Reference no: EM133860893
Complete BCP/DRP Final Project Requirements
Document Structure Requirements
Your final project must be a single comprehensive document with the following components:
1. Title Page
2. Table of Contents
3. Main Section (detailed below)
4. Appendices:
1. Appendix A: Updated Network Diagram
2. Appendix B: MTD, RTO, RPO for all major hospital items
3. Appendix C: Incident Response Plan
4. Appendix D: Restoration Procedures (strongly recommended but optional)
5. References: Minimum of 20 citations from established restorative principles, APA Format
Hospital Departments to Include
Your BCP/DRP must address these departments:
• Emergency Department
• Intensive Care Department
• General Surgery
• Internal Medicine
• Pharmacy
• Lab
• Radiology
• Finance
• Human Resources
• IT/Cybersecurity
• Nursing/Doctor Staff
Main Section Requirements
1. Recovery Scenario
• Ransomware attack affecting 50% of on-premises equipment
• Must include one affected piece of equipment for each department (can only use laptops/desktops once in total)
• Examples: X-ray machine for radiology, lab processing device, etc.
• Ransomware affects 25% of mission-critical cloud applications
• Must identify at least 2 non-Windows-based, medical SaaS-centric applications
2. Team Structure and Responsibilities
• Disaster Management Team
o General responsibilities
o Public communication responsibilities
• Operations Team
o Responsibilities
• Networks Team
o Responsibilities
• Facilities Team
o Responsibilities
• Communications Team
o Responsibilities
3. Response Procedure
• Minimum 10 detailed steps per identified affected device
• Must address the ransomware incident scenario
• Example for a radiology device:
o Activate incident response and notify cybersecurity
o Assess against MTD, RTO, RPO
o Join internal communications
o etc.
Appendix Requirements
Appendix A: Updated Network Diagram
• Must include dependencies (e.g., "MRI goes to workstation 1 eth1, Workstation 0 goes to switch port 40")
• Show transition from on-premises to cloud-hosted services
• Include SaaS applications (non-Microsoft)
• Minimum 2 applications identified to live in the cloud
• Simple cloud icons are acceptable for cloud applications
Appendix B: MTD, RTO, RPO Tables
• Create tables listing Maximum Tolerable Downtime, Recovery Time Objective, and Recovery Point Objective
• Include each mission-critical item for every department
• Organize by department for clarity
• May span multiple pages
Appendix C: Incident Response Plan
• Define the difference between a "security event" and a "security incident."
• Identify teams activated for response
• Detail the communications plan (can be an outline)
• Establish criteria for determining incident closure
Appendix D: Restoration Procedures
• Detailed restoration steps for affected systems
• Data recovery procedures
• System sanitization protocols
• Verification and testing procedures
• Return-to-operation guidelines
Font: Times new Roman, font Size: 12