You are the Information Security Manager for a company operating from a single location. The company's IT infrastructure includes two Windows file servers, four printers, approximately 25 PCs, a fractional T-1 internet connection, an off-premi

Overview

In this assignment, you will assume the role of an InfoSec manager tasked with developing a Disaster Recovery Plan (DRP) for a company with a single location. The plan will focus on ensuring the continuity of critical operations in the event of a disruptive incident. Your goal is to create a comprehensive starting point DRP that addresses key components of the company's IT infrastructure and outlines procedures for recovery and restoration.

Scenario

You are the Information Security Manager for a company operating from a single location. The company's IT infrastructure includes two Windows file servers, four printers, approximately 25 PCs, a fractional T-1 internet connection, an off-premise web server hosted by a third party, and an on-premise Outlook email server. Your task is to develop a Disaster Recovery Plan (DRP) that ensures the timely recovery of critical systems and data in case of a disaster or disruptive event.

Prompt

Develop a Disaster Recovery Plan (DRP) for the company based on the provided scenario. Your plan should include the following components:

1. Introduction: Provide an overview of the company's IT infrastructure and the importance of having a Disaster Recovery Plan (DRP). Explain the scope and objectives of your DRP.
2. Risk Assessment: Conduct a brief risk assessment to identify potential threats and vulnerabilities to the company's IT systems and data. Consider risks such as natural disasters, hardware failures, cyberattacks, and human errors.
3. Recovery Objectives: Define recovery time objectives (RTOs) and recovery point objectives (RPOs) for each critical system and data component listed in the scenario. Specify the maximum acceptable downtime and data loss for each system.
4. Backup and Recovery Procedures:
   • Describe the current backup procedures for the Windows file servers, email server, and any other critical systems.
   • Propose improvements or adjustments to ensure backups are performed effectively and securely.
   • Outline the procedures for restoring data and systems from backups in the event of a disaster.
5. Communication Plan: Develop a communication plan that outlines how stakeholders, employees, and external parties will be notified in the event of a disaster. Include contact information and escalation procedures.
6. Testing and Maintenance: Detail a plan for regularly testing and updating the DRP. Define roles and responsibilities for conducting tests, evaluating results, and making necessary improvements.
7. DRP Documentation: Summarize the DRP into a concise document that includes procedures, contact information, recovery steps, and any other relevant details. Ensure the document is accessible to key personnel and stakeholders.
8. Conclusion: Provide a concluding statement summarizing the importance of disaster preparedness and the role of the DRP in ensuring business continuity and minimizing operational disruptions.

This assignment will allow students to demonstrate their understanding of Disaster Recovery Planning principles by applying them to a realistic scenario. It emphasizes critical thinking in assessing risks, setting recovery objectives, and designing procedures to safeguard an organization's IT infrastructure.