Business Continuity Plan (A.5.29, A.5.30)

Document ID: bcp-policy
Version: 1.0
Effective from: 2025-01-01
Owner: ISMS owner
Review cycle: Quarterly (drill) + Annual (policy)

note

This document is aligned to ISO/IEC 27001:2022 Annex A as a self-assessment. SigmaShake holds no ISO 27001 certification.

---

Business continuity objectives

Objective	Target
Recovery Time Objective (RTO)	≤ 60 minutes for production services (target only; no collector measures it; the time to redeploy all in-scope Workers is untested and may exceed 60 minutes)
Recovery Point Objective (RPO)	≤ 24 hours for customer data, using D1 time-travel (30 days of point-in-time bookmarks). The weekly d1-backup-export R2 export is an extra off-D1 copy and is not the RPO source. Operator-internal Tier 3 systems have a 7-day RPO.
Evidence continuity	Automated collectors resume on next cron trigger (≤ 24 hours)

Threat scenarios

Scenario	Likelihood	Impact	Mitigation
Cloudflare regional outage	Low	High	Cloudflare runs the Workers runtime on its global network. SigmaShake configures no R2 geo-replication and no multi-region failover. Weekly D1 backups in an Object Lock R2 bucket (next row) limit data loss
D1 database corruption	Very low	Critical	Weekly D1 backup export (d1-backup-export), daily d1-backup-verify, and monthly non-destructive backup verification (backup-restore-test). That collector checks that recent D1 time-travel bookmarks and a recent R2 export exist. It does not restore data into a scratch database.
Signing key loss	Very low	Critical	Key recovery procedure + V2 overlap slot
GitHub outage (source hosting and GitHub sign-in unavailable)	Low	Medium	Deployments via Wrangler CLI from local; Cloudflare handles runtime
Key-holder unavailability	Low	Critical	No key escrow or successor exists today; open risk

Recovery procedures

Production service recovery

1. Confirm outage via Cloudflare status page and tail-consumer-coverage alerts
2. If regional: Cloudflare automatically routes to healthy regions (no action required)
3. If account-level: Contact Cloudflare support with account ID and evidence of ownership

Database (D1) recovery

1. Retrieve latest backup from sigmashake-d1-backups R2 bucket
2. Create new D1 database: wrangler d1 create sigmashake-compliance-recovery
3. Restore: wrangler d1 execute --local < backup.sql
4. Update wrangler.toml binding + deploy

Evidence collection recovery

1. Identify stale collectors via cron-health or self-evaluation
2. Trigger manual run: POST /compliance/admin/cron/trigger
3. Verify evidence resumes via /api/v1/soa.json?framework=iso27001

Signing key recovery

1. Generate new Ed25519 key pair
2. Set COMPLIANCE_SIGNING_KEY via wrangler secret put
3. Register new key in signing_keys table
4. Previous key retained as retiring (historical evidence still verifiable)

Testing

Quarterly BCP drill performed by bcp-test collector:

• Verifies Merkle chain is unbroken for the period
• Checks for stuck error evidence runs
• Records drill outcome in bcp_tests table

Evidence

Collector	Cadence	Control
bcp-test	Quarterly	A1.2, A1.3, A.5.29, A.5.30
d1-backup-export	Weekly	A.8.13
d1-backup-verify	Daily	A.8.13, A.8.14
dr-runbook-currency	Quarterly	A.5.30, A.8.14