PORTFOLIO

Student Version

ICTSAS526
Review and update disaster recovery and
contingency plans
First published 2021

This resource is copyright. Apart from any fair dealing for the purposes of private study, research, criticism or review as
permitted under the Copyright Act 1968, no part may be reproduced by any process without written permission as
expressed in the RTO Works License Agreement.

The information contained in this resource is, to the best of the project team’s and publisher’s knowledge true and correct.
Every effort has been made to ensure its accuracy, but the project team and publisher do not accept responsibility for any
loss, injury or damage arising from such information.

IT Works is a series of training and assessment resources developed for qualifications within the Information and
Communications Technology Training Package.
CONTENTS
Section 1: Review ICT system and threats and risks 5
Section 2: Develop disaster recovery and contingency plan 7

ICTSAS526 Review and update disaster recovery and contingency plans | 3

Student name: Salman Aslam

Assessor:

Date: 27-09-23

Business this assessment is Disaster Recovery and Contingency Plans.

based on:

ICTSAS526 Review and update disaster recovery and contingency plans | 4

Section 1: Review ICT system and threats and risks
Business information Business Information: Grow Management Consultants is a management
consultancy firm that specializes in enhancing the leadership performance of
Summarise what the
other companies' staff. The company offers a variety of services and products,
business does and its key
products and services. which include:

Additionally, describe the Consulting Services: Grow Management Consultants offers consulting services
security environment in to help businesses boost their leadership capacity and staff productivity. As part
which the business of these offerings, we collaborate closely with our customers to develop
operates, as well as leadership plans and provide advice on how to improve existing skillsets.
statutory and commercial
requirements that the
Professional Development Workshops: The firm also offers professional
business needs to abide by. development programs in addition to its consulting services. Structured training
Give at least three examples programs are used in these seminars to assist client company personnel grow
of statutory/commercial as leaders.
requirements and their link
E-books: The organization offers an extensive collection of e-books on a variety
to disaster planning.
of management topics. You may get these e-books from an online store. They
are a great go-to for people and businesses in need of leadership-related
information.

Remote Workforce: All of Grow Management Consultants' employees are

remote workers that do their duties from their own homes. Because of the
necessity of good communication and digital collaboration technologies, they
are able to function within a 10-kilometer radius of each other despite their
geographical separation.

Key Considerations:

E-book Sales: The company's online bookstore's digital books section is a

substantial revenue generator. As a result, the company's operations and
financial performance might be immediately harmed by any downtime
experienced by the online store.

Software Dependency: The company's reliance on software is exemplified by

the fact that it runs exclusively on OneDrive and Microsoft Office for Business.
Consultants can't do their important job without this program. If this program
stops working, the firm will be unable to provide consultancy services, which
would have a negative effect on the online store's capacity to make money.

Data and Document Management: Grow Management Consultants utilizes

zero for accounting, and Microsoft Word documents to maintain data on their
employees and clients. Information and data security are of paramount
relevance due to the vital nature of these systems.

Shortcomings in Cybersecurity: The company may be subject to cybersecurity

risks due to its lack of understanding of cybersecurity dangers and its lack of
precise procedures on antivirus software and firewalls.

ICTSAS526 Review and update disaster recovery and contingency plans | 5

Financial Preparedness: The firm has a solid financial foundation and is
prepared to set aside at least $20,000 annually to invest in catastrophe
preparedness and continuity of operations.

Security Environment

Grow Management Consultants' remote staff and dependence on digital

resources provide a one-of-a-kind security setting for the company. Some
important features of its security system are as follows:

Remote Workforce: All employees work from home, but they are all within a
10-kilometer radius of each other, making it possible for them to telecommute.
Security threats to remote access, data transfer, and endpoints are exacerbated
in a decentralized workplace.

Digital Operations: Crucial business processes, such as consultancy and the

online store, rely significantly on digital technology and software. Because of
how crucial technology is, it must be protected against cyberattacks and other
interruptions.

Data and Document Management: Grow Management Consultants uses

Microsoft Word documents to hold private information including client and
employee details. It is crucial to prevent data breaches and unauthorized access
to this information.

Statutory and Commercial Requirements:

Although the company is not required to comply with any additional laws or
regulations beyond those that apply to other companies, it should nonetheless
take the following guidelines and best practices into account when creating its
disaster recovery and contingency plan.

Data Protection Regulations: The General Data Protection Rules: Grow

Management Consultants may be subject to data privacy laws according on its
region and customers. If it has customers in the European Union, for instance, it
must follow the GDPR (General Data Protection Regulation). Data security and
breach reporting protocols would be key to this kind of disaster preparation.

Business Continuity Standards: Following ISO 22301 and other best practices
for business continuity is recommended but not required by law. Maintaining
essential operations during and after a catastrophe is made possible by
adhering to such standards, which also helps to keep costs low.

Intellectual Property Protection: Given the company's dependence on e-books

for revenue, it is crucial to safeguard the company's intellectual property. To
avoid a loss or theft of e-book material, which might have an effect on income
production, copyright regulations and intellectual property protection
standards should be included into the disaster recovery plan.

Link to Disaster Planning:

ICTSAS526 Review and update disaster recovery and contingency plans | 6

 Compliance with data protection standards requires disaster recovery
processes, frequent data backups, and steps to safeguard customer and
employee data in the case of data loss or breaches.

Business continuity refers to the ability of a company to keep providing its core
services and products, such as consultancy and e-commerce, in the face of a
disruptive incident.

The company's intellectual property and income stream may be safeguarded by

including measures to secure and back up electronic books as part of any
disaster recovery strategy.

While Grow Management Consultants may not be required to do so by law, it is

still prudent for the company to take measures to ensure the safety of its
operations and reduce the impact of disasters on its services and revenue
streams by taking precautions such as backing up data and maintaining
business continuity.

Critical functions III. Critical Functions:

Identify and describe the Consulting Services: Grow Management Consultants is a service that helps
critical business functions businesses and organizations enhance their leadership capabilities via the use
that would significantly of expert advice.
threaten the business if they
Importance: The company's consulting services are a major source of income. If
were to be disrupted or
unavailable for a certain these services were to be interrupted, the firm would suffer cash losses right
period of time. once and perhaps suffer reputational harm as well.

Further identify and describe Professional Development Workshops: Work Shops for Professional Growth
the critical data that the are an additional service that this firm provides alongside consulting.
business holds, as well as
Workshops are crucial for attracting new customers and maintaining existing
software that also
contributes to critical
relationships. Workshop revenue and customer connections are vulnerable to
business functions. disruptions.

Explain the business’ Online E-Book Sale: The Grow Management Consultants online store offers e-
requirements in terms of books on a wide range of managerial topics.
contingencies.
Importance: The company's profitability is heavily dependent on the selling of
electronic books. A sudden drop in sales might result from an outage in the
online store.

Customer Information: Data on customers, such as names, email addresses,

payment information, and purchasing preferences, are kept on file.

Importance: Customer data is essential for advertising, communicating with,

and serving individual customers. Legal and public image problems may arise if
this information were lost or stolen.

Financial Records: Invoices, receipts, and expenditure reports are just some of

ICTSAS526 Review and update disaster recovery and contingency plans | 7

the documents that fall under the purview of Grow Management Consultants'
accounting department.

Importance Accurate financial records are necessary for tax reporting, financial
decision making, and regulatory compliance. There may be monetary and legal
repercussions for any financial data loss or corruption.

Critical Data:

Customer and Staff Information: Personal information about clients and

employees is stored by Grow Management Consultants. Information of this
kind may contain names, addresses, phone numbers, email addresses, and even
financial details. Compliance with data security rules and the maintenance of
confidence among customers and workers need the secure storage of this
information.

E-book Content: The company's vast collection of electronic books is a

significant asset. Copyrighted materials and exclusive management tools are
among the many valuable pieces of intellectual property it has. Significant
financial and reputational costs might result from the loss of or illegal access to
sensitive information.

Financial Records: Accounting and budgeting are impossible without the

company's financial records. Income, expenditure, invoice, and transaction
records all fall under this category. In the event of financial data loss or
corruption, financial operations and regulatory compliance might be
jeopardized.

Online Shop Data: E-book sales and income creation rely heavily on
information connected to the online store, such as product listings, price, and
client orders. Loss of this information might be disastrous to the company's
bottom line.

Critical Software

Microsoft Office for Business: Microsoft Office is a must-have for every office
worker who regularly creates or receives documents, spreadsheets,
presentations, or emails. Consulting reports, workshop handouts, and other
crucial papers all rely heavily on it.

OneDrive: e-books and other important corporate papers are kept on

OneDrive, Microsoft's cloud storage platform. In addition to storing
information, it also makes it easier for dispersed teams to work together by
letting them easily share and edit documents.

Zero: When it comes to managing and keeping track of money, zero is the
accounting software of choice. It's crucial for things like keeping tabs on cash
flow, sending out invoices, and maintaining legal compliance.

Business requirements in terms of contingencies

ICTSAS526 Review and update disaster recovery and contingency plans | 8

Grow Management Consultants has unique needs in terms of contingency
planning. Having a plan in place for when the unexpected happens is crucial for
keeping operations running smoothly with little downtime. In case of
emergencies, the company has the following requirements:

Remote Work Contingencies:

Since everyone on staff works from home, there must be backup plans in case
something goes wrong, such a power loss, internet disruption, or an
unexpected personal emergency. There should be clear communication
mechanisms in place for employees to report and handle difficulties swiftly, as
well as arrangements for backup internet connections and power backup
options (such as uninterruptible power supply).

Backup and Restore of Data: Given the importance of data including customer
and employee details, e-book content, and financial records, having a backup
and recovery plan in place is critical.

Cybersecurity Contingencies Data should be backed up regularly and kept

safely, with a strategy in place for data restoration in the event of data loss or
corruption.

Emergencies in Cybersecurity in light of the current state of cybersecurity, it is

imperative that backup plans be made to deal with malware, phishing, and data
breaches. It is crucial to set up effective firewalls and antivirus programs to
protect sensitive data. To further prepare for, and respond to, cyberattacks,
incident response plans should be made.

Online Shop Continuity: Maintaining the Online Bookstore's Availability is

Critical to Prevent Interruptions in E-Book Sales. This might require using
several servers, multiple payment processors, and multiple customer service
channels.

Online store back-up and restoration should be part of any disaster recovery
strategy.

Consulting Service Continuity: Maintaining project information and client

interactions is crucial for consulting service continuity. In the event that a
consultant is unavailable, it is important to have a plan in place for continuing
the project in their absence.

Communication and Collaboration: To guarantee that remote workers can

continue to connect successfully in the event of an interruption, it is crucial to
have backup plans in place for communication and collaboration technologies.

It's important to set up backup methods of communication and create ground

rules for using complementary resources.

The availability of zero's financial data at all times should be considered a

ICTSAS526 Review and update disaster recovery and contingency plans | 9

 critical business contingency. Regular data backups and a financial management
backup strategy in case of program failure are two examples.

Customer Service: Back-up plans for handling calls and shipments from
customers during service interruptions are essential.

The resources and data needed to remotely assist customers should be

available to customer care agents.

Threats and risks The following are five such dangers and the dangers they pose:

Identify at least five threats 1. External Threat: Cyberattack Data breaches, illegal access, and the theft of
(both internal and external) sensitive information (e.g., customer and employee data) are all possible
to the business’ ICT systems outcomes of the first kind of external threat: cyberattack risks.
and the associated risks this
Risk A successful cyberattack may lead to financial losses, reputational harm,
poses.
legal penalties, and company interruption.
Identify and evaluate risk
controls (prevention and 2. External Threat: DDoS Attacks Distributed denial-of-service (DDoS) assaults
recovery options) to mitigate are a serious external threat that may render an organization's online store and
or prevent threats. Evaluate website inaccessible to consumers.
these risk controls in terms
Risk The corporation might lose sales of e-books, suffer reputational harm
of the business’ cost
constraints and overall
online, and risk losing customers if its services go down.
requirements. 3. Internal Threat: Insider Data Breaches there is the possibility of an insider
data breach, whether on purpose or by mistake, which might jeopardize
sensitive customer or employee information.

Risk Insider data breaches may have serious repercussions, including legal and
regulatory issues, damaged reputations, and the loss of confidence from
customers.

4. External Threat: Supply Chain Disruptions

Risks associated with disruptions in the supply chain of mission-critical software

or services (such as Microsoft Office or the servers that host online stores) may
pose a significant external threat.

Consequences Supply chain interruptions may have far-reaching effects,

including revenue loss, disruption of business operations, and even an effect on
the demand for consultancy services and digital book sales.

5. External Threat: Third-Party Security Vulnerabilities

Threat Threats: Cloud hosting services and e-commerce platforms are examples
of third-party providers that could have security flaws that hackers might
exploit.

Data breaches, service interruptions, and tarnished reputations are all possible

ICTSAS526 Review and update disaster recovery and contingency plans | 10

 repercussions of compromised third-party suppliers.

Risk Controls:

1. Risk: Cyberattacks (e.g., malware, phishing, ransomware) Prevention

Controls:

Install reliable antivirus software on all of your devices to protect yourself from
malicious software.

Filtering Email: Use email filtering software to detect phishing attempts and
store any hazardous attachments safely out of the way.

Train your staff to spot and prevent cyber hazards with consistent cybersecurity
awareness training.

Regulators of Recovering:

Performing Frequent Backups: Keep regular backups of your most important

data in case your system is ever hit by ransomware.

Prepare for cyberattacks by creating and routinely testing an incident response

strategy.

2. Risk: DDoS Attacks

Prevention Controls: DDoS Mitigation Services: Hire a service to monitor for and
stop assaults as they happen.

Web content distribution systems (CDNs): Use content delivery networks

(CDNs) to disperse online traffic and mitigate DDoS attacks

. Regulators of Recovering: Protect your website from prolonged DDoS attacks

with redundant hosting.

3. Risk: Insider Data Breaches

Prevention Controls: Use RBAC to provide users specific permissions to see

data sets depending on their specific job functions. Keep an eye on your staff,
particularly if they have access to critical information.

Tools for Preventing Data Loss: Make use of data loss prevention techniques to
keep sensitive information from falling into the wrong hands.

Regulators of Recovering: Logging and Monitoring of Data: Keep detailed

records so that you can find out who is responsible for data breaches. Create a
strategy to respond to incidents like data breaches quickly.

4. Risk: Supply Chain Disruptions

Prevention Controls: Examine the security measures and trustworthiness of

important vendors.

Multiple vendors should be considered for mission-critical software and

ICTSAS526 Review and update disaster recovery and contingency plans | 11

services to lessen dependency on any one provider and increase redundancy.

Regulators of Recovering: Create a Business Continuity Plan (BCP) including

supply chain recovery measures.

Emergency Restore Companies: Create ties with alternative service providers so

you may easily transfer providers if necessary.

5. Risk: Third-Party Security Vulnerabilities

Prevention Controls:

Regular Vendor Assessments: Continuously assess the security posture of third-

party providers.

Security SLAs: Include security requirements in service-level agreements (SLAs)

with third-party providers.

Recovery Controls:

Plan how security issues involving vendors will be escalated to the next level of
support. Due diligence: Vendor evaluations and security service level
agreements (SLAs) may need more work and discussion, but they are essential
for reducing exposure to risks caused by vulnerabilities in third-party services.
This investment is in line with the company's need for safe interactions with
outside vendors.

When assessing the efficacy of these risk controls, businesses must strike a
balance between the costs involved and the benefits gained in terms of
consumer confidence, data privacy, and company continuity. Some of these
precautions may have recurring costs, but they are expenditures necessary to
protect the company from the dangers that have been recognized.

ICTSAS526 Review and update disaster recovery and contingency plans | 12

Section 2: Develop disaster recovery and
contingency plan
Industry standard Report on Industry-Standard Procedures for Cyber Attack Recovery and
procedures Contingency Planning

Conduct research and then Prepared by Salman Aslam

report on industry standard
Date: 23-09-23
procedures for disaster
recovery and contingency Executive Summary: Cybersecurity is a top priority for organizations in the
planning. digital age. Cyber Attacks can have devastating consequences, including data
Describe these standard breaches, financial losses, and damage to an organization's reputation.
procedures and how you will Therefore, it is crucial for businesses to establish industry-standard procedures
ensure that they are for Cyber Attack recovery and contingency planning. This report outlines key
reflected in your disaster procedures and best practices in this critical area.
recovery and contingency
plan.
1. Incident Identification and Classification:

Detection: Employ advanced threat detection tools and techniques to identify

Cyber Attacks promptly. This includes intrusion detection systems (IDS),
intrusion prevention systems (IPS), and security information and event
management (SIEM) solutions.

Classification: Categorize cyber incidents based on severity and impact to

prioritize response efforts. Incident classification helps in allocating resources
effectively.

2. Incident Response Plan (IRP):

Develop and maintain a comprehensive IRP that outlines the step-by-step

procedures for responding to cyber Attacks.

Define roles and responsibilities of incident response team members and

establish communication channels for incident reporting and coordination.

3. Containment and Eradication:

Stop the bleeding of data and harm as soon as possible by isolating the
problem. Locate and remove the origin of the attack from the compromised
machines.

Recover and restore damaged systems and data from safe copies.

Verify the accuracy of data and do extensive tests to make sure everything is
running well.

5. Communication and Notification: Create a strategy for communicating with

internal and external stakeholders that specifies how and when they will be
notified of the event.

ICTSAS526 Review and update disaster recovery and contingency plans | 13

If required to do so, adhere to data breach notification laws and regulations.

6. Forensic Analysis: Conduct a forensic study to ascertain the scope of the

breach, the attack vector, and any exploited vulnerabilities. Keep records for
use in any future inquiries or lawsuits.

7. Patching and Remediation: identify the vulnerabilities that were exploited in

the attack by applying security patches and other measures.

you avoid future attacks, be sure you install all available security updates and
patches.

8. Business Continuity and Recovery Make sure essential company operations

can continue during and after a cyber Attack by creating a business continuity
plan (BCP). Set up redundant systems and data to cut down on outages.

9. Employee Training and Awareness: Provide your staff with cybersecurity

training and encourage a culture of security awareness. Regularly teach
employees to recognize and avoid social engineering and phishing attempts.

10. Legal and Regulatory Compliance: Maintain conformity with all applicable
laws and regulations governing cybersecurity and data storage that are
particular to your industry. Manage risks associated with lawsuits and legal
claims by working with experienced attorneys.

11. Post-Incident Evaluation and Documentation: Conduct a detailed post-

mortem study to assess the efficacy of the reaction and document the results.
Note any changes or updates made to the incident response plan or security
policies as a result of the lessons learned.

12. Continuous Improvement Never Stop Bettering Cybersecurity measures

must be constantly monitored and updated to counteract new and emerging
threats. Keep up with the latest cyber risks by joining networks that share
threat information.

Conclusion: Organizations in today's digital world must prioritize cyber Attack

recovery and contingency preparation. Detection, reaction, recovery, and
prevention of cyber Attacks are all covered under best practices. The effects of
cyber catastrophes may be mitigated, assets protected, and stakeholder
confidence preserved if firms follow certain protocols and best practices.
Report's Over

Describe these standard procedures and how you will ensure that they
are reflected in your disaster recovery and contingency plan
1. Business Impact Analysis (BIA): In order to prioritize recovery efforts, BIA
entails identifying essential business processes, evaluating their value, and
deciding tolerable downtime.

strategy: Include BIA preparation in your disaster recovery and contingency

strategy. It should describe the process through which mission-critical business

ICTSAS526 Review and update disaster recovery and contingency plans | 14

 processes are identified, prioritized, and prioritized for recovery. Each
function's maximum allowable downtime should be stated here as well.

Identifying and evaluating the effect of internal and external risks on a

company's operations is the primary goal of a risk assessment.

2. Risk Assessment: A risk assessment section detailing the procedure for

identifying and rating potential dangers and weaknesses should be included in
the strategy. It should detail how the risks to the company's operations are
evaluated and what actions are taken as a result.

3. Backup and Data Recovery: Data backups and recovery methods should be
performed on a regular basis to protect data availability and integrity.

Data backup and restoration processes should be included in the strategy. It

should detail how frequently data is backed up, where it is kept securely (both
locally and remotely), and how often its recoverability is evaluated.

4. Incident Response Plan: explanation of what a "incident response plan" is

and what it does in the case of a tragedy or cyberattack. Members of the
incident response team are given specific duties. The incident response plan
should be included in the disaster recovery and contingency plan. It should
outline the roles and duties of the incident response team and define the
particular measures to be taken in the event of different occurrences, including
cyberattacks.

5. Training and Awareness: Cybersecurity training and awareness programs

teach workers to reduce the risk of insider threats and enhance incident
response preparedness.

A component on training and awareness for employees should be included in

the strategy. To keep personnel educated and ready, it should detail how often
cybersecurity training programs will be updated, what subjects they will cover,
and how they will be implemented.

6. Drills and tests, Number: Description: Testing the disaster recovery plan on
a regular basis using tabletop exercises and simulations helps determine how
well it is working and where it may be improved.

Disaster and recovery plan Disaster and recovery plan

Develop a disaster recovery By incorporating these industry-standard procedures into the disaster recovery
and contingency plan in a and contingency plan, an organization can create a comprehensive document
format of your choice. that addresses key aspects of preparedness, response, and recovery. Each
Your plan should include the procedure should have clear instructions and responsibilities, ensuring that the
following as a minimum: organization is well-prepared to handle various threats and disasters effectively
 The purpose of the plan. 1. Purpose of the Plan Objectives:
 Threats to ICT systems

ICTSAS526 Review and update disaster recovery and contingency plans | 15

 and risks this presents. This Disaster Recovery and Contingency Plan has been drafted with the goal of
protecting daily operations against things like cybercrime, natural catastrophes,
 Disaster recovery and and even human mistake. The plan's goals are to limit disruptions, safeguard
prevention strategy vital information and infrastructure, and make it easier to respond quickly and
based on the business’
efficiently to events.
requirements, cost
constraints, risks This strategy covers everything from ICT infrastructure and data to employee
identified and standard training and operational procedures. It details strategies for protecting against,
industry procedures. reacting to, and recovering from a variety of hazards.
Explain how your
strategy addresses each 2. Dangers to Information and Communication Technology Systems
of these.
Recognizing Danger:
 Processes/actions to be 1, Malware, Ransomware, Cyber Attacks 2Earthquakes and other natural
followed, including calamities 3Risks caused by humans (such as inadvertent data erasure)
cutover criteria plan.
Each risk has been evaluated in light of its potential to disrupt corporate
Remember that your plan
operations in some way, whether it via monetary losses, data breaches, or
can be a high level plan as
reputational harm. The potential dangers have been ranked by how likely they
not all incidents can be
are to occur and how severe they may be.
included in the plan i.e. it
can be high level actions to Third, a plan for dealing with and averting disaster. Essential for Business:
be taken rather than specific Determine which company activities are most important and rank them
actions in relation to ICT accordingly. Recovery Time Objectives (RTOs) should be established for each
incidents. Your plan will essential service. Make sure your data is accessible and unaltered.
allow for these to be
developed specific to the 3. Expenditure Restraints: Invest at least $20,000 annually on preventative
ICT incident. measures. Find a happy medium between spending and the importance of
features and data.

Identified Threats Take action to reduce, eliminate, and recover from potential
dangers.

Common Practice in the Field:

Include BIA, risk assessment, backup and recovery, incident response, training
and testing, and other practices that are common in the industry.

Explanation: Critical functions are identified, and allowable downtime is set, to

meet business needs. The backup and recovery procedures guarantee the
data's availability and integrity. Allocating a budget and optimizing resource
allocation in light of company needs and risks helps take costs into account.

Strategies for mitigating, preventing, and recovering from the risks indicated in
the threat assessment are implemented. The strategy is aligned with best
practices since it incorporates standard industry processes.

4. Processes/Actions to be Followed

Roles and duties for responding to incidents must be established for the
Incident Response Team. Create lines of contact for reporting and coordinating

ICTSAS526 Review and update disaster recovery and contingency plans | 16

 incidents.

Notification and Communication Plan out how information will be shared in the
event of an emergency. Follow all data breach notification laws and regulations.

Immediately containing occurrences and eliminating their causes should be

spelled out in detail.

Include backup systems and testing in your data recovery and restoration
operations.

Business Continuity Ensuring the continued operation of vital operations during

and after an event requires the creation of a business continuity strategy.

Elaborate on how you'll evaluate past incidents in order to improve future

versions of the plan in light of what you've learned.

5. Cutover Criteria Plan

Specific danger indicators or occurrences that exceed established severity

thresholds are two examples of criteria that might initiate recovery operations.

Checking and Double-Checking: Specify what kind of regular drills and exercises
will be used to evaluate the plan's efficacy. Explain how you will know whether
your most important data and functionalities have been restored.

An organized method of mitigating risks, maintaining corporate operations, and

recovering from disruptions to information and communication technology
(ICT) systems is provided by this Disaster Recovery and Contingency Plan. It
stresses testing and continual improvement, outlining defined protocols and
criteria for kicking off recovery operations.

Presentation Disaster Recovery and Contingency Plan

Write the title of your
presentation here and attach
it to your Portfolio.

Attach: Disaster recovery and contingency plan ☐

ICTSAS526 Review and update disaster recovery and contingency plans | 17

 Presentation ☐

Complete this section following your presentation.

Feedback Feedback Summary:

Summarise the feedback The comments we got during the presentation of our catastrophe recovery and
you received here and your contingency plan were quite helpful. Following is a synopsis of the comments:
response to the feedback.
Content Clarity: The text was well-organized and simple to follow, so people
Attach your updated could grasp the big picture and the details of the strategy.
disaster recovery and
contingency plan based on Participation: The audience members said they like how involved they were in
the feedback you received. the presentation. It was remarked how helpful the use of pictures and
straightforward presentation were.

Coverage: Threats, risk controls, and industry standards were all discussed at
length, and the audience much appreciated this attention to detail in the
disaster recovery plan.

Visuals: Slides and diagrams, for example, were deemed useful in

communicating complicated ideas to the audience.

Delivery: The presentation was praised for its clarity and confidence in the
speaker's ability to convey the strategy to the audience.

Responses to Questions: The presenter did a good job of addressing audience

members' queries and concerns and elaborating when necessary.

Response to Feedback:
We learned a lot from the comments and questions from the audience
throughout the presentation, and we thank you for taking the time to provide
them. Thank you for helping us make our catastrophe recovery and contingency
plan the best it can be.

Continued Clarity: Continued Maintaining a dedication to providing material

that is easy to read and comprehend is a top priority, and we will not deviate
from this policy.

Engagement: To keep our audience interested and engaged, we will continue to

employ eye-catching imagery and a conversational presenting style.

Comprehensive Coverage: Our disaster recovery plan will continue to be all-

encompassing, covering all the bases in terms of the safety and recovery of our
information and communication technology systems.

Visual Enhancements: Opportunities to improve the use of images to simplify

difficult topics will be investigated.

Delivery Style: We will continue to present in the same straightforward and

ICTSAS526 Review and update disaster recovery and contingency plans | 18

 assured manner that has helped us build such a strong rapport with our
audience.

Effective Communication: To ensure everyone is on the same page, we are

committed to answering inquiries and resolving problems as soon as possible.

Updated Cybersecurity Contingency and Recovery Plan

Introduction: In the event of unforeseen circumstances, such as cyberattacks,
natural catastrophes, or human error, the Disaster Recovery and Contingency
Plan will kick in to keep operations running smoothly. Our whole company,
including its information and communication technology infrastructure, data,
employees, and procedures, is covered by this strategy.

Assessing Risks and Managing Dangers:

ICT System Threats

Data breaches, monetary losses, and reputational harm are all possible
outcomes of cyberattacks, the likes of which include malware and ransomware.
Earthquakes and floods are only two examples of natural disasters that may
cause interruptions in data centres and other physical infrastructure.

Data loss and interruption of operations may occur as a consequence of human

error, such as the deletion or mismanagement of data. We analyse the risks
associated with these dangers by calculating the possible monetary loss, data
leakage, and brand harm. Dangers are ranked by how often they are to occur
and how severe they may be.

Disaster Recovery and Prevention:

Business Requirements: Identify and Prioritize Critical Functions. We identify

essential functions and define acceptable downtime (Recovery Time Objectives
- RTO) for each. Ensure Data Integrity: Data availability and integrity are
prioritized.

Cost Constraints: Budget Allocation: A budget of at least $20,000 per year is

allocated for prevention measures.

Resource Optimization: Costs are balanced with the criticality of functions and
data to optimize resource allocation.

Risk Mitigation: We address risks through mitigation, prevention, and recovery

strategies. Standard industry procedures, including Business Impact Analysis
(BIA), risk assessment, backup and data recovery, incident response, employee
training, and regular testing, are integrated into our plan.

Incident Response Plan: Incident Response Team: Specific roles and

ICTSAS526 Review and update disaster recovery and contingency plans | 19

 responsibilities are designated within our incident response team.
Communication Channels: Clear communication channels for incident reporting
and coordination are established.

Communication and Notification: Communication Protocols: We define

communication protocols for notifying stakeholders in case of incidents.
Compliance: We ensure compliance with legal and regulatory requirements for
data breach notification, when applicable.
This updated section provides a detailed overview of disaster recovery and
contingency plan, addressing the feedback received.

Task sign off Dear Teacher,

Write an email here I hope this email finds you well. I wanted to provide you with an update on our
indicating your response to Disaster Recovery and Contingency Plan, which we recently presented. We have
the feedback and requesting received valuable feedback from our audience during the presentation, and I
final task sign off. am pleased to share our response to the feedback and kindly request your final
task sign-off.

Our response has prioritized enhancing content clarity, maintaining engaging

visuals, ensuring comprehensive coverage, and refining our confident delivery
style. We remain committed to addressing questions promptly, demonstrating
our dedication to continuous improvement.

With the feedback incorporated, we believe that our Disaster Recovery and
Contingency Plan is now well-prepared for final task sign-off.

We have updated the relevant sections of the plan to reflect these

improvements. I would be grateful if you could review the attached updated
section and provide your final sign-off, indicating your approval for the
completion of this task.

Your guidance and feedback have been invaluable throughout this process, and
I would like to express my gratitude for your support.

Thank you for your time and consideration. I look forward to your response.

Best regards,

Salman Aslam

ICTSAS526 Review and update disaster recovery and contingency plans | 20