Task
Critique an organisation’s disaster recovery plan and evaluate the proposed recovery model.

Subject Learning outcomes
Demonstrate an understanding of cybersecurity and the likely cyber-attack vectors on a business or organisation
Develop and justify a cyber security strategic plan and what it should contain ensuring legal obligations are being met.
Design cyber security policies to mitigate the common weaknesses in ICT systems, such as human factors, out-of-date protection, the currency of protocols and be able to institute organisational data governance protocols.
Analyse weaknesses in information protection of a business and be able to determine risks, threats and controls.
Critically discuss a cyber disaster plan and evaluate a recovery model.
Explain the responsibilities of a cyber security manager and the implications of non-compliance by workers.
Procedures
Choose a plan to examine:

A cyber security disaster plan will be provided for you to use (Large)
Or a small organisation
Note: an organisation’s disaster recovery plan will cover more than the ICT infrastructure and resources associated with it, but there would be very few organisations where ICT was not the major component of the plan and the recovery model. This assessment focuses on the cyber component of the disaster recovery plan.

Write a report assessing the Cyber Disaster Recovery Plan (or component of a larger plan) and associated Business Contingency Strategy. Your report should include an assessment of the following:

What is the coverage of the plan?
Who is involved?
Business Continuity strategy
The extent of possible problems and ramifications of the loss of various parts of IT infrastructure
Detail of procedures to be followed
Scenarios covered (e.g. threats, timelines and resource estimates)
Staffing issues
Equipment, communication, system, data/record issues coverage
Legal compliance requirements
Media output
Conclusion of assessment covering good and poor features
Recommendations
A sample organisation’s cyber security disaster recovery plan
Choose either: a large organisation’s disaster recovery plan or a smaller organisation’s plan.

Large organisation
North Carolina Central University is a large organisation with a complete Disaster Recovery Plan, but you are concentrating on how they plan to recover their IT infrastructure. Being a university, they may well be a target for information leakage.

Ornat, S 2014, Information Technology Services Disaster Recovery Plan, North Carolina Central University, viewed March 3 2021, .

OR

Smaller organisation
If you are looking for something smaller with a focus on IT, then use Berry College’s Information Technology Disaster Recovery Plan

Berry College 2015, Information Technology Disaster Recovery Plan, Berry College. .

Resources
Use the following resources to help you decide what should be in a Disaster Recovery Plan:

CPA Australia 2020, Disaster Recovery Toolkit, CPA Australia, viewed 3 June 2020, .

Reed, J 2019, Components of the disaster recovery plan checklist, Nakivo, viewed 4 June 2020, .

Rock, T 2016, The 9-point checklist for disaster recovery plans, InvenioIT, viewed 4 June 2020, .

Touhill, GJ & Touhill, CJ 2014, Cybersecurity for Executives: A Practical Guide, John Wiley & Sons, New Jersey.

Requirements
The required word length for this report is 3,500 words (plus a 10% allowance).

You are required to use at least six (6–12) academic references for this report.
Your references should be from credible sources such as books, industry-related journals, magazines, company documents, company websites and academic journal articles. Ideally, relevant academic journal articles should be used for academic discussion.
Your grade will be adversely affected if your assignment contains no/poor citations and/or reference list and if your assignment word length is beyond the allowed tolerance level (see Assessment Policy available on AIB website).
Grading criteria and feedback
Your assessment will be marked according to the following grading criteria:

Depth and quality of understanding the coverage of the chosen DRP (ICT component) and who needs to be involved and why – 10%
Quality of assessing the adequacy or otherwise of the Business Continuity Plan proposed to support the DRP made from the ICT perspective – 15%
Detailed analysis of the extent of possible problems and ramifications of loss of the various parts of the ICT infrastructure and detail of the related procedures – 25%
Demonstrated understanding of issues likely to be associated with staffing, equipment, systems, communications, legal and media issues, data/records or similar which needs to be prescribed in the DRP – 20%
Explanation of the conclusions drawn on the appropriateness of the DRP for the enterprise and suitability of recommendations for improvement and why – 20%
Structure, Presentation, Communication Style and Language: Uses the example structure provided; presentation and English language conventions are applied as outlined in the AIB Style Guide to communicate clearly – 5%
Referencing: Uses referencing conventions as outlined in AIB Style Guide to acknowledge an appropriate number of credible sources of fact and/or theory – 5%