Examples: Slack outage, partial Google service disruption, unavailable employee during active project delivery.
Response: shift to backup channels, leadership notification, status tracking until resolution.

Level 3 - Major Disruption

A serious event affecting core operations, security, or multiple critical systems with material impact on service delivery.

Examples: Salesforce outage, Google Workspace outage, cybersecurity incident, widespread regional connectivity disruption.
Response: activate full continuity procedures, leadership coordination, client communication as needed, documented response until recovery.

Level 4 - Cloudflare Down

A catastrophic event in which the internet is down, and the company mostly resorts to pen, paper, and smoke signals.

Activation Procedures

This plan may be activated when any of the following occurs:

  1. A primary communication channel is unavailable for a material period
  2. A critical business system becomes inaccessible
  3. A cybersecurity incident could affect confidentiality, integrity, or availability of data
  4. A disruption affects the Company’s ability to serve clients normally
  5. Leadership determines that structured coordination is required

Upon activation:

  1. Leadership confirms the incident and impact.
  2. Leadership determines the appropriate severity level.
  3. Personnel are notified through the best available communication channel.
  4. Work is redirected to backup systems or alternate procedures.
  5. Client communications are coordinated where delivery may be affected.
  6. Status is monitored until normal operations resume.

Communication Procedures

Internal Communication Priority

Internal communications will follow this order unless circumstances require otherwise:

  1. Google Workspace email / Google Meet
  2. Slack
  3. Telegram
  4. Phone call / text message, if needed

External Client Communication

Client communication will normally occur through email and scheduled calls. If a disruption affects service delivery or responsiveness, leadership or the designated client lead will notify affected clients as appropriate.

Communication Expectations During an Incident

During an active disruption:

  1. Personnel should acknowledge messages as soon as reasonably possible
  2. Team members should communicate current status, limitations, and expected availability
  3. Leadership should maintain a single agreed-upon source of truth for incident updates where practical

Business Continuity Procedures by Scenario

Individual Internet Outage

  1. Switch to backup internet access such as mobile tethering, alternate ISP, or other available secure connection
  2. Notify the team through any available channel
  3. Reschedule non-critical meetings if needed
  4. Continue work from cloud systems once connectivity is restored

Google Workspace Outage

  1. Shift internal communications to Slack
  2. Shift backup or urgent communications to Telegram if Slack is also affected
  3. Delay non-essential meetings or use alternate available calling methods
  4. Continue work in Salesforce and locally available materials as possible until Google services are restored

Slack Outage

  1. Use Google Workspace email and Google Meet for internal communications
  2. Use Telegram for urgent backup communication if needed

Telegram Unavailable

  1. Continue using Google Workspace and Slack as normal
  2. Use phone/text communication for urgent fallback where necessary

Salesforce Outage

  1. Continue communication with clients using email and meetings
  2. Use Google Drive project documentation and other approved records to continue work where possible
  3. Defer CRM updates until service is restored
  4. Reconcile delayed entries once Salesforce becomes available

Google Drive Outage

  1. Continue communication through Google Workspace if available, or fallback channels as needed
  2. Use Salesforce and any locally cached, approved working materials where available
  3. Delay non-essential file updates until Google Drive access is restored

Endpoint Device Failure or Loss

  1. Report the issue immediately to leadership
  2. Revoke sessions and change credentials as appropriate
  3. Use a backup device if available
  4. Restore access through approved cloud systems once a secure replacement device is available
  5. Assess whether any security notification or containment steps are required

Cybersecurity Incident

  1. Report the incident immediately
  2. Isolate affected devices or accounts where possible
  3. Reset passwords and revoke sessions as appropriate
  4. Review access logs and vendor alerts where available
  5. Limit communications to approved channels
  6. Notify affected clients only as appropriate based on the nature and impact of the incident
  7. Document incident actions and remediation steps

Personnel Unavailability

  1. Leadership will reassign essential responsibilities
  2. Team members will use available documentation in Salesforce and Google Drive to continue client support
  3. Client communication responsibilities will be delegated as needed

Data Protection Requirements During Continuity Events

During normal operations and continuity events:

  1. Company data must remain within approved systems such as Salesforce and Google Drive unless otherwise authorized
  2. Credentials must not be shared through insecure channels
  3. Sensitive data must not be copied into unapproved personal apps or storage locations
  4. Encryption in transit and at rest must be maintained through approved enterprise platforms
  5. Personnel must use secure internet access and avoid public or unsecured networks unless protected by approved safeguards

Recovery Priorities

When restoring normal operations, priorities should be:

  1. Re-establish internal communication
  2. Confirm client-facing responsiveness
  3. Restore access to Salesforce and Google Drive workflows
  4. Reconcile delayed CRM updates, file updates, and project records
  5. Review whether any clients require status follow-up
  6. Document lessons learned and preventive actions

Training and Readiness

To support continuity readiness, the Company should:

  1. Ensure all personnel know the communication fallback order
  2. Ensure all personnel maintain access to required systems and backup communication tools
  3. Periodically confirm that backup connectivity options are workable
  4. Periodically review this plan and update it as systems or operations change

Testing and Review

This plan should be reviewed at least annually and whenever there is a significant operational or systems change.

The Company should periodically test selected continuity procedures, including:

  1. Communication fallback from Google Workspace to Slack or Telegram
  2. Access to critical systems from backup internet connections
  3. Recovery steps for account compromise or device loss

Document Control

Document Owner: Jason Booher
Effective Date: 2/1/2026
Last Reviewed: 2/1/2026
Next Review Date: 2/1/2027

Approval

This Business Continuity Plan is approved by Company leadership and is effective as of the date listed above.

Approved By: Jason Booher
Date: 2/1/2026