Business Continuity & Disaster Recovery Policy

How we keep client work safe when things go wrong

Purpose and scope

Objectives

  • Maintain critical creative and production services wherever reasonably possible.

  • Protect client data, project files and intellectual property from loss, corruption or unauthorised access.

  • Minimise downtime and meet agreed deadlines, even during disruptive events.

  • Provide clear points of contact and communication for clients if an incident occurs.

  • Continually review and improve our business continuity arrangements as our studio grows.

Roles and responsibilities

  • Business Continuity Lead: The Creative Director (or a delegated senior team member) is responsible for implementing and maintaining this policy, coordinating incident response and keeping clients informed where appropriate.

  • All team members and contractors: Must follow this policy, use approved tools and storage, and immediately report any incident that may affect service delivery or data security.

  • Third-party suppliers: Are expected to maintain appropriate continuity and disaster recovery controls for the services they provide to EEW Design.

Risk assessment

  • Local incidents (power cuts, connectivity issues, equipment failure).

  • Loss, theft or damage of devices used to access client work.

  • Cyber incidents (malware, unauthorised access attempts, account compromise).

  • Unavailability of key third-party services (e.g. cloud storage, project management, communications tools).

  • Staff illness, caring responsibilities or other personal emergencies.

Preventative and continuity measures

  • Use reputable cloud-based tools for file storage, version control and collaboration, with data hosted in secure data centres.

  • Maintain encrypted laptops and devices with strong authentication and automatic locking.

  • Keep key documents, templates and brand assets in shared, access-controlled locations rather than on single devices.

  • Use secure, independent internet connections and mobile data where possible to provide alternative access if a primary connection fails.

  • Maintain documentation for key workflows (for example, video editing, motion graphics, print artwork, web builds) so another team member can step in where needed.

Backup and recovery

  • Store active project files in secure cloud environments with built-in redundancy and version history.

  • Maintain regular automated backups of key storage locations.

  • Keep backup copies of final deliverables for a reasonable period after project completion, unless a client requests otherwise.

  • Test our ability to restore files from backup as part of our regular technical checks.

Incident response and communication

  • Assess and contain: Identify the nature of the incident, secure systems and prevent further impact.

  • Prioritise services: Focus first on protecting client data and time-critical deliverables.

  • Notify clients where appropriate: If an incident is likely to affect deadlines, deliverables or data, we will inform the relevant client contacts as soon as reasonably practical, explain the impact and agree next steps.

  • Record and review: Log the incident, root cause and actions taken, and use this to improve our business continuity and disaster recovery processes.

Remote working and site access disruption

  • Continue working from alternative locations where a secure internet connection is available.

  • Use cloud-based tools to access project files and communicate with clients and suppliers.

  • Inform clients if there is any expected material impact on delivery timescales.

Third-party services and suppliers

  • Their information security and availability commitments.

  • Their own business continuity and disaster recovery arrangements (where available).

  • How quickly we can switch to alternative providers if a service becomes unavailable for an extended period.

Testing, review and improvement

  • Review key risks and controls.

  • Check that backup and recovery processes are functioning as intended.

  • Update contact details, tools, and procedures to reflect how we actually work.

  • Make any necessary improvements to strengthen our business continuity posture.

Supplier Code of Conduct

Contact