CP-2,3,4 Business Continuity Planning

[srtalbot]

Security story

Story context This was a security control that was flagged as not compliant in our SA&A process. See guidance from security assessor below:

Additional reference resources may be found at Disaster Recovery Institute Canada and DRI International

Acceptance criteria

• [ ] Engage Core Services and Platform on contingency planning activities
• [ ] Designate an individual with accountability for the Business Continuity Plan i.e. formal business continuity planner.
• [ ] Provide that resource with training relevant to their function.
• [ ] Develop a business continuity plan that meets expected industry norms.
• [ ] Test the business continuity plan at least annually.
• [ ] risk register is updated to reflect new risks and their treatments. Treatments are implemented or a new card is created.
• [ ] Update ATO documentation (SRTM and SA&A)

[srtalbot]

@sarahhobson - identify some first steps on BCP planning that we could tackle earlier.