Tutorial activities

Re: Week 6 activity

Tue, 17 Mar 2026 16:58:37 GMT

by Rajul Gupta.

Week 6 – Contingency Planning Scenario 3
FinSecure Bank – Financial Management System
Data Security, Governance and Compliance
Group Members: Aviral Tyagi – 2530743, Premraj Janga – 2505006, Rajul Gupta – 2523934, Gautam Malviya – 2504384

Analyse the Scenario
FinSecure Bank is an online banking platform that handles customer accounts, transactions, loans, and investments. The most critical assets we identified are the core banking system, customer database, payment processing engine, and the online banking portal. If any of these go down, the bank basically cannot function; customers cannot access money, transactions fail, and the bank could face serious regulatory trouble.

Potential Disasters
For natural disasters, the most realistic risks are flooding at the data centre, fire, and long power cuts during bad weather. For man-made threats, the biggest ones are ransomware attacks, someone inside leaking customer data, a DDoS attack taking the website down, and third-party payment systems failing. Some of these happen fast, like a cyberattack, others are slower, like a vendor gradually becoming unreliable.

Business Continuity Plan
For the BC team, we split responsibilities between a BC Manager who runs everything, an IT lead who handles the technical side, a compliance person to deal with regulators, and someone handling communications to staff and customers. Everyone has a backup person in case they are not available. For our strategy, we decided on a hot site as the main backup for the core banking system because it cannot afford to be down for long. For less critical systems like internal tools, we would use a warm site. We also use cloud backups through AWS, so data is always recoverable. The purpose of the BC policy is simply to keep the bank running during a crisis. It covers all departments and all systems. Resources needed include the backup sites, cloud storage, and a trained team. Training happens once a year, and everyone gets a refresher if there is a major change to the systems.

Disaster Recovery Plan
We classified disasters in two ways: first, by type, such as natural like flooding or man-made, like a cyberattack, and second, by speed, where rapid onset means something hits suddenly, and you need to react within 30 minutes, while slow onset means you have some warning and can manage it gradually. For recovery, we said the core banking system gets restored first, then payments, then the customer portal, then everything else. The IT lead activates the backup site, checks that all data is intact, and brings systems back online in that order. The compliance officer has to notify the FCA within a few hours of a major incident. Once everything is back up the team does a review of what happened and updates the plan if needed. The DR policy covers all systems at all times, including weekends, and staff with recovery roles are trained every year.

Testing and Maintenance
We would use three main testing methods. A tabletop exercise every few months, where the team just talks through a scenario together. A full simulation once a year, where we actually test the failover systems. And a structured walkthrough where each person goes through exactly what they would do step by step. After each test, anything that did not work gets fixed before the next one. The plan also gets reviewed whenever something big changes in the bank's systems or team structure.

Re: Week 6 activity

Tue, 17 Mar 2026 16:57:58 GMT

by Raj Bhatia.

Group 4

Week 6. Creating a Contingency Plan

4. Learning Management System (EduFlex school) EduFlex school is a school that uses an online Learning Management System (LMS) to manage courses, track student progress, and deliver educational materials.

Member Name:

Raj Bhatia 2522682

Omkumar Bhavesbhai Nayak 2525082

Darshan Nareshbhai Sheliya (2530070)

Dip Kirankumar Patel (2530744)

khushi sangani navnitbhai (2520615)

1. Form the Business Continuity (BC) Team – EduFlex School LMS Scenario

A Business Continuity (BC) Team must be formed in order to guarantee that EduFlex School's Learning Management System (LMS) keeps running during disruptions (such as system failures, cyberattacks, or network outages). This group is in charge of creating, carrying out, and upholding the Business Continuity Plan (BCP).

A. Roles and Responsibilities in the BC Team

Role	Responsibilities
BCP Manager / Continuity Coordinator	Leads the BC team, oversees development of the BCP, coordinates response during disruptions.
IT Manager	Ensures LMS servers, databases, and networks remain operational and manages system recovery.
System Administrator	Maintains LMS infrastructure, backups, and technical recovery procedures.
Academic Coordinator	Ensures course materials and teaching activities continue during disruptions.
Communications Officer	Communicates updates to students, teachers, and staff during incidents.
Data Protection / Security Officer	Protects student data and manages cybersecurity incidents.
Administrative Representative	Handles operational issues such as scheduling, student records, and policy implementation.

B. Personnel Assigned for Plan Development

The following BC team members are in charge of creating the Business Continuity Plan:

BCP Manager: oversees the planning process.

The system administrator and IT manager should create technical recovery plans for the LMS.

Academic Coordinator: guarantees the continuation of instruction.

Security Officer: combines data protection and cybersecurity measures.

Administrative personnel: make sure they follow operational protocols.
Among their responsibilities are:

Determining which systems are essential (e.g., student database, LMS platform).

Evaluating possible dangers and interruptions.

Developing protocols for system continuity and recovery.

C. Personnel Assigned for Plan Testing

Testing ensures that the BCP will work during real emergencies.

Personnel	Testing Responsibility
IT Manager	Conducts disaster recovery simulations for LMS servers.
System Administrator	Tests data backups and restoration procedures.
Academic Coordinator	Tests alternative teaching methods (e.g., offline materials or backup platforms).
BCP Manager	Organizes drills and evaluates results.

D. Personnel Assigned for Plan Maintenance

The BCP must be regularly reviewed and updated.

Personnel	Maintenance Responsibility
BCP Manager	Reviews and updates the BCP annually.
IT Manager	Updates technical recovery procedures and system configurations.
Security Officer	Updates cybersecurity response strategies.
Administrative Representative	Updates policies and staff contact lists.

2. Outline Business Continuity (BC) Strategies – EduFlex School LMS

During disturbances like server failures, cyberattacks, or power outages, EduFlex School's Learning Management System (LMS) can continue to function or swiftly recover thanks to business continuity (BC) solutions.

A. Options for Exclusive Use

Exclusive-use recovery sites are backup locations set out specifically for EduFlex School.

Option	Description	Example for EduFlex
Hot Site	A fully equipped backup site with servers, software, and real-time data replication. It can be activated immediately after a disruption.	A cloud backup LMS server that mirrors the main system and can switch instantly if the primary server fails.
Warm Site	A partially equipped backup site with hardware and network infrastructure but requires data restoration and configuration before use.	A secondary server where LMS software is installed but data backups must be restored before the system becomes operational.
Cold Site	A basic facility with power, network, and space but no active equipment. Systems must be installed before use.	A reserved data center space where EduFlex can set up servers if the main system is destroyed.

B. Options for Shared Use

In order to cut expenses, shared-use techniques entail sharing recovery resources with other businesses or service providers.

Option	Description	Example for EduFlex
Timeshare	Multiple organizations share a recovery site but use it at different times during a disruption.	EduFlex shares a backup data center with other schools that can be scheduled for use when needed.
Service Bureau	A third-party company provides backup systems and data processing services.	An external IT service provider temporarily hosts the LMS and manages system operations during outages.
Mutual Agreement	Two organizations agree to support each other during disruptions.	EduFlex partners with another school to temporarily host their LMS platform if the main system fails.

C. Specialized Choices

These tactics include customized solutions for both operational continuity and quick recovery.

Option	Description	Example for EduFlex
Mobile Site	A portable recovery facility with computing equipment that can be deployed to a location when needed.	A mobile IT unit with servers and network equipment used to restore LMS access after major infrastructure damage.
External Resources	Using cloud services, managed hosting, or external IT providers to maintain system availability.	Cloud platforms (e.g., cloud-based LMS hosting or backup storage) used to quickly restore services and data.

3. Create the EduFlex School LMS's Business Continuity (BC) Policy.

EduFlex School can maintain its Learning Management System (LMS) and educational services in the event of disruptions by following the instructions provided by a Business Continuity (BC) Policy.

Goals

In the event of a system failure, cyberattack, or natural disaster, the Business Continuity Policy's goal is to guarantee that EduFlex School can sustain or promptly restore vital educational services, such as access to the LMS, student data, and instructional materials.

Range

All EduFlex School employees, IT systems, and resources used to run the LMS and associated services are covered by this policy. It consists of:

• LMS servers and platforms

• Academic and student data

• Communication and network systems

• Instructors, pupils, and administrative personnelResource

Conditions

In order to facilitate business continuity, EduFlex School needs:

• Cloud hosting or backup servers for the LMS

Systems for data recovery and backup

• Dependable network and internet infrastructure

• Technical support team and IT professionals

• Tools for staff and kids to communicate in an emergency

Positions and Duties

• BCP Manager: Coordinates reaction during disruptions and oversees the continuity strategy.

• IT Manager/System Administrator: Oversees system recovery, backups, and LMS infrastructure maintenance.

• Academic Coordinator: Oversees the continuation of instruction and course delivery.

• Communications Officer: During incidents, this person keeps staff and students informed.

• Security Officer: Handles cybersecurity threats and safeguards student data.Training

EduFlex School will provide regular training and awareness programs for staff to ensure they understand:

Business Continuity procedures
Emergency response actions
System recovery processes
Communication protocols during disruptions

4. Make sure the business continuity plan is maintained.

EduFlex School must carry out ongoing maintenance tasks in order to maintain the efficacy and currency of the Business Continuity Plan.

Examining

To make sure that recovery processes are efficient, the BC plan should be tested on a regular basis. Testing could consist of:

• Tests for system backup and recovery

• The LMS's disaster recovery simulations

• Testing for network failure response

Exercises

To prepare employees for actual occurrences, EduFlex School should hold training exercises and drills. Examples consist of:

• Simulations of emergency response

IT disaster recovery exercises

• Communication exercises to alert instructors and students of disturbances

Regular Updates

Periodically reviewing and updating the BC strategy should take into account:

• Modifications to the LMS system or technology

• New dangers or threats to security

• Changes in staff roles

Disaster Recovery Plan (DRP)- Technical Detailed Brief.

Definition:

Disaster Recovery Plan (DRP) is a complex and policy-based framework that defines orderly procedures and technical requirements of restoring the key IT infrastructure, applications, and data resources in the event of a disruptive incident. It also makes recovery systematic in a pre-set way that minimizes operational and financial damage.

Core Objectives:

The main aim of the DRP is to ensure that the business is resilient to any kind of event that may disrupt the business by making sure that the systems ensure high availability and also maintaining data integrity and the services can be rapidly restored. It is designed to minimize downtime, eliminate corruption of data and sustain important business functions even in unfavorable conditions.

Recovery Metrics:

RTO (Recovery Time Objective): It is a time limit that defines the maximum acceptable time of systems and services to be returned to avoid serious business consequences.

RPO (Recovery Point Objective): The allowable level of data loss calculated by time, it determines how often do the backup or replication needs to be done to satisfy the business needs.

Disaster Classification:

Categorization of disasters is done according to their place of origin and effects, in order to implement the right response measures. This is natural disasters like floods or fires, man-made disasters like cyberattacks or insider threat, and technological disasters like malfunctioning hardware or software crashes. All categories need special recovery mechanisms.

Recovery Procedures:

The DRP identifies the specific technical procedures to follow in the restoration of systems, such as server reconfiguration, application redeployment and network restoration. It also has database recoveries based on the backup and validation procedures to make sure that the restored services are fully operational and coherent.

Data Recovery Mechanisms:

The recovery of data is done in various layers such as offsite secured backups, cloud-based data storage tools, real-time data replication, and snapshot-based recovery features. These systems also make the data to be available and consistent even when there is a critical system failure.

Infrastructure Resilience:

To improve fault tolerance, the DRP uses redundant infrastructure as hot, warm or cold sites. It also provides load balancing mechanisms and failover so that transition to the backup environment may be achieved without much service disruption.

Security Restoration:

The DRP provides assurance of the re-introduction of security controls after recovery such as identity and access management systems, authentication measures, and encryption measures. It also includes integrity checking to ensure that the systems are not compromised or changed maliciously.

Roles and Responsibilities:

The DRP lays out very clear responsibilities of IT personnel, security teams and management stakeholders based on roles. This provides co-ordination of recovery processes, communication and accountability in disaster situations.

Testing and Validation:

The DRP also involves frequent testing procedures to be reliable in the form of simulation exercises, failover tests, and walkthroughs. Constant auditing and revision is done so that the plan is kept up date with the changing threats and technology.

Outcome:

When applied correctly, the use of an efficient DRP allows for a quick restoration of the system, reduces the negative impact on the business, preserves essential information, and prevents the industry standards and regulatory issues, thus, improving the overall resiliency of the organization.

Re: Week 6 activity

Tue, 17 Mar 2026 16:54:21 GMT

by Md Morshedul Islam.

MD Morshedul Islam - 2519737
Md Ekram Hossain - 2523284
MD Shiblu Hossain - 2517990
Zannatul Mawya Priya - 2527766
Md Arafat Rahman - 2437469

Introduction

MediCare Solutions needs BCP and DRP to ensure continuous healthcare services.

Potential Disasters

Cyberattacks like ransomware and phishing can disrupt systems.

Data breaches can expose sensitive patient information.

System failures can stop healthcare operations.

Natural disasters like fire and flood can damage infrastructure.

Human errors can cause data loss or system issues.

Critical Functions & Assets

EHR system is essential for managing patient data.

Patient care services must continue at all times.

IT infrastructure supports all operations.

Lab and appointment systems are critical for daily tasks.

BC Team

BC Manager handles overall coordination.

IT team manages system recovery.

Security team handles cyber threats.

Medical staff ensure patient care continues.

BC Strategies

Hot sites provide immediate system recovery.

Warm sites offer moderate recovery speed.

Cold sites take longer to restore operations.

Cloud systems ensure data availability.

BC Policy

BCP ensures continuous healthcare services during disruptions.

It defines scope, roles, and required resources.

Staff training prepares employees for emergencies.

BC Maintenance

Regular testing ensures plan effectiveness.

Simulations help prepare for real incidents.

Updates keep the plan current.

Disaster Classification

Disasters can be natural or man-made.

They can be rapid or slow onset.

Recovery Steps

Incidents must be identified quickly.

Critical systems are prioritised first.

Data is restored from backups.

Systems are brought back to normal operation.

DR Policy

DRP defines recovery procedures and scope.

Training ensures staff readiness.

RTO and RPO minimise downtime and data loss.

Testing & Improvement

Simulations test disaster response.

Desk checks review the plan.

Walkthroughs identify weaknesses.

Presentation

Key threats include cyberattacks and system failures.

BCP ensures business continuity.

DRP focuses on system recovery.

Regular testing improves effectiveness.

Conclusion

BCP and DRP are essential for maintaining healthcare services and data security.