Business Continuity Management Policy

Document: ARD-P12  ·  Revision: 1.0  ·  Issue Date: 11/11/2026

Purpose

The purpose of this policy is to establish Ardroid FZCO’s commitment to maintaining essential operations, protecting people, customer assets and information, and restoring critical services following a significant business disruption. It provides the framework for business continuity planning, response, recovery and continual improvement.

Scope

This policy applies to all Ardroid personnel, activities, facilities, information systems, outsourced processes and off-site operations within Ardroid’s control or influence. It includes receipt and custody of electronic equipment, data sanitization, diagnostics, grading, refurbishment, inventory management, dispatch, and responsible downstream processing, where applicable.

Business continuity arrangements shall consider Ardroid’s quality, environmental, health and safety (QEH&S), data security, customer, contractual, regulatory and R2v3 obligations.

Responsibility

• Leadership: Approves this policy, provides resources and authorizes significant recovery decisions, temporary operating arrangements and return to normal operations.
• Management Representative (MR): Coordinates business impact and risk assessments, maintains the continuity arrangements, schedules exercises and reviews results with Leadership.
• Department Managers / Process Owners: Identify critical activities, dependencies, recovery priorities and alternate methods; ensure employees understand their assigned response and recovery roles.
• Data Protection / IT Designees: Support the protection, backup and restoration of business systems, customer data, evidence of sanitization and related access controls.
• All Employees and External Providers: Follow approved emergency and continuity instructions, promptly report disruptions and protect customer property, confidential information, health, safety and the environment.

Definitions

• Business Continuity Management (BCM): A coordinated approach to preparing for, responding to and recovering from disruptions that may affect essential operations.
• Business Continuity Plan (BCP): Documented arrangements defining the responsibilities, resources, actions and priorities used to continue or restore critical activities.
• Business Impact Analysis (BIA): An assessment of the operational, customer, legal, data security and financial consequences of interruptions and the time within which activities should be restored.
• Recovery Time Objective (RTO): The target period for resuming a critical activity after a disruption, as established through the BIA.
• Recovery Point Objective (RPO): The maximum acceptable period of data loss for a defined information system, where applicable.

Policy Statement

Ardroid is committed to maintaining an effective and proportionate business continuity capability. Protection of life and health, environmental safeguards, data security, legal compliance and custody of customer assets shall take priority over production and delivery targets. Essential services may be resumed only when the required controls and authorizations remain effective.

To meet this commitment, Ardroid shall:

• Identify and prioritize time-critical products, services, processes, facilities, people, technology, suppliers and customer commitments.
• Assess foreseeable disruption scenarios and maintain practical preventive, response, continuity and recovery arrangements.
• Protect customer equipment and information, including chain of custody, controlled access, traceability and data sanitization records, throughout a disruption.
• Maintain clear decision-making, escalation and internal and external communication responsibilities.
• Exercise and review continuity arrangements at planned intervals and after significant disruptions or operational changes.
• Meet applicable legal, contractual, certification and stakeholder obligations without bypassing safety, environmental or information security requirements.

General Requirements

Business continuity planning is aligned with Ardroid’s existing QEH&S management system. Risks and opportunities shall be considered through the Aspects/Hazards/Risk/Opportunity Evaluation (ARD-F08), and significant operational changes shall be assessed through the established management-of-change process. Regulatory, customer and interested-party requirements shall be reviewed as applicable.

The continuity arrangements shall complement, and not replace, the Emergency Preparedness and Response Procedure (ARD-P06), Emergency Action Plan (ARD-SOP-04), incident investigation and corrective action requirements, and applicable site-specific instructions.

Business Continuity Management Requirements

Business Impact Analysis and Recovery Priorities

The MR, in consultation with relevant process owners, shall identify critical activities and assess the effects of their interruption on employees, the environment, customer deliveries, information security, traceability, compliance and financial exposure. The BIA shall identify key dependencies, acceptable interruption periods and appropriate RTOs and RPOs. Priorities shall be documented and approved by Leadership.

Functions assessed shall include, as applicable, receiving and secure storage, inventory records, diagnostics and grading, data sanitization and verification, customer order fulfilment, shipping, information technology, utilities, qualified external providers and downstream movement of materials.

Risk Assessment and Preventive Controls

Disruption scenarios shall be assessed in proportion to the nature of Ardroid’s operations, including fire, serious injury, facility inaccessibility, power or network failure, cyber or data security incidents, equipment breakdown, natural hazards, supply chain interruption, transportation restrictions and loss of key personnel. Controls and residual risks shall be reviewed through ARD-P03 and ARD-P07, as applicable.

Continuity and Recovery Arrangements

For activities identified as critical, the responsible manager shall develop practical recovery instructions covering activation criteria, alternates and deputies, personnel and contact details, essential records, technology or equipment dependencies, customer property safeguards, secure communications and the sequence for restoring the process. Where viable, the plan may include alternate work locations, approved providers, manual controls and prioritized processing.

Any temporary method shall preserve health and safety controls, environmental protections, data security, material traceability and approved downstream pathways. No device shall be released, reused or transferred on the assumption that data has been sanitized; required sanitization and verification must be confirmed under the applicable Data Sanitization Plan and Procedure (ARD-SOP-02).

Incident Activation, Communication and Recovery

Personnel shall immediately report any significant interruption to their manager and the MR. If there is an immediate danger to people or the environment, the Emergency Action Plan shall take precedence. Leadership, with input from the MR and affected functions, shall determine whether to activate continuity arrangements, assign a recovery lead, communicate priorities and record material decisions and actions.

Affected customers, external providers, authorities and other interested parties shall be informed where required by law, contract or the nature of the incident, following ARD-P05. The status of customer equipment, outstanding orders, information systems and affected environmental or safety controls shall be verified before work resumes. Relevant incidents and corrective actions shall be addressed under ARD-P04.

Information Systems, Data Security and External Providers

Business-critical information and systems shall have suitable access restrictions, backup and restoration arrangements proportionate to their risk. Restoration testing shall verify usability and integrity of key information, including inventory, customer instructions, chain-of-custody and data sanitization evidence. Any suspected information security breach shall be escalated and contained before affected systems return to service.

Where an external provider supports a critical activity, the responsible function shall consider service disruption risks, contractual requirements, alternate supply arrangements and provider capability in accordance with ARD-P11. Use of an alternative provider shall remain subject to Ardroid’s approval and qualification controls.

Training, Exercising, Monitoring and Review

Personnel with assigned continuity responsibilities shall receive appropriate awareness and training in line with ARD-P10. The MR shall coordinate a review and exercise of continuity arrangements at least annually, and additionally following significant changes or actual disruptions. Exercises may be discussions, walkthroughs, restoration tests or scenario simulations, based on risk and operational practicality.

Exercises and actual activations shall be evaluated for response effectiveness, recovery performance, communication, gaps and corrective actions. Business continuity suitability, resource needs and improvement actions shall be reviewed by Leadership during Management Review and tracked through the established QEH&S management system.

Records and Related Documents

Business impact assessments, continuity plans, exercise results, activation/recovery logs and post-incident reviews shall be maintained as controlled documented information under ARD-P01. New continuity record types and their retention requirements shall be added to the document master list and retention schedule before controlled issue.

• ARD-P01 — Control of Documented Information and Records Procedure
• ARD-P03 — Identification of Aspects, Hazards, Risks and Opportunities Procedure
• ARD-P04 — Incident Investigation, Nonconformity and Corrective Action Procedure
• ARD-P05 — Communication, Participation and Consultation Procedure
• ARD-P06 / ARD-SOP-04 — Emergency Preparedness and Response / Emergency Action Plan
• ARD-P07 / ARD-P10 / ARD-P11 — Operational Controls / Training / External Providers
• ARD-F08 / ARD-F17 / ARD-F27 — Risk Assessment / Annual Schedule / Change Management
• ARD-SOP-02 — Data Sanitization Plan and Procedure

Revision History

©Ardroid