Q1: Assume a senior manager in a University like UC has asked you to conduct a quick review of the organisation's business continuity and disaster recovery planning efforts during the unfolding of the COVID-19 pandemic. The review is to ensure the organisation will be adequately protected around issues directly related to the COVID-19 outbreak.

Q1.1 What would be the major threats to UC that could eventuate from the pandemic and associated government actions?

Q1.2 How would you go about conducting such an exercise? You need to identify the major steps in such a review, the documents that you would need to look at, and the key stakeholders that you may want to talk to along the way. There is no need to discuss the potential outcomes of the review - only focus on the process, stakeholders and issues to be considered.

Section 17 of ISO 27002 may provide some assistance with this.

Q2: Some of the topics of concern in the second assignment are concerned with contingency issues and resilience (backup and recovery, cyber incidents etc). For many students, it is possible that the security evaluation may uncover that there is little in the way of contingency planning around their personal use of information technology, or perhaps this is done in a very informal manner. In more normal times, this may not be a significant issue, but since onset of the COVID-19 situation, most of us have become more dependent on our technical environment, and suitable alternatives in the event of a failure could be more difficult to obtain or access.

Q2.1 What are the key contingency and availability threats in the current situation from the perspective of your personal technical environment?

Q2.2 Assuming you had some key requirements over the next few weeks (such as the completion and submission of University assignments), what would you see as two key elements of a personal disaster recovery plan?