Disaster Recovery Plan

Definitions

Disaster Recovery

A disaster in the context of a disaster recovery plan is an event that potentially affects the data or IT systems of the company. The aim of this plan is to outline how the business will recover from the effects of such an event to return to normal operations.   

Categories

There are various types of incidents that can be seen as a disaster in this context. Examples include:

• Cyber-attack or incident: 
  • Malicious code execution, such as malware or ransomware.
  • Denial of service.
  • Phishing.
  • Unauthorised access to systems.
  • Insider threat, either malicious or accidental.
  • Data breach, including stolen equipment.
• Technology and infrastructure failures:
  • Power failure.
  • Internet failure.
  • Data Centre failure.
  • Hardware failure.
  • Software failure.
  • Vendor failure.
• Organisational issues: 
  • Human error.
  • Personnel loss.
• External issues: 
  • Natural disaster.
  • Pandemic.
  • Armed conflict.
  • Civil unrest.
  • Strikes. 

Priority services and recovery timelines

Prater Raines provides the following services:

• Fleet: The website system for the Liberal Democrats.
• Lighthouse: The membership management system for the liberal democrats.
• Email Your MP: Microsite campaigning functionality for a variety of organisations. 
• Adnum: An internal system for FIM Capital.
• Website Hosting: Various CMS based websites for businesses, organisations, and councils.
• SRB Intranet: The document management system for SRB. 
• Email: Microsoft reseller email accounts for businesses and a mail server for Liberal Democrat local parties. 
• Domain name registration: Nominet registrar for .uk domains.
• APIs: For the Liberal Democrats and for the Email Your MP service.

The priority services within the above list are those provided to the Liberal Democrats and to FIM Capital. These services should be restored prior to other services after a disaster, with an aim to return to ‘business as usual’ within 24 hours. Once these services are restored, other services should be restored within a further 48 hours. 

Actions and responsibilities

In the event of a cyber attack or incident, the cyber incident response plan will be enacted in the first instance. Otherwise, the business continuity plan will be enacted. The following actions will take place if hardware, software, or systems have been damaged.

• Identify the actions required to recover from the disaster.
• If external support is required, arrange for this to be put in place.
• Read any documentation required to complete the process of recovery. 
• Notify staff members, customers, and the public as required of the expected timescales for recovery.
• Replace any damaged hardware.
• Test replacement hardware to ensure it is working.
• Reinstall any software that cannot be recovered from backups, such as operating systems.
• Configure any reinstalled software using the configuration files stored in version control where possible.
• Test reinstalled software to confirm it is working as expected.
• Recover software components from backups where this is possible.
• Recover data and files from backups.
• Reinstate software access to data and files as required.
• Test recovered software to confirm it is working as expected.
• Restore staff member, customer, and public access to systems as appropriate. 
• Notify staff members, customers, and the public where required.

The technical director and data protection officer are responsible for disaster recovery actions resulting from a cyber-attack or incident. The technical director and managing director are responsible for disaster recovery actions resulting from technology and infrastructure failures, organisational issues, or external issues.