SoftArc Engineering Ltd (SEL) is a civil engineering company which works across Australia as well as in New Zealand, Fiji, Vanuatu, Indonesia, Timor Leste and Papua New Guinea.

SEL has a small data centre at its main site in Bathurst where the company’s servers and data storage is located.

The company has some 70 engineering and support staff that work on different projects for clients in various locations in Australia and overseas. The support staff are mainly based in Bathurst, but engineering staff are located in different parts of Australia, New Zealand, an d Papua New Guinea. Most of the support staff have access to a PC, although some support staff share a PC with other staff. The engineering staff all connect remotely to the SEL data centre from their laptops. The SEL data centre infrastructure has not been updated for some time and the SEL Board is concerned that they may be exposed to a cyber attack as they are now starting to work on various Government projects in different countries.

Background:

You have been employed by SEL as their first Chief Information Security Officer (CISO). You have been tasked by the Board to conduct a review of the company’s risks and start to deploy security policies to protect their data and resources.

You are concerned that the company has no existing contingency plans in case of a disaster.

The Board indicated that some of their basic requirements for contingency planning include:

• A Recovery Time Objective (RTO) of 4 hours
• A Recovery Point Objective (RPO) of 6 hours

Based on these, you now need to determine:

• The Maximum Tolerable Downtime (MTD),
• The Work Recovery Time (WRT) and
• The system and data recovery priority

The Board expects that you will propose a Business Continuity Plan (BCP) for SEL. The Board expects you to use as much of their existing resources as possible for the BCP, but understands that some additional resources may be required. Your BCP proposal must clearly state what additional resources, in terms of hardware, software and locations, are required.

Tasks:

You are to develop a proposal for a Business Continuity Plan (BCP) for SEL in accordance with the Board’s instructions above. Your proposed BCP must include:

1. A brief executive overview of the entire BCP,
2. A Business Impact Analysis
3. An Incident Response Plan
4. A Backup plan,
5. A Disaster Recovery plan,

Your proposed BCP should include the following headings:

• Executive Overview of the BCP
• Business Impact
• Incident Response
• Backup
• Disaster Recovery

You are required to provide references in your BCP in APA 7 format.

RATIONALE
back to top

This assessment task will assess the following learning outcome/s:

• be able to justify the goals and various key terms used in risk management and assess IT risk in business terms.
• be able to apply both quantitative and qualitative risk management approaches and to compare and contrast the advantages of each approach.
• be able to critically analyse the various approaches for mitigating security risk, including when to use insurance to transfer IT risk.
• be able to critically evaluate IT security risks in terms of vulnerabilities targeted by hackers and the benefits of using intrusion detection systems, firewalls and vulnerability scanners to reduce risk.

</h5style=”box-sizing:>