Business Continuity Plan General BCP for Castle Wealth Advisors LLC Approved by Executive Management 04-2016 The contents of this document, including and all exhibits and attachments, are confidential in nature and are intended solely for the use of Castle Wealth Advisors LLC. Any other use, reproduction or dissemination of this document is strictly prohibited. Table of Contents Document Overview/ Revision Control Introduction A. Overview B. General Guidelines C. Policy Statement Business Continuity Planning Process A. Business Impact Analysis B. Risk Assessment C. Risk Management D. Risk Monitoring and Testing Roles and Responsibilities A. Executive Management B. Business Continuity Management Team C. Branch Office/ Department Management Activation of the Plan A. Declaring a Disaster/ Disruption B. Defining a Disaster/ Disruption Pandemic Incapacity or Death of Chief Executive Officer Data Backup and Recovery Incident Response and Business Resumption Tasks A. Objectives B. Defining An Incident C. The Command Center D. Incident Notification E. Communications with Regulators F. Public and Media Relations G. Internal Communications H. Damage Assessment I. Contingency Site Preparation and Business Resumption J. Safety and Security K. Human Resources Tasks L. Legal/Insurance Appendix: Corporate Contact List The contents of this document, including and all exhibits and attachments, are confidential in nature and are intended solely for the use of Castle Wealth Advisors LLC. Any other use, reproduction or dissemination of this document is strictly prohibited. Document Overview: Date Created Version Document Classification Owner Status of Document Last Approved 02-25-2016 2.0 Confidential Misty Heather Castle Final 04-15-2016 This is a controlled document and should be treated as such. All reservation and updates shall be documented in the below revision control table and documented to be best ability of the author. A new version of this document shall not be created without revision control being updated. Revision Control: Date Modified 02-20-2016 02-24-2016 02-25-2016 04-15-2016 Revision Author Heather Castle Heather Castle Heather Castle Heather Castle Author Phone 205-310-1888 205-310-1888 205-310-1888 205-310-1888 Define Update Plan Creation Final version created Final version approved Revision approved The contents of this document, including and all exhibits and attachments, are confidential in nature and are intended solely for the use of Castle Wealth Advisors LLC. Any other use, reproduction or dissemination of this document is strictly prohibited. Introduction A. Overview As part of its fiduciary obligation to its Clients, and as a matter of best business practices, Castle Wealth Advisors LLC (CWA or the Firm) has commissioned, and management has approved, this General Business Continuity Plan (BCP) pertaining to all office locations, should there ever become more than one. The plan serves as a centralized repository for the locations Business Continuity (BC) information, procedures, details the roles, responsibilities and tasks needed to effectively and efficiently respond to BC event and to resume mission-critical, time-sensitive business operations and services. This plan is designed to dictate an overview of the policies and procedures of a recovery effort as well as identify key business departments and personnel. This information will assist the company in resuming operations, and to services its clients in a timely manner. Castle Wealth Advisors, LLC had developed and implemented this BCB to continue an acceptable level of business performance in the near term and resume normal business operations as soon as possible. B. General Guidelines The Plan sets forth the following general guidelines: The Business Contingency Management (BCM) Team, will prepare and submit the Plan to Executive Management for review and approval. The Owner is responsible for oversight of the Business Continuity planning process, including the maintenance, testing and revision of this plan. The Owners will review and approve the plan at least annually or when the environment or business focus changes significantly (eg., a material change to the Firm’s location, physical infrastructure, or scope of business or operations. The BCM Team, currently Owner, will maintain the plan on an ongoing basis and test the plan, completely or in part, at least annually or more frequently as determined by Executive Management. The BCM Team will determine the scope, objectives, and schedule of each test. The objectives of east test are to verify the compatibility and performance of CWA’s back-up resources and identify strategic/ procedural enhancements to the BCP in meetings the needs of the organization. All testing should facilitate training of employees with respect to their responsibilities. The contents of this document, including and all exhibits and attachments, are confidential in nature and are intended solely for the use of Castle Wealth Advisors LLC. Any other use, reproduction or dissemination of this document is strictly prohibited. The BCM Team will document the results of each test, make any necessary changes to the plan, and submit the test results and the updated plan to Executive Management for review. C. Policy Statement It is the Policy of Castle Wealth Advisors LLC, that a viable Business Continuity Plan be developed and maintained in order to provide prompt recovery from business impacting disruptions ranging from a temporary loss of power, to a major catastrophe, such as the total destruction of a building or a major damage to a region of the country. The life safety of our employees and visitors while protecting the assets of the company and our clients is the top priority of the plan, as well as assuring our clients access to their funds and securities in the event of a business impacting disruption. The plan should conform to regulatory requirements and good business practices and be consistent with the provision and direction of Castle Wealth Advisors LLC strategic and tactical business plans. Business Continuity Planning Process A. Business Impact Analysis The Operational Risk Committee/ Executive Management shall review and approve at least annually the Business Impact Analysis (BIA) and its identified Business process developed by the BCM Team. The Executive Management Team will be presented with an executive summary of any significant findings once this annual process is completed. Objectives of the BIA include the following: Assess and prioritize Castle Wealth Advisors LLC, business functions that must be recovered, including interdependencies among critical operations, personnel and services Identify the potential impact of business disruptions resulting from uncontrolled, nonspecific events Identify the potential impact of legal, regulatory, financial, reputational, and other such impacts on identified process. Establish Recovery Time Objectives (RTO) and Recovery Point Objections (RPO) to establish the Maximum Allowable Downtime (MAD), as well as the The contents of this document, including and all exhibits and attachments, are confidential in nature and are intended solely for the use of Castle Wealth Advisors LLC. Any other use, reproduction or dissemination of this document is strictly prohibited. acceptable level of loss (eg., data, operations, financial, reputation, regulatory, etc.), associated with each identified process. Each identified function will be prioritized based on its RTO and RPO aiding in the critical path recovery of systems and functions by imbedding both RTO and RPO numbers to each application supporting the function. Current BIA reports are housed on a shared drive allowing for restricted access and availability in the event they are needed during an incident. B. Risk Assessment The Executive Management shall review and approve at least annually the Business Continuity Risk Assessment. This risk assessment shall be incorporated into the overall Information Security Program risk assessment. The purpose of the risk assessment is to evaluate business functions and the BIA assumptions under various threat scenarios. Threats to be considered as part of the assessment include, but may not be limited to: Environmental disasters (Eg., earthquakes, tornados, hurricanes, flooding, fires, snow or ice storms) Pandemic events (eg., flu outbreak) Theft of data loss from negligent or malicious individuals (eg., terrorists, hackers, rogue employees) Infrastructure failure (eg,. Power outages, equipment failures) Management shall analyze the impact, likelihood, and resulting severity of identified threats in order to prioritize its business functions and estimate how they could be disrupted under the various threat scenarios. C. Risk Management Based on the results of the BIA and Risk Assessment, management shall develop appropriate strategies and procedures to recover, resume, and maintain its critical business functions in the event of a business-impacting event. D. Risk Monitoring and Testing Testing the BCP is an essential element of preparedness. Management conducts tests of its BCPs at least annually to ensure the plans remain current and are effective. The tests ensure that all member of the recovery team and any relevant staff are aware of the plan(s) their roles and responsibilities as defined by the plan(s). The contents of this document, including and all exhibits and attachments, are confidential in nature and are intended solely for the use of Castle Wealth Advisors LLC. Any other use, reproduction or dissemination of this document is strictly prohibited. The testing program shall incorporate the following elements: Defined roles and responsibilities of key personnel. IT Management, Crisis Management, Corporate Facilities, Internal Audit (or other independent party), ect. Testing policies and related strategies. Procedures for execution, evaluation, independent assessment, and reporting of test results. Updates to the BCP and testing program Testing methods may include, but are not limited to, tabletop exercises, walkthrough reviews, workspace relocation, ENS notification exercises, functional drills, and interruption tests. After reviewing the test results, a list of recommended improvements and lessons learned shall be developed for review by management and for use in future exercises. All applicable improvements are implemented into the BCP test plan. Castle Wealth Advisors LLC, Business Continuity planning as an iterative process that must be continually updated and improved. Roles and Responsibilities A. Executive Management Executive Management will provide guidance in the management of an incident resulting in the loss of access to primary work place for Castle Wealth Advisors LLC business location and/ or loss of key dependencies at the business location from 24 hours to 30 days. B. Business Continuity Management Team This leadership implementation team will manage, administer and implement the contingency plan. This team shall be reviewed annually by the Executive Management, at which them any member is deemed unable to complete his/her role as outlined below. Once approved by the Executive Management the team may appoint additional members as needed. The team is authorized to take action as necessary to regain full utilization of Castle Wealth Management resources, or alternative sites, as necessary, within the guidelines set forth within this Plan. Actions taken and decisions made jointly by no less than two of the approved team members is considered action by and for the entire team. The CEO of the company may act alone if no other members of the The contents of this document, including and all exhibits and attachments, are confidential in nature and are intended solely for the use of Castle Wealth Advisors LLC. Any other use, reproduction or dissemination of this document is strictly prohibited. Executive Management are available to confer with at the time of the event and it is in the best interest of the company that a decision be made in a timely manner. Ensuring that the plan reflects ongoing change is crucial. The Business Continuity Management team coordinates and is responsible for the maintenance, periodic testing and revision of the plan and for ensuring that any company personnel have access to the plan and are trained I its basic components. General oversight and review of the plan will be under the Operational Risk Committee (ORC). Name Lead: Heather Castle Alternative: TBD Title CEO C. Branch Office Management Branch Office Management will be responsible for the safety of personnel, relocation efforts to designated contingency sites, and damage assessments regarding the affected site. Team members as defined in this plan will be responsible for the roles and responsibilities that have been assigned to them. Detailed descriptions of the roles and responsibilities described are presented in the Incident Response and Business Resumption Tasks section of the Plan. Activation of the Plan A. Declaring a Disaster/ Disruption Executive Management, in coordination with the BCM Team, will determine whether and when to activate this Plan. If affirmed, the Business Continuity Management Team will initiate emergency notifications to Castle Wealth Advisors, LLC, personnel (should any exist) and activate the entire Plan or phases of the Plan, as required. B. Defining a Disaster/ Disruption Low Impact Temporary inability to process work, with the likelihood that processing will functions adequately within 2 hours Trading and clients access to funds and securities are available immediately via duplicate circuits and technical environments Minimal impact on the safety and soundness of the organization Minimal impact on the reputation of the organization This dose not constitute a Disaster The contents of this document, including and all exhibits and attachments, are confidential in nature and are intended solely for the use of Castle Wealth Advisors LLC. Any other use, reproduction or dissemination of this document is strictly prohibited. Intermediate Impact Temporary inability to process work at the home office of Castle Wealth Advisors LLC/ company wide, with an expected resolution timeframe (generally one day) Personal and workload may be transferred to alternate locations Trading and client access to funds and securities are available immediately via duplicate circuits and technical environments Possible financial impact on the organization Possible impact on the reputation of the organization High Impact Inability to process work and/ or service customer needs for an undetermined length of time, generally, more than two days. Personal and workload will be transferred to alternate location due to unable or hazardous conditions. Life safety of personal could or is impacted by the present environment Likely adverse impact on the safety and soundness of the organization Trading and client access to fund and securities are available immediately via duplicate circuits and technical environments Likely adverse impact on the reputation and market risk of the organization Trading and client access to fund and securities are available immediately via duplicate circuits and technical environments Likely adverse impact on the reputation and market risk of the organization Generally includes catastrophic natural disasters (eg., earthquake, tornado, hurricane); and other large-scale events (eg., pandemic flu or terrorism); may also include computer or information system security breach where highly sensitive data is compromised. Pandemic In the event that a pandemic is projected to impact the Firm, management shall review the projections made by relevant authorities, including local or state police, government officials, community public health officials, the World Health Organization (WHO), or specialists in the medical field. Specific actions will be taken based on direction received from these authorities. Leading up to, during and post Pandemic Management will refer to the approved Castle Wealth Advisors LLC, Pandemic Plan for guidance and the Human Resources (HR) department. The contents of this document, including and all exhibits and attachments, are confidential in nature and are intended solely for the use of Castle Wealth Advisors LLC. Any other use, reproduction or dissemination of this document is strictly prohibited. Incapacity or Death of Chief Executive Officer The company has developed a separate succession plan in the event of the death or incapacity. In the event the Chief Executive Officer is incapacitated or deceased, Executive Management, consistent with the succession planning exercise of the other Executive Management Members (should any exist), will appoint an interim officer. These members would act as the interim company leaders in the event the current CEO is unable to perform their duties. Data Backup and Recovery Castle Wealth Advisors, LLC. maintains its primary books and records as described below: Firm Records: Electronically on computer hard-drive, with the ability to edit documents locked. A back-up copy will be located on external hard drive and be updated weekly. Additionally, files will be updated on a monthly basis and held on jump drive offsite in a secure location. Customer Records: Electronically on cloud server and two additional electronic records on an external hard drive updated weekly and a jump drive updated monthly and held offsite in a secure location. All hardcopy records will be held for 6 months at primary location and then boxed and set to storage off-site in a secure location. Castle Wealth Advisors LLC conducts incremental backups every evening with a full backup taken no less than once per week. The e-mail server is subject to a full backup nightly. Shadow backups are also employed allowing recovery of files without having any impact on production systems. These backups are taken multiple times through out the day for overall file restoration convenience. In the event of a disaster that causes the loss of our electronic records, we will recover them from our other electronic records where possible. For the loss of electronic records, we will either attempt to physically recover the storage media or electronically recover data from our backup site; or, if our primary site is inoperable, continue operations from out backup site or and alternate location. The contents of this document, including and all exhibits and attachments, are confidential in nature and are intended solely for the use of Castle Wealth Advisors LLC. Any other use, reproduction or dissemination of this document is strictly prohibited. Incident Response and Business Resumption Tasks A. Objectives The overall objectives of Incident Response and Business Resumption in the event of a significant disruption or disaster are to: Life safety, ensuring safety and health of any employees (should there ever be employees) Limit and contain damage to the facilities and equipment Stabilize operations/ services Manage and communicate information about the incident to customers, regulatory parties, suppliers and vendors Coordinate and manage overall response and recovery efforts Prepare and begin operations at the assigned contingency site(s) B. Defining an Incident Low Severity Minor annoyance or threat Disrupts a very small number of network devices or systems Has little or not risk of propagation or causes minimal disruption of damage in its attempt to propagate Example: Isolated infection; malware on non-critical systems Intermediate Severity Having a moderate probability of propagating to other systems Adversely impacts a moderate number of systems and/ or people, such as an individual department, unit, lightly populated building or branch site Example: Attempts to gain unauthorized access High Severity The contents of this document, including and all exhibits and attachments, are confidential in nature and are intended solely for the use of Castle Wealth Advisors LLC. Any other use, reproduction or dissemination of this document is strictly prohibited. A current or future incident that has been identified as a serious threat to the organization A threat that requires immediate attention or action Any action that threatens the confidentiality, integrity, or availability of critical business and information systems or confidential information (ie., employee, customer, and intellectual property, or third-party vendor date) Life safety of employees is at immediate risk Example: Malicious code, unauthorized access, affecting critical services or a compromised host containing sensitive data. The home office location is highly impacted by a natural or manmade event and is rendered inaccessible. C. The Command Center The Command Center is the physical location at which coordination of information and resources to support management incident activities takes place. The Command Center may be located on-site or in a temporary or permanent facility or be Virtual via a conference bridge. The Command Center should be located away from the emergency scene. Castle Wealth Advisors LLC has chosen the Beverly Hilton Hotel (Address: 9876 Wilshire Blvd, Beverly Hills, CA 90210 Phone:(310) 274-7777) as Command Center should something happen which prevents/ limits access to primary location. The purpose of the Command Center: Command and control coordination and communication Organizing responses and evaluation of incident Tracking and monitoring of business continuity needs to determine which business continuity plan needs to be implemented Tracking responses- track personnel and other deployed resources Updating employee, public, external agencies and executives The CMT will determine what other Company personnel are need and appoint specific personnel to assume these roles depending on the incident, in the event employees are ever hired. Additionally, in the event of power outage or business interruption: 1. Business phone number (424-209-2257) will be remotely call forwarded to alternative phone. This will ensure that should a client, employee, regulator or business partner can contact Castle Wealth Advisors LLC. The contents of this document, including and all exhibits and attachments, are confidential in nature and are intended solely for the use of Castle Wealth Advisors LLC. Any other use, reproduction or dissemination of this document is strictly prohibited. 2. Business mail and communication can be held and picked up from local post office or FedEx facility. D. Incident Notification Corporate Services will provide building management or designee with telephone numbers of key Castle Wealth Advisors, LLC. contacts. Upon notification, from either building management or Castle Wealth Advisors, LLC management, the BCM Team will meet either in physical designated locations, identified virtual locations or in the event of a building evacuation, at designated assembly points. Initial incident assessments will be preformed and recorded and a situational update reported to Executive Management. If necessary the Crisis Management Team (CMT) will convene and advise local resources of further actions. Responsibility Task Building Security When an incident occurs, the on-site security (The BW Apartments management team) will contact Corporate Services (Heather Castle) with the following: 1. Name 2. Location 3. Description of Incident Corporate Services Emergency Notification. After being notified of a situation, Corporate Services will assess, and if appropriate notify the BCM Team, Crisis Management Team and the Damage Assessment Team. Will assemble the following: 1. Corporate Services will attend to affected site location until the Emergency authorities arrive 2. Provide support for any team members 3. Evacuate personnel, if necessary 4. Secure site 5. First Responders should be contacted as necessary Damage Assessment After being notified of a situation the Damage Assessment Team will designate a representative to be the liaison (Heather Castle) with first responders. If allowed to return to the building they should do a general assessment of the overall condition of the site. The Damage Assessment Team will report information to Corporate Service or CMT. Items to Report: 1. Physical structure of the building 2. Security systems: include access control, fire prevention 3. Are access routes available 4. Environmental support systems such as air condition, heating, plumbing, electrical wiring, power supply 5. Hard copy files 6. Telecommunications equipment 7. Computer Systems 8. Affected personnel and their safety status Life Safety is a primary goal and no person should enter a facility if they have not been cleared by onsite first responders or other like personal. Whenever possible take photographs to record visual damage to site and equipment. The contents of this document, including and all exhibits and attachments, are confidential in nature and are intended solely for the use of Castle Wealth Advisors LLC. Any other use, reproduction or dissemination of this document is strictly prohibited. In the event of a shutdown, as pertinent, the Company will utilize their Emergency Notification System (ENS) to email and call any employees potentially impacted by the event. E. Communication with Regulators In the event of a shutdown, the Company will use most effective available means to communicate with its regulator and to meet any regulatory requirements precipitated by the particular circumstances. The Chief Executive has the primary responsibility for communication with regulators during and SBD. F. Public and Media Relations Executive Management is responsible for approving all major communications with the public, including media releases and notifications to customers. The Crisis Communications Team will manage the information flow and content throughout the resumption phase. At Executive Management’s direction, this team will assess the audience and determine the most appropriate and efficient delivery mechanism available. Heather Castle, CEO, will have final approval for outside media and communications. All communication with the media is to be undertaken by the direction of the CEO. Responsibility Task Crisis Communications Press release should be prepared in advance. They should be clear, factual, and concise, with related information distributed from a single source. All press releases must have prior approval from the CEO The Crisis Communication Team should: a. Be available to the Media at all times b. As appropriate, schedule communications with the media c. Coordinate all press releases Notifications to Customers: 1. Coordinate posting of notification to CWA’s website and to subsidiary websites, as appropriate 2. Coordinate posting of alternate address and pertinent information on physical building sites, as needed 3. Coordinate media coverage, if appropriate, to direct customers to alternate sites The contents of this document, including and all exhibits and attachments, are confidential in nature and are intended solely for the use of Castle Wealth Advisors LLC. Any other use, reproduction or dissemination of this document is strictly prohibited. G. Internal Communications The Crisis Communications Team is also responsible for all communications to Castle Wealth Advisors LLC, associates (should any exist). This team will assess the audience need and determine the most appropriate and efficient delivery mechanism available as well as he information to be provided. Responsibility Task Crisis Communications Communication to Business Units. Provide the following: 1. Time incident occurred 2. Expected duration of outage 3. Protocols to follow 4. Key methods of updates/ communications 5. Number to call f normal channels are not working 6. How to track expenses related to recovery 7. Vendors that have been notified 8. Status of recovery site 9. Method of obtaining customer statements 10. HR services, counseling, benefits, payroll Family Support Communications: Work with HR to coordinate any contact with families related to support services being provided. H. Damage Assessment The Damage Assessment Team will be responsible for conducting the intimal damage survey and assessing the probable length of a business site outage. A determination of the level of disaster is to be made. Once made other teams will become involved to further address impact and resumption. Responsibility Task Damage Assessment After being notified of as situation the Damage Assessment Team will designate (CEO, Heather Castle) to be the liaison with first responders. If the team is allowed to return to the building they should do a general assessment of the overall condition of the site. a. b. c. d. Determine physical structure of building Security systems, access control, fire alarm, fire prevention Are access routes available Environmental support systems (air conditioning, heating, plumbing, electrical wiring, power supply) e. Hard copy files f. Telecommunications equipment g. Computer systems Affected personnel (if any exists) The contents of this document, including and all exhibits and attachments, are confidential in nature and are intended solely for the use of Castle Wealth Advisors LLC. Any other use, reproduction or dissemination of this document is strictly prohibited. Determine Impact and coordinate any repairs needed including replacement of any damaged equipment. K. Human Resources Tasks Responsibility Task HR/ Admin Travel Arrangements: 1. Coordinate travel and transportation to alternative site 2. Rent appropriate lodging for recovery team members Procurement of Goods and Services 1. Coordinate purchasing and/or rental of additional office space, computers, equipment Administration of Personnel Issues: 1. Should an associate have injuries, coordinate medical coverage and services Secretarial/ Clerical Support: 1. Bring in additional help as needed Compensation: a. Coordinate compensation b. Document and secure management approval of any special pay or expenses c. Ensure payroll recovery is undertaken L. Legal/ Insurance Responsibility Task BCM Team Notify insurance rep of incident and coordinate involvement in site reviews and initial adjustment activities Monitor the collection and accounting of disaster related expenses Prepare/ present preliminary and final loss and reimbursement summaries to Executive Management Assist in the preparation, review and evaluation the disruption in terms of liability, regulatory requirements and contractual obligations Coordinate legal aspects of crisis related responses to media inquires The contents of this document, including and all exhibits and attachments, are confidential in nature and are intended solely for the use of Castle Wealth Advisors LLC. Any other use, reproduction or dissemination of this document is strictly prohibited. Appendix: Corporate Contact List 1. Ernest Sampson, CEO [email protected] Private Client Services Broker Dealer 502-451-0600 2. Steve Higdon, Chief Development Officer [email protected] Private Client Services Broker Dealer 502-797-5207 3. John Taylor-Jones, Chief Compliance Officer [email protected] Private Client Services Broker Dealer 502-451-0600 4. Mary Wescott, Chief Operations Officer [email protected] Private Client Services Broker Dealer 402-451-0600 5. Jeremy Molsberger, Managing Principal [email protected] Private Client Services Broker Dealer 401-451-0600 ext 212 6. Matt Adams [email protected] Charles Schwab 800-253-1110 7. Emily Uhle [email protected] RIA in a Box 8. Client Service [email protected] Private Client Services (800) 966-9347 9. Client Services Charles Schwab 866-855-9102 The contents of this document, including and all exhibits and attachments, are confidential in nature and are intended solely for the use of Castle Wealth Advisors LLC. Any other use, reproduction or dissemination of this document is strictly prohibited.
© Copyright 2026 Paperzz