BCMS-Policy-Ver 1 0

Business Continuity Management Policy
Version Prepared by Reviewed by Approved by
Ver 1.0 Jickson Kenton Venugopal Mudhaliar Saurabh Sharma
Master reference Release date Reviewed on Next review date
BCMS-001 21/06/2022 NA-First release 20/06/2023
© Firstsource Solutions Limited | RESTRICTED | January 25, 2023 1

Table of Contents:
1. Introduction ................................................................................................................. 4
1.1 Purpose ......................................................................................................................... 4
2. Scope ............................................................................................................................ 5
3. Scope .............................................................................. Error! Bookmark not defined.
3.1 Personnel ........................................................................ Error! Bookmark not defined.
3.2 Locations......................................................................... Error! Bookmark not defined.
3.3 Compliance with the policy, standards and certificationError! Bookmark not defined.
4. Goals and objectives ...................................................... Error! Bookmark not defined.
5. BCMS policy.................................................................................................................. 6
6. Governance .................................................................................................................. 7
7. Enforcement and violation .......................................................................................... 7
Annexure A – Information Classification Details.................................................................................... 8
Annexure B – Version history (changes since last version).................................................................... 9

1. INTRODUCTION
1.1 PURPOSE
The purpose of this Business Continuity Management Policy (“BCM Policy”) is to ensure that the products and
services Firstsource Solutions Limited and all its global subsidiaries (collectively “Firstsource”) provides continue
to be delivered to our customers at contractually agreed levels during operational disruption and are in line with
ISO 22301 standards. Firstsource, through this policy, will support its corporate strategy of meeting
organizational objectives through continued delivery of operations as committed to its Clients.
Firstsource’s growth is built on the trust that its clients and business communities have placed Firstsource’s best
practices. It is therefore necessary that Firstsource’s services and infrastructure are capable of effectively
sustaining any eventualities occurring due to actual or potential threats (both internal and external) that are
likely to have an adverse impact on business as usual.
Firstsource is committed through this policy to proactively:
a. Plan, establish, implement, operate, monitor, review, maintain and continually improve on its BCM
framework and commit to satisfy applicable requirements in line with ISO 22301:2019 standard framework,
by having a process driven and documented Business Continuity Management System (BCMS)
b. Ensure the continuity of its prioritized services and/or products including the activities that support them;
c. Meet and continue to manage the expectations of interested parties such as be auditors, Board, Clients or
Vendors as relevant for managing the Business Continuity Program
2. SCOPE
2.1 This policy applies to:
2.1.1 PERSONNEL
All Firstsource staff, contract, vendors, sub-contractors and key interested parties, such as be auditors, Board,
Clients or Vendors as relevant for managing the Business Continuity Program personnel working out of
Firstsource offices across all its locations in India, Philippines, UK, USA and Mexico.
2.1.2 Infrastructure and information processing systems

All Firstsource infrastructure, technologies, applications and other information processing systems that are
required to deliver critical services to its customers.
2.2 Compliance with the policy, standards and certification

Firstsource shall be compliant with ISO 22301 standards and based on the client and/or contractual
requirements, some of the centers will undergo ISO 22301 Certification. This strategy shall be fully
integrated into all our clients’ day-day operations and shall work in conjunction with other organizational
policies and applicable regulations.
3. SCOPE EXCLUSIONS
All client offices from where Firstsource provides services are excluded from the BCMS scope.
Exclusions from this policy are:

Exclusions Reasons for exclusions
Recovery of client/customer managed infrastructure Firstsource does not have control over client
hosted within Firstsource facilities; managed infrastructure
Operations and recovery managed by client from their Firstsource does not have control over clients site
site;
Processes/sub-processes not having Firstsource Firstsource is not accountable for processes and sub-
Operations accountability; processes that are not included in the scope of work
agreed with its clients;
Merger and Acquisition entities until integration; Firstsource would implement ISO 22301 framework
only after integration
4. GOALS AND OBJECTIVES

Following is Firstsource’s BCM Goal:
“Set-up a best-in-class Business Continuity Management Systems for our clients ensuring optimal response,
as per the agreed targets of process and service criticality and build resilience to threats and attacks severely
impacting our continuity of service thereby securing the safety of humans, assets as well as company’s
reputation.”
Firstsource is poised to achieve the above goal statement through the following objectives:
1. Ensure a harmonized approach to Business continuity management across all Business Departments
2. Ensure all our clients are resilient against major failures, disasters, and attacks
3. Obtain Business Continuity Management Systems (BCMS) Certification (ISO 22301:2019) for one or select
centers across the globe and ensure that the framework is applied to all centers where Firstsource is
operating.
4. Details on implementation and maintenance of a robust BCMS at Firstsource is documented in a separate
manual called “Firstsource’s BCMS Manual.
5. Design, develop, manage and govern a Business Continuity Management System (BCMS) Framework;
6. Meet and continue to manage the expectations of interested parties such as be auditors, Board, Clients
or Vendors as relevant for managing the Business Continuity Program
7. Design and institutionalize the BCM processes holistically across the Business Units and Geographies and
corporate functions based on a pre-defined BCM criteria;
8. Develop strategies, plans and procedures to ensure resumption, recovery and restoration of prioritized
services, in a structured manner until return to normalcy (BAU);
9. Develop and implement an effective testing and exercise program as per the BCM Process Document
10. Conduct periodic reviews annually or whenever significant change(s) take place;
11. Establish and implement an incident management program to manage an effective response during a
disruption;
12. Develop a business continuity awareness and training program to spread the awareness of BCM culture
across Firstsource’s organisation and as applicable to relevant BCM roles within the organisation;
13. Adhere to and comply with applicable legal, statutory, regulatory and contractual obligations of the
business.

5. BCMS POLICY
Firstsource commits to ensure availability of its critical equipment, services, personnel, suppliers, infrastructure
and applications to its relevant stakeholders and to continue its critical and essential business operations during
a disruption of a disaster as contractually agreed with the client.
Firstsource understands that any disruption to the operational activities of our client may have significant and
wide impact on the returns to their investors. In its pursuit to become a partner of choice that values excellence,
discipline and inspiration, Firstsource is committed to implement and maintain BCMS Policy to support holistic
program for business continuity thereby enabling resilience. The purpose of this policy is to effectively prepare
for and respond to any major disaster or crisis faced by the organization with a focus on achieving its strategic
goals. During such disruptions, BCMS ensures continuity of all critical business operations, thereby enabling our
clients in meeting their internal and external stakeholder commitments, legal, regulatory and contractual
obligations.
Firstsource shall take all required steps to ensure:
• Safety, protection and wellbeing of its employees, contract workers and customers
• Safety and protection of its assets
• It is resilient against major business disruptions like disasters, pandemics, attacks and failures
• A harmonized and consistent approach to BCM throughout the organization
• A leader of BCM practice and a role model for other organizations
To fulfil this commitment, Firstsource shall:

• Establish a holistic BCMS that identifies potential threats and risks which may disrupt our operations and
develop effective mitigation strategies and responses
• Implement, exercise, maintain and improve Emergency Response Plans (ERP), Crisis Management Plan(CMP),
Business Continuity Plans (BCP) and IT Disaster Recovery Plans (ITDR) to minimize or eliminate the negative
impacts of a disaster or crisis to our organization
• Align our technological priorities, capabilities, readiness and availability to the business requirements
• Implement a robust corporate communication and stakeholder management strategy for internal, external
stakeholders and media during emergencies
• Actively build and embed a business continuity culture through awareness and training activities
• Incorporate BCM requirements into our existing operations, processes and plans
• Identify our dependencies with critical vendors and partners to ensure their availability and support during
any disruption
• Integrate Business Continuity with Physical Security, Cybersecurity and Information Security
• Allocate necessary resources and funding for driving BCMS
• Achieve maturity in BCMS and get certified on international standard ISO 22301:2019 – security and
resilience – Business Continuity Management Systems (BCMS)
• Review the effectiveness on regular basis to ensure continual improvement of BCMS

6. GOVERNANCE
• The policy implementation responsibility rests with the pre-defined roles as described in the BCM
Roles and Responsibilities in the BCMS Framework/Procedures/documents that shall be read along
with this Policy;
• The Global BCM Head is responsible for overall alignment of BCM objectives by
a. Integrating with other corporate functions/management system initiatives, to leverage the
commonalities for effectiveness and sustenance
b. Taking reasonable decisions post consultation with the appropriate stakeholders (as relevant) to
invoke BC and communicating it to the right business stakeholders during and post disruptive
events
c. Reviewing potential threats that may lead to trigger a situation to invoke BC
d. Driving reviews on the overall performance and governance of the BCM
e. Ensuring periodic evaluation, monitoring of effectiveness of BC requirements
• To achieve the aforementioned objectives, the Global BCM Head shall be supported by the Global
BCM team
• The Business units and corporate functions shall seek necessary guidance and advisory from the
corporate BCM team for adherence and compliance to this BCM Policy and Framework globally
7. COMMUNICATION
FIRSTSOURCE BCM TEAM shall ensure that the BCMS Policy is communicated to all internal staff, third parties
such as vendors, suppliers, contractors, government and regulatory authorities, customers and other external
stakeholders as necessary. The communicating channels would be at the discretion of the BCMS leader (to be
designated in the BCM Process Document) AND can be on emails, townhall meetings, leadership messages,
training, awareness, induction programs, posters, printed media, Intranet etc.
8. ENFORCEMENT AND VIOLATION
The Business Continuity Steering Committee (BCSC) is responsible for ensuring the enforcement of this policy
across Firstsource operations.
Any activity resulting in non-compliance with this policy would be considered as a violation. Violations to this
policy shall result in disciplinary action, which will be consistent with the severity of the incident as determined
through an investigation. Serious violation may result in major disciplinary actions, including termination of
employment / services / business relationship.
9. REVIEW AND MAINTENANCE
This Business Continuity Policy shall be reviewed when significant changes occur in the organization or at least
on an annual basis.

ANNEXURE A – INFORMATION CLASSIFICATION DETAILS
Classification: Firstsource Restricted
Information Owner (IO): Operations risk and Business continuity team
Information Custodian (IC): BCM team
Authorization List (AL): All employees, Existing/Prospective Clients.
Declassify on: Never

ANNEXURE B – VERSION HISTORY (CHANGES SINCE LAST VERSION)
Date Version Number Changes made
Draft 1.0 - Draft copy;
31/05/2022 Draft 1.1 Legal inputs incorporated
20/06/2022 Draft 1.2 Corporate Communications inputs incorporated
21/06/2022 Ver 1.0 Initial release

BCMS-Policy-Ver 1 0

Uploaded by

Copyright:

Available Formats

BCMS-Policy-Ver 1 0

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

BCMS-Policy-Ver 1 0

Uploaded by

Copyright:

Available Formats

Business Continuity Management Policy

Version Prepared by Reviewed by Approved by

Ver 1.0 Jickson Kenton Venugopal Mudhaliar Saurabh Sharma

Master reference Release date Reviewed on Next review date

BCMS-001 21/06/2022 NA-First release 20/06/2023

© Firstsource Solutions Limited | RESTRICTED | January 25, 2023 1

© Firstsource Solutions Limited | RESTRICTED | January 25, 2023 3

2.1 This policy applies to:

2.1.2 Infrastructure and information processing systems

2.2 Compliance with the policy, standards and certification

© Firstsource Solutions Limited | RESTRICTED | January 25, 2023 4

4. GOALS AND OBJECTIVES

© Firstsource Solutions Limited | RESTRICTED | January 25, 2023 5

To fulfil this commitment, Firstsource shall:

© Firstsource Solutions Limited | RESTRICTED | January 25, 2023 6

8. ENFORCEMENT AND VIOLATION

9. REVIEW AND MAINTENANCE

© Firstsource Solutions Limited | RESTRICTED | January 25, 2023 7

© Firstsource Solutions Limited | RESTRICTED | January 25, 2023 8

Date Version Number Changes made

Draft 1.0 - Draft copy;

31/05/2022 Draft 1.1 Legal inputs incorporated

20/06/2022 Draft 1.2 Corporate Communications inputs incorporated

21/06/2022 Ver 1.0 Initial release

© Firstsource Solutions Limited | RESTRICTED | January 25, 2023 9

You might also like