DR Interview Questions

1- Can you explain the key components of a disaster recovery plan?

comprehensive disaster recovery plan consists of several key
components to ensure business continuity and minimize downtime in
the event of a crisis.
 The first component is risk assessment, which involves identifying
potential threats and vulnerabilities that could disrupt operations.
This helps prioritize resources and focus on the most critical
systems.
 Business impact analysis focuses on understanding how different
disruptions could affect the organization’s ability to function. It
identifies key processes, systems, and resources that are
essential for maintaining operations and evaluates the potential
consequences of their unavailability. This information is vital for
determining the (RTOs) and the (RPOs), which guide the
development of specific recovery strategies and resource
allocation.
 Recovery strategies for each identified risk. this steps required to
restore essential functions and may include alternative work
locations, data backup procedures, and communication plans with
stakeholders.
 Another vital component is the implementation of these strategies
through detailed action plans. These plans assign roles and
responsibilities to team members, establish timelines, and provide
step-by-step instructions for executing the recovery process.
 Also Regular testing and updating of the disaster recovery plan
are also essential to ensure its effectiveness and adapt to any
changes in the organization or environment.”
 it is important to create a communication plan. This should include
information on who to contact in the event of a disaster and how
to reach them, as well as instructions for notifying employees and
customers in the event of a disaster.
 In summary, the steps for planning a disaster recovery strategy
include assessing the risks associated with potential disasters,
creating a disaster recovery plan, creating a backup plan, and
creating a communication plan. By taking these steps,
 organizations can ensure that they are prepared in the event of a
disaster.

2- What are the key components of a business continuity plan?

-Identifying critical business functions and determining how they would be

impacted by an interruption
-Developing strategies to maintain or restore critical functions in the event of
an interruption
-Identifying resources that would be required to maintain or restore critical
functions
-Developing procedures for implementing the business continuity plan
-Testing the business continuity plan to ensure it is effective
A business continuity plan is important because it provides a roadmap for how
an organization will continue to operate in the event of an interruption. By
having a well-developed plan in place, organizations can minimize the impact
of disruptions and keep their operations running smoothly.

1- Explain the role of risk assessment in disaster recovery planning.

Risk assessment plays a critical role in disaster recovery planning as it

helps identify potential threats and vulnerabilities that could impact an
organization’s operations. It involves evaluating the likelihood of various
disasters occurring, such as natural disasters, cyberattacks, or
equipment failures, and assessing their potential impact on business
continuity.

Once risks are identified and prioritized it can to develop the strategies
to mitigate these risks and minimize their consequences. This includes
creating contingency plans, implementing redundant systems, and
establishing backup procedures. The risk assessment process also
informs decision-making regarding resource allocation, ensuring that
efforts are focused on addressing the most significant threats.

In summary, risk assessment is essential for developing effective

disaster recovery plans tailored to an organization’s specific needs and
vulnerabilities
2- Describe a time when you successfully managed a disaster recovery effort
from start to finish.

i was once responsible for managing the disaster recovery in DHL

MENA Region for a significant data breach. The first step I took was to
assemble a cross-functional team, including IT security experts, network
administrators, and representatives from affected departments. We
quickly assessed the extent of the damage and identified the
compromised systems.

We then developed a comprehensive plan to restore critical business

operations as soon as possible. This involved isolating the affected
systems, removing any malware or unauthorized access points, and
implementing additional security measures to prevent further breaches.
On the other hand, we worked on recovering lost data from backups
and validating their integrity before reintegrating them into our systems.

Throughout the process, communication with stakeholders was

essential. We provided regular updates to senior management and
employees about the progress of our recovery efforts and any potential
impacts on their work. Once the recovery was complete, we conducted
a thorough post-mortem analysis to identify areas for improvement in
our disaster response procedures and implemented changes
accordingly. As a result, we emerged stronger and more resilient
against future threats.”

3- What is the difference between disaster recovery and business continuity

planning?

Disaster recovery and business continuity planning are closely related.

but serve distinct purposes in an organization’s overall strategy to
maintain operations during unforeseen events.

Disaster recovery focuses on the restoration of critical IT systems,

applications, and data after a disruptive event, such as a natural
disaster or cyberattack. The primary goal is to minimize downtime and
ensure that essential technology infrastructure can be brought back
online quickly and efficiently.

On the other hand, business continuity planning encompasses a

broader scope, addressing how an organization will continue its
 operations during and after a disruption. This includes not only IT
systems but also personnel, facilities, communication channels, and
supply chain management. Business continuity planning aims to
maintain the organization’s ability to deliver products and services at
acceptable levels while minimizing the impact on customers,
employees, and stakeholders.

4- Steps to Calculate Recovery Time Objectives and Recovery Point

Objectives

Here’s a step-by-step process on how to calculate RTOs and RPOs:

1-Conduct a Business Impact Analysis (BIA) to identify critical business processes,
assets, and resources that are essential to the business operations. This analysis will
help determine the potential impact of an outage or disaster on the organization.
2-Based on the BIA, identify the Recovery Time Objective (RTO) and Recovery Point
Objective (RPO) for each critical business process, asset, and resource. The RTO is
the maximum tolerable downtime for each process, while the RPO is the maximum
tolerable data loss.
3-Consider the organization’s budget and available resources to determine the
feasibility of meeting the RTO and RPO requirements. For example, implementing high
availability and disaster recovery solutions can significantly reduce RTO and RPO, but
they may come at a high cost.
4-Document the RTO and RPO values, along with the corresponding business
processes, assets, and resources. Ensure that all stakeholders are aware of these
values.
5-Regularly review and update the RTO and RPO values to reflect changes in the
organization’s operations, technology, and budget. Conduct testing and simulation
exercises to ensure that the RTO and RPO requirements can be met in a real-world
scenario.
6-Communicate the RTO and RPO values to all relevant stakeholders, including senior
management, IT staff, and business units. Ensure that everyone understands the
importance of meeting these requirements and their role in achieving them.
By following this step-by-step process, organizations can effectively determine their
RTO and RPO requirements, and implement appropriate measures to ensure business
continuity in the event of an outage or disaster.
 5- How to improve the Recovery Time Objectives and Recovery Point
Objectives

Identifying the Risks

Increasing Backup Frequency
Near-Zero RTOs with Synchronous Mirroring
To achieve a near-zero RTO, one effective technique is
synchronous mirroring. This involves writing data to both the
primary device and the mirrored system simultaneously.
Whenever there is a change in data on the primary site, it is
also immediately synced with the mirrored site to ensure that
both sites are always identical. The write operation is only
considered complete when the mirror site sends confirmation
back to the primary site. The secondary copy should be stored
in a hot state for immediate recovery in case of any disaster.
Regular testing for ascertaining realistic values

6- How do you assess an organization’s vulnerability to disasters

assessing an organization’s vulnerability to disasters involves conducting a

thorough risk assessment and analyzing potential threats.

1-The first step is to identify critical business functions and the resources
required to support them. This includes understanding the dependencies
between various systems, processes, and personnel.

2-Once these critical components are identified, I evaluate the likelihood

and impact of various disaster scenarios on the organization. This involves
considering both natural disasters such as floods, earthquakes, and man-
made disasters like cyber-attacks, equipment failures, or human errors. To
gather accurate information, I collaborate with different departments within
the organization and some times consult external sources like historical
data, industry reports, and government guidelines.

3-After identifying potential threats and their impacts, I prioritize risks based
on their severity and probability. This helps in developing a comprehensive
disaster recovery plan that focuses on mitigating high-priority risks while
also addressing lower-priority ones.
4-At the end Regularly reviewing and updating the risk assessment
ensures that the organization remains prepared for any unforeseen events
and can quickly recover from disruptions

7- Describe your experience in developing and implementing disaster

recovery plans.

I have been involved in developing and implementing disaster recovery

plans for various organizations. My experience includes conducting risk
assessments to identify potential threats and vulnerabilities, as well as
analyzing the impact of these risks on business operations.

One notable project I worked on DHL through MENA Region where we

developed a comprehensive disaster recovery plan that covered both
natural disasters and cyber-attacks. We began by identifying critical
systems and processes, then designed strategies to ensure their
continuity during an incident. This included creating backup procedures,
establishing alternate work sites, and setting up communication
channels for employees and stakeholders.

Throughout the implementation phase, I collaborated with different

departments to conduct training sessions and drills, ensuring all staff
members were familiar with the plan and their roles in case of an
emergency. Additionally, we regularly reviewed and updated the plan to
account for changes in technology, personnel, and organizational
structure. This proactive approach helped the organization maintain its
operational resilience and minimize downtime during unforeseen
events.”

8- What are some common challenges faced during disaster recovery efforts,
and how would you address them?

One common challenge during disaster recovery efforts is coordinating

communication among various stakeholders, such as emergency
responders, government agencies, and affected communities. To
address this issue, I would establish a centralized communication hub
that streamlines information sharing and ensures all parties are updated
on the progress of recovery operations. This could involve setting up
regular meetings or conference calls, utilizing collaboration tools, and
designating points of contact for each stakeholder group.
 Another challenge is managing limited resources effectively while
addressing immediate needs and long-term recovery goals. Prioritizing
tasks based on urgency and impact is essential in this situation. I would
work closely with local authorities and organizations to assess the most
critical needs, allocate resources accordingly, and develop a phased
approach to tackle less urgent issues over time. This strategy helps
ensure that life-saving measures are prioritized while still planning for
sustainable recovery in the long run.”

9- What methods do you use to test the effectiveness of a disaster recovery

plan?

To test the effectiveness of a disaster recovery plan, I employ various

methods to ensure that all aspects of the plan are thoroughly evaluated.
One method is conducting tabletop exercises, where key stakeholders
gather and discuss potential scenarios in a simulated environment. This
helps identify gaps in the plan and promotes communication among
team members.

Another method is performing full-scale tests, which involve simulating

an actual disaster event and executing the recovery procedures as
outlined in the plan. This provides valuable insights into the practicality
and efficiency of the plan under real-world conditions. Additionally, it
allows us to assess the readiness of our personnel and resources,
ensuring that we can respond effectively when faced with an actual
disaster situation.”

10-Describe a situation where you had to adapt a disaster recovery plan due to
unforeseen circumstances.

I remember when was part of DR Team, we had developed a

comprehensive disaster recovery plan that was tested and validated
regularly. However, when an unexpected power outage occurred in our
primary data center, we faced unforeseen challenges due to the
simultaneous failure of our backup generator system.

To adapt to this situation, I immediately assembled our disaster

recovery team and initiated communication with key stakeholders to
keep them informed about the issue and our response strategy. We
quickly assessed the extent of the damage and determined that it would
take longer than anticipated to restore power to the primary site. As a
 result, we decided to activate our secondary data center to minimize
downtime and maintain business continuity.

Throughout the process, we closely monitored the performance of the

secondary site and provided regular updates to stakeholders. Once the
primary site was restored, we carefully executed a phased transition
back to normal operations while ensuring minimal disruption to the
business. This experience highlighted the importance of flexibility and
adaptability in disaster recovery planning and led us to review and
update our plans to account for similar scenarios in the future.”

11-How do you prioritize which systems and processes should be restored

first after a disaster?

prioritizing systems and processes for restoration after a disaster is

critical to ensure business continuity. My approach involves assessing
the impact of each system on the organization’s operations and
identifying which ones are most essential for maintaining core functions.

I start by collaborating with key stakeholders from various departments

to understand their specific needs and dependencies on different
systems. This helps me create a comprehensive list of all systems and
processes that need to be restored. Next, I categorize them based on
their criticality to the organization’s overall functioning, such as mission-
critical, business-critical, or non-critical.

Once categorized, I prioritize restoring mission-critical systems first, as

they have the highest impact on the organization’s ability to function
effectively. These may include communication infrastructure, financial
systems, or customer-facing applications. Following this, I focus on
business-critical systems that support internal operations but might not
directly affect customers. Finally, non-critical systems are addressed
once the more vital components have been restored. This structured
approach ensures a swift recovery while minimizing disruption to the
organization’s core activities.”

12-What strategies do you employ for data backup and recovery?

I employ a multi-layered approach to data backup and recovery to

ensure maximum protection against potential disasters. The first
strategy is the 3-2-1 rule, which involves maintaining three copies of
 critical data: one primary copy and two backups stored on different
media types, with at least one offsite backup for added security.

Another essential component of my strategy is regular testing of backup

systems and recovery plans. This includes simulating disaster scenarios
and verifying that all backed-up data can be successfully restored
without any loss or corruption. Regular testing helps identify potential
issues before they become critical and ensures that the recovery
process runs smoothly in case of an actual disaster.

Furthermore, I prioritize data based on its importance to the

organization’s operations. This allows me to allocate resources
effectively and focus on restoring mission-critical systems first during a
recovery operation. In doing so, we minimize downtime and ensure
business continuity even under challenging circumstances.”

13-What tools and technologies do you utilize for disaster recovery planning
and management?

I utilize various tools and technologies to ensure effective planning and

management. For risk assessment and business impact analysis, I use
specialized software like RiskWatch or RSA Archer to identify potential
threats and evaluate their impact on critical business functions. This
helps prioritize resources and develop appropriate recovery strategies.

For data backup and replication, I rely on solutions such as Veeam

Backup & Replication and Zerto Virtual Replication, which provide
efficient and secure ways to protect essential data and applications.
Additionally, I employ cloud-based disaster recovery services like Azure
Site Recovery or Amazon Web Services (AWS) Disaster Recovery for
offsite storage and quick restoration of systems in case of an incident.

To manage the overall disaster recovery process, I use platforms like

ServiceNow , which offer comprehensive incident management and
communication capabilities. These tools help streamline workflows,
coordinate response efforts, and keep stakeholders informed during a
crisis. Leveraging these technologies allows me to create robust
disaster recovery plans that minimize downtime and support business
continuity.”

14-How do you communicate with employees and stakeholders during a

disaster recovery process?
 Effective communication is essential during a disaster recovery process
to ensure that everyone involved understands their roles and
responsibilities, as well as the current status of the recovery efforts. To
achieve this, I establish clear communication channels and protocols at
the onset of any disaster recovery plan.

For employees, I typically use a combination of email updates,

conference calls, or virtual meetings to keep them informed about the
progress and any changes in the recovery strategy. This allows for real-
time feedback and ensures that everyone stays on the same page
throughout the process. Additionally, I make sure to provide concise
instructions and expectations to avoid confusion and maintain efficiency.

When it comes to stakeholders, such as senior management, clients, or

partners, I prioritize transparency and regular updates through formal
reports or briefings. These updates include information on the current
situation, actions taken, challenges faced, and anticipated timelines for
full recovery. This approach helps build trust and confidence in our
ability to manage the crisis effectively while keeping all parties informed
and engaged.”

15-What measures do you take to ensure the security of sensitive information

during disaster recovery efforts?

I follow strict protocols and adhere to industry best practices.

Firstly, I make sure that all data backups are encrypted and stored in
secure offsite locations. This ensures that even if the primary site is
compromised, the sensitive information remains protected. Additionally,
I implement role-based access control (RBAC) to limit access to
sensitive data only to authorized personnel who require it for their
specific tasks during the recovery process.

Furthermore, I work closely with the IT security team to continuously

monitor and assess potential threats and vulnerabilities throughout the
disaster recovery effort. This collaboration allows us to proactively
address any security concerns and maintain the integrity of sensitive
information. In summary, by employing encryption, RBAC, and close
coordination with the IT security team, I can effectively safeguard
sensitive information during disaster recovery operations.”
 16-What steps do you take to prevent future disasters from occurring?

I first conduct thorough risk assessments to identify vulnerabilities within

the organization’s infrastructure, processes, and systems.

Once these vulnerabilities are identified, I collaborate with various

departments to develop and implement strategies that address these
weaknesses. This may involve updating policies, enhancing security
measures, or investing in more resilient infrastructure. Additionally, I
emphasize the importance of regular training and awareness programs for
employees, as human error can often contribute to disaster scenarios. These
programs help staff understand their roles and responsibilities during
emergencies and ensure they follow best practices to minimize risks.

Through this proactive approach of identifying vulnerabilities, implementing

preventive measures, , we can significantly reduce the likelihood and impact
of future disasters on the organization.”

17-How do you manage stress and maintain focus during high-pressure

disaster recovery situations?

Managing stress and maintaining focus during high-pressure disaster

recovery situations is essential for effective response. One strategy I
employ to achieve this is by breaking down the situation into smaller,
manageable tasks. This allows me to concentrate on one task at a time,
ensuring that each aspect of the recovery process receives my full
attention.

Another key element in managing stress is clear communication with my

team members. We establish open lines of communication and regularly
update each other on our progress, challenges, and any changes in
priorities. This collaborative approach not only helps distribute the
workload but also fosters a supportive environment

Ultimately, focusing on teamwork and breaking down complex situations

into smaller tasks enables me to stay calm and maintain focus during
high-pressure disaster recovery scenarios.”

18-Can you provide examples of different types of disasters you have

prepared for or responded to?
 . One example is natural disasters, such as Big Fire. In these situations,
I worked closely with crisis management team to develop evacuation
plans, identify safe zones, and establish communication channels for
affected communities. Additionally, I coordinated with the HQ in LA to
ensure the all team member update and on same page

Another type of disaster I’ve dealt with is cyberattacks on critical

infrastructure. In one instance, faced a ransomware attack that
threatened its operations. My role involved collaborating with IT teams
to assess the extent of the damage, implement containment measures,
and restore systems from backups. Furthermore, I helped develop
strategies to strengthen cybersecurity defenses and prevent future
incidents.

These experiences have taught me the importance of adaptability and

collaboration when addressing diverse disaster scenarios, ensuring
effective mitigation and recovery efforts.”

19-What is the importance of having a clear chain of command during disaster

recovery operations?

Having a clear chain of command during disaster recovery operations is

essential for ensuring effective communication, coordination, and
decision-making. In high-pressure situations like disasters, it’s vital that
everyone involved knows their roles and responsibilities, as well as who
they report to and receive instructions from.

A well-defined chain of command helps prevent confusion and

duplication of efforts by streamlining the flow of information and
decisions. This allows teams to respond quickly and efficiently to
changing circumstances, ultimately minimizing the impact of the
disaster on affected communities and resources. Additionally, a clear
chain of command fosters accountability and enables leaders to monitor
progress, evaluate performance, and make necessary adjustments to
the recovery plan as needed.”

20-Can you discuss any experience you have had with cloud-based disaster
recovery solutions?
 I was responsible for implementing and managing our cloud-based
disaster recovery solution. We utilized a hybrid approach, combining on-
premises infrastructure with cloud services to ensure data redundancy
and quick recovery times.

I worked closely with the IT team to identify critical applications and data
that needed protection and established Recovery Time Objectives
(RTOs) and Recovery Point Objectives (RPOs) based on business
requirements. We selected a reputable cloud service provider and
designed a strategy that involved regular backups of essential data and
virtual machine images to the cloud storage.

During this process, I also developed and documented detailed

recovery procedures, which included steps for restoring systems from
cloud backups and testing failover capabilities. To ensure the
effectiveness of our solution, we conducted periodic tests simulating
various disaster scenarios, allowing us to refine our processes and
address any potential issues proactively.

This experience has given me valuable insights into the benefits and
challenges of using cloud-based disaster recovery solutions, such as
cost savings, scalability, and ensuring data security while leveraging the
advantages of cloud technology.”

21-How do you evaluate the success of a disaster recovery effort once it has
been completed?

Evaluating the success of a disaster recovery effort involves assessing

both quantitative and qualitative factors. First, I would analyze key
performance indicators (KPIs) such as the Recovery Time Objective
(RTO) and Recovery Point Objective (RPO). Comparing these metrics
to predefined targets helps determine if the recovery process met the
organization’s expectations in terms of time and data loss.

Beyond KPIs, it is essential to gather feedback from stakeholders

involved in the recovery process. This includes conducting debriefings
with team members, management, and any external partners who
participated in the recovery efforts. These discussions can reveal
valuable insights into areas that worked well and those that require
improvement.
 Additionally, evaluating communication effectiveness during the incident
response and recovery phases is vital for understanding how
information was shared among teams and decision-makers.

Combining these quantitative and qualitative assessments allows me to

comprehensively evaluate the success of a disaster recovery effort and
identify opportunities for refining our strategies and processes moving
forward.”

What is the difference between DR and HA?

High availability and disaster recovery are both strategies used to

ensure business continuity in the event of an unforeseen disaster.
However, they are two distinct strategies that are used to address
different types of disruptions.

High availability (HA) is a strategy used to reduce downtime by

providing redundancy and failover protection to ensure that all services
remain available at all times. HA implements redundancy by using
multiple servers, or multiple components within a server, that can take
over the workload in the event of a failure.

Disaster recovery (DR) is a strategy used to restore operations in the

event of a disaster, such as a natural disaster, cyber attack, or system
failure. DR focuses on restoring the data and systems that have been
lost or corrupted and ensuring that all processes can be resumed as
quickly as possible.

To summarize, the main difference is that high availability focuses on

preventing downtime, while disaster recovery focuses on restoring
operations

How do you determine your RPO and RTO?

There is no one-size-fits-all formula for calculating the RPO and RTO, as they
depend on various factors such as your business goals, the industry
regulations, the customer expectations, the data value, and the risk tolerance.
However, a general approach that we can follow is to conduct a business
impact analysis (BIA) that identifies the critical data and processes, assesses
the potential consequences of a disaster, and estimates the acceptable levels
of data loss and downtime. also can use tools such as surveys, interviews,
workshops, or simulations to gather the relevant information and analyze the
results.

What are the key considerations for developing a workable incident

response plan?

There are a number of key considerations that need to be taken into account
when developing an effective incident response plan. These include:

1. Establishing clear roles and responsibilities for all members of the incident
response team. This will ensure that everyone knows what their role is and
what is expected of them during an incident.

2. Defining the scope of the incident response plan. This should include
identifying the types of incidents that the plan will cover, as well as any
specific procedures that need to be followed.

3. ensuring that the incident response plan is regularly reviewed and updated.
This will ensure that it remains relevant and up-to-date in the event of a real-
world incident.

4. Testing the incident response plan on a regular basis. This will help to
identify any weaknesses or gaps in the plan, and allow for necessary changes
to be made before an actual incident occurs.”

What are the different types of disasters that could impact your
organization?

Natural disasters – These include events like floods, hurricanes, earthquakes,

and tornadoes.

2. Technical disasters – These include events like fires, power outages, and
system failures.

3. Human-caused disasters – These include events like theft, vandalism, and

terrorism.

4. Pandemics – These include events like the outbreak of a new disease or

virus.”
 What are some common mistakes organizations make with their business
continuity plans?

There are a number of common mistakes that organizations make when it

comes to their business continuity plans. One of the most common mistakes
is failing to properly test the plan. It is important to test the plan regularly to
ensure that it is effective and up-to-date. Another common mistake is failing to
update the plan on a regular basis. As businesses change and evolve, so too
must their continuity plans. Failing to update the plan can lead to it becoming
outdated and ineffective. Finally, another common mistake is failing to involve
all stakeholders in the development and implementation of the plan. Business
continuity planning should be a collaborative effort involving all those who
could be affected by an interruption in service.”

What are some considerations for working with vendors during a crisis?

There are many considerations to take into account when working with
vendors during a crisis. Some key considerations include:

- Ensuring that communication lines are open and that everyone is on the
same page. This includes having a clear plan of action and ensuring that all
stakeholders are aware of it.
- Being transparent with vendors about the situation and what is expected of
them. This includes setting clear expectations and deadlines, as well as being
clear about any changes that may occur.
- Providing vendors with the resources they need to be successful. This may
include additional manpower, financial resources, or other forms of support.
- Ensuring that vendors are held accountable for their performance. This
includes setting clear metrics and benchmarks, as well as monitoring progress
closely.”

BIA
1- First step is to determine and identify all of business processes and
the recovery criticality for this process

2- We have to determine how a system disruption will affect our crtical

systems and will also determine our outage impacts and estimated
downtime if incident happened

3- Identify the resources that need to get our system back online quickly

4- Identify the recovery priorities for system resources, we have to

determine which system are most critical and make sure we recover
the most critical system first and least critical system last to make
sure that our business process and function can continue without a
negative impact

When we are conducting the Business impact assessment we have

to determine how we will have affected if an incident happened and
how long we can be without our systems

Also we have to identify our corporate assets and determine the risks
that are associated with each of those assets during our inventory
process we have to determine what our assets are and an asset is
anything that has value for the organization while we are identifying
our assets we have to perform a criticality assessment to determine
which asset are most crtical and which asset are the least crtical,

We have to perform risk assessment on each of our asset to

determine what risks may exist and how to mitigate those risks and
then we will have to assign our recovery goals and priorities, while
we are conducting our business impact assessment there are
several key metrics that will be come up with MTD –RPO-RTO

Also there are other criteria should be determined

Need to remember that a disaster can happen anytime usually

without warring, so it’s important that you are prepared for disaster
before they accour, you also make sure that you are comply with any
legal regulation.

based on the industry there are there are difference type of losses
categories ,you could loss revue an interruption in cash flow ,you
could have extra expenses if a disaster occurs like needed to
purchase new equipment ,you may compramizes your customer
service and upsetting your clients

it’s also important to know how to priotrize and immediate crises VS

smoldering one
 Once you have finished conducting the BIA you should have identified all of critical
department and resources determined threats risks discovered the impact that risk could have on the
organization. determine the outage time that would be acceptable. determine any recovery alternative
and also determine how to protrize your recovery step based on criticality and relationship of each
indivual system that effected . once you conducted the BIA you want to document your results and
present to the management for approval
GDPR:General data protection regulation

GDPR stands for General Data Protection Regulation. It's the core of Europe's digital
privacy legislation.

There are 7 pricipal for GDPR

1- Lawfulness , fairnesss, transperancy

Lawfulness: means you are complying with the low and respect the spirit of low that means
any processing that company carries out you identify a purpose as per low.

Fairness: you take action which are in proportion to the processing like you use legitimate
interest as a business processing purpose if you do that it must not violate the rights and
freedom of individual.

Transparency: you as company are transparent towards individual, you inform them what
data you collect what you do with it ,why you do share it with and how do you respect their
rights, how you do that but publishing a privacy statements or privacy notice on your
website and cookies notice as well in that category

2- Purpose limitation:

Mapping your process activities to the legitimate purposes as allowed with GDPR
 Exp: contractual obligation or contractual agrrement ex: you collect personal data for event
that you are organizing for maybe event you organizing now, after that you want to send a
newsletter that the separate purpose did you tell them you are going to send them a
newsletter or not, if not, you have to ask

At the end you should ask for permission to use their data.

3- Data minimization:

You collect the data that strictly nessasery for the purpose for which you are collecting ex:
you want to offer newsletter subscription normally you need an email to send do you need
name, but you don’t need a birthday or any other information any other it’s against the data
minimization

4- Data accuracy

You keep personal data of individual accurate at all time that you maintain personal data up
to date,how do you do that to ask from time to time to update your record that your mobile
number still the same, you email,or address still the same

5- Storage limitation:

Data has expiration date or retention period, so don’t keep personal data for ever

6- Integrity and confidentiality

Means the personal data you have is made confidential, kept secure and protect the
integrity of the data the cannot be altered by unauthorized people

7- Accountability:

Means that you as accompany are acting in a responsible and accountable manner and you
can demonstrate compliance with GDPR and it’s principals on going basis

SOX

SOX compliance is an annual obligation derived from the Sarbanes-Oxley Act (SOX) that requires
publicly traded companies doing business in the U.S. to establish financial reporting standards,
including safeguarding data, tracking attempted breaches, logging electronic records for auditing,
and proving compliance

There are 4 control for SOX

access control, change management, segregation of duties, cybersecurity

solutions, and backup systems.
Sarbanes-Oxley is arranged into 11 titles. As far as SOX compliance is concerned, the
most important sections within these are often considered to be 302, 404, 409, 802 and
906.

Section 302 – Corporate Responsibility for Financial Reports – Every public company is
required to file periodic financial reports with the SEC, and the principal executive officer
and the principal financial officer must sign each report to indicate they have reviewed it
and they certify that the report does not contain any untrue statements and does not omit
any material information. In addition, the signers of the report are responsible for
establishing and maintaining internal sox controls and must have validated those
controls within 90 days prior to issuing the report

Section 404 – Management Assessment of Internal Controls – All annual financial reports
must include an Internal Control Report stating that management is responsible for an
“adequate” internal control structure, and an assessment by management of the
effectiveness of the control structure. Any shortcomings in these SOX controls also must
be reported. In addition, registered external auditors must attest to the accuracy of the
company management’s assertion that internal accounting controls are in place,
operational and effective.

Section 409 – Real Time Issuer Disclosures – Companies are required to disclose to the
public in a timely manner any material changes in the financial condition or operations of
the company in the interest of protecting investors and the public.

Section 802 – Criminal Penalties for Altering Documents – Anyone who knowingly alters,
destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record,
document, or tangible object with the intent to impede, obstruct, or influence the
investigation or proper administration of matters before the SEC can be fined, imprisoned
for no more than 20 years, or both.

Section 906 – Corporate Responsibility for Financial Reports – The criminal penalty for
certifying a misleading or fraudulent financial report can be upwards of $5 million in fines
and 20 years in prison.

PCI-DSS

Payment card industry data security standard: it’s applies to all merchants
and services providers that process, transmit or store cardholder data.

It’s lunched on 2004 and it’s colloberation between the major credit card
brands like American express,discover ,mastercard , JCB and visa

How to become PCI-DSS compliant?

It’s specifies 12 requirements that are organized in to six control objectives

1- Build and maintain a secure network

 install and maintain a firewall configuration to protect cardholder data
  Do not use vendor-supplied defaults for system passwords and other security
parameters
2- Protect card holder data
 Protect stored cardholder data
 Encrypt transmission of cardholder data across open, public networks
3- Maintain a vulnerability management programme
 Use and regularly update anti-virus software or programs
 Develop and maintain secure systems and applications
4- Implement strong access control measure
 Restrict access to cardholder data by business need to know
 Assign a unique ID to each person with computer access
 Restrict physical access to cardholder data
5- Regularly monitor and test network
 Track and monitor all access to network resources and cardholder data
 Regularly test security systems and processes
6- Maintain an information security policy
 Maintain a policy that addresses information security for all personnel