Business Continuity & Resilience
Public summary version: 1.2
Effective date: 6 Sep 2026
Next review: 6 Sep 2027
Owner: COO
Approver: Chief Executive
1. Our approach
SpotDev Services Ltd uses a remote working model and cloud services to support delivery. Our continuity approach is intended to protect information, reduce disruption and restore essential work in a controlled order when incidents occur.
This page describes our policy approach. It is not a contractual service-level agreement or a guarantee of uninterrupted service.
2. Scope and responsibilities
The COO owns business continuity coordination. The CTO and relevant service owners are responsible for technical requirements and recovery arrangements within their authority. The Chief Executive retains executive accountability and oversight of material business decisions.
Our planning covers people, access to business services, essential records, supplier dependencies and ongoing client delivery. Clients procure and control their own infrastructure. Any backup, recovery or administration we undertake for them must be included in the agreed scope and authorised by the client.
3. Prevention and preparedness
Our approved security policies require access control, managed-device protection, encryption, vulnerability management and controlled development and release practices. These measures support continuity but do not remove all disruption risk.
Continuity planning identifies critical services, responsible roles, dependencies and practical alternatives. Recovery requirements should reflect business impact and the relevant agreement. Provider redundancy, backup and export capabilities must be assessed for the service actually used rather than assumed to cover every system.
Essential delivery information should be maintained in authorised, access-controlled records so that work can be handed over without depending on one person's private files or knowledge. Personnel are required to understand the continuity responsibilities relevant to their role.
4. Responding and recovering
When disruption occurs, our response is to assess its impact, assign responsibility, protect affected information and prioritise essential services. Recovery may involve restoring or rebuilding authorised resources, using an alternative working arrangement, or coordinating with a client or provider.
Recovery decisions consider data integrity, access protection and the risk of recurrence. A restored service must be checked before being treated as recovered. Security incidents are also managed under our Incident Response Plan.
5. Communication
Affected clients receive information appropriate to the incident and the agreed service: known impact, actions being taken and further updates as facts develop. Personal-data breach notifications follow the applicable DPA and legal requirements; an ordinary service update does not replace those obligations.
Client-specific recovery objectives and responsibilities are documented in the relevant agreement or service arrangements. This public summary does not introduce a universal recovery time or data-loss guarantee.
6. Testing and improvement
Relevant continuity and recovery arrangements are required to be reviewed and tested proportionately to risk and after material change. Tests should record their scope, results, limitations and follow-up actions. A supplier feature or an uncompleted template is not evidence of a successful recovery test.
We can discuss our approach and provide available, verified assurance information through an authorised review, subject to confidentiality and security restrictions. We review this summary at least annually and following material changes. General enquiries can be sent to hello@spotdev.co.uk.
