Business Continuity Policy and Plan

1. Purpose

This policy sets out how we keep working for our clients when something goes wrong. It also sets out how we recover and return to normal. We are a small firm, so the plan is short and practical. It names roles, not people's personal details.

2. Scope

This policy covers Unolabs Limited. We provide technology consulting and technology workforce services. Our people work in a hybrid pattern: usually two days a week at our office and three days remotely. People placed with a client work at the client's office, remotely or in a hybrid pattern, as agreed with that client. Our work runs on Microsoft 365, with our data held in the UK.

Our group company in India, Unolabs Technologies Private Limited, provides delivery and operations support. Where a disruption affects that support, we treat it as a supplier risk under this plan.

3. Business impact analysis

We have looked at the activities that matter most to our clients and our people. For each one we set two limits:

• Maximum tolerable outage (MTO): the longest the activity can stop before serious harm.
• Recovery time objective (RTO): the time within which we aim to restore it.

We will review these values whenever we win a contract with stricter terms. Where a client contract sets a shorter time, the contract wins.

4. Key risks

These are the disruptions most likely to affect us:

1. Loss of a key person. Illness, injury or departure of a director or a lead consultant.
2. IT or cloud outage. Microsoft 365 or another cloud service is unavailable.
3. Cyber incident or ransomware. Accounts are taken over, or data is locked or stolen.
4. Loss of a supplier or partner. A staffing partner, software provider or our group company cannot deliver.
5. Office or client site unavailable. We or a client cannot use a building.
6. Pandemic or travel disruption. People cannot travel or attend client sites.

5. Continuity strategies

Key people. Each director has a named deputy who can act for them:

Deputies already hold the admin and banking access they need, so they can act at once. For client delivery, we agree a back-up consultant or a handover route with the client where the contract allows.

IT and cloud. Our systems are cloud-based. People can work from any managed device with an internet connection. We hold Cyber Essentials certification, issued on 6 November 2026. If one device fails, the person can carry on from another managed device.

Backups. Our key data sits in Microsoft 365, and we keep a separate backup of it with a third-party backup service. We will test a restore at least once a year.

Suppliers and partners. We will keep a short list of alternative suppliers for our critical services by 31 January 2027. This will include at least one alternative staffing partner and an alternative payroll route.

Locations. Our people already work remotely for part of each week, so losing our office or a client site rarely stops work. If the office is unavailable, everyone works remotely. If a client site is closed, we agree remote working with the client.

6. Invoking the plan

Anyone who sees a serious disruption must tell a director straight away. A director decides whether to invoke this plan. If the first director cannot be reached, the next available director decides.

When the plan is invoked, the incident team is:

• Incident lead: Director and Chief Technology Officer (IT, cyber and data incidents), or Director (all other incidents);
• Client and engagement lead: Senior Director (engagement lead);
• Support: the delivery and operations team at our group company in India, Unolabs Technologies Private Limited, where needed.

The incident lead keeps a simple log of decisions, actions and times. If personal data is involved, the incident lead also follows the breach process in our Data Protection Policy (UNO-POL-01). That process includes reporting to the ICO within 72 hours of becoming aware of a breach, where the law requires it.

7. Communication

We tell affected clients early and honestly. We say what has happened, what it means for them, and when we will update them next.

• Clients: we contact affected clients within 4 working hours of invoking the plan, or sooner if the contract says so.
• Public sector buyers: we follow the notice terms in each contract. Where a contract sets a shorter timescale than ours, the contract timescale applies.
• Our people: we keep staff and contractors informed through Teams and email. If those are down, we use phone and text messages.
• Suppliers: we tell suppliers who need to act.

The client and engagement lead owns client messages. The incident lead approves them.

8. Recovery and return to normal

We restore activities in the order set by the business impact analysis. IT and Microsoft 365 come first, then client delivery and payments, then invoicing and bids.

The incident lead closes the incident when normal working is back. Within 10 working days we hold a short review. It covers what happened, what worked and what we will change. We update this plan with what we learn.

9. Testing

We have not yet tested this plan. We will run the first exercise by 31 March 2027. It will be a short desk-based walk-through of one scenario, such as a ransomware attack or the loss of a director. After that we will run an exercise at least once a year. We will record each exercise and the actions that come out of it.

10. Review

The owner reviews this policy every 12 months, and sooner after an incident, an exercise or a major change to our business.

11. Contact

Approval and signature

This policy was approved by the board of Unolabs Limited on 6 November 2026.