Policy status: Approved and actively followed. We operate business-continuity planning, impact analysis, escalation and recovery governance. Effective April 11, 2026.
Purpose and scope
We keep critical services available or recoverable within approved business tolerances following disruptive events.
This policy applies to personnel, contractors, technology and third parties acting for Pingplus Media to the extent of their approved access and applicable agreements. Customer and supplier responsibilities are aligned with our executed contracts and applicable law.
Controls and practices in operation
- We document business impact analysis for SMPP acceptance, delivery status, supplier routing, account/wallet, billing/settlement, database services, customer support and public website, including critical dependencies and contacts.
- We maintain documented recovery time and recovery point objectives for critical services using business impact, service architecture and infrastructure dependency assessments. Any applicable recovery constraints and compensating arrangements are captured in the active continuity plan.
- We maintain active recovery playbooks for application outages, database server loss, compromise, partner or network outages and backup-storage loss. Our response procedures preserve data integrity and audit trails during authorised recovery or failover actions.
- We operate a business continuity tabletop exercise programme and schedule controlled, isolated recovery exercises through the authorised change process. We document exercise results and improvement actions.
- We document customer communication and emergency supplier coordination; no unapproved live failover/rerouting, rebind or traffic shift is permitted.
- We review critical supplier, alternate connectivity and site dependency changes before relying on them in external questionnaires.
Review and responsibility
BIA and contact review every six months; annual exercise; on critical dependency changes.
Accountability and reporting
Our personnel, contractors and in-scope service partners follow this policy, with established channels for prompt reporting of suspected security issues. Exceptions are recorded, reviewed and approved by an authorised policy owner. Applicable customer contracts and legal duties continue to govern the services provided.