Project Part 4: Business Impact Analysis (BIA) and Business Continuity Plan (BCP) Senior management at Health Network has decided they want a business impact analysis (BIA) that examines the company’s data center and a business continuity plan (BCP). Because of the importance of risk management to the organization, management has allocated all funds for both efforts. Your team has their full support, as well as permission to contact any of them directly for participation or inclusion in the BIA or BCP. Winter storms on the East Coast have affected the ability of Health Network employees to reach the Arlington offices in a safe and timely manner. However, no BCP plan currently exists to address corporate operations. The Arlington office is the primary location for business units, such as Finance, Legal, and Customer Support. Some of the corporate systems, such as the payroll and accounting applications, are located only in the corporate offices. Each corporate location is able to access the other two, and a remote virtual private network (VPN) exists between each production data center and the corporate locations. The corporate systems are not currently being backed up and should be addressed in the new plan. The BCP should also include some details regarding how the BCP will be tested. For this part of the project: Research BIAs and BCPs. Develop a draft BIA plan for the Health Network that focuses on the data center. The BIA should identify: Critical business functions Critical resources Maximum acceptable outage (MAO) and impact Recovery point objective (RPO) and recovery time objective (RTO) Develop a draft BCP that could recover business operations while efforts are ongoing to restart previous operations. You may use or repurpose a BCP template you find online. Include a description of how you would test the plan.

Write a three to five page report using your research. At a minimum, your report must include the following: 1.An introduction or overview of event management systems and the potential security and privacy concerns which could arise when implementing this technology. This introduction should be suitable for an executive audience. Provide a brief explanation as to why three major operating units believe the company needs this capability. 2.An analysis section in which you address the following: A recommendations section in which you identify and discuss five or more best practices for security and privacy that should be implemented before the technology is put into use by the company. Include at least one recommendation in each of the following categories: people, processes, policies, and technologies. A closing section (summary) in which you summarize the issues related to your chosen use case and the event management platform overall. Include a summary of your recommendations to Padgett-Beale leadership.ScenarioThe Entertainment Team (ET -- part of Resort Operations at Padgett-Beale, Inc.) is excited about a new event management platform and is ready to go to contract with the vendor. This platform is a cloud-based service that provides end-to-end management for events (conferences, concerts, festivals). The head of Marketing & Media (M&M) is on board and strongly supports the use of this system. M&M believes that the data collection and analysis capabilities of the system will prove extremely valuable for its efforts. Resort Operations (RO) also believes that the technology could be leveraged to provide additional capabilities for managing participation in hotel sponsored “kids programs” and related children-only events. Several other high level managers have expressed concerns however, about one of the capabilities that ET, M&M, and RO are most excited about – customizable RFID wrist bands for managing and tracking attendees.For an additional fee, the event management platform's vendor will provide customized RFID bands to be worn by attendees. These bands have unique identifiers embedded in the band that allow tracking of attendees (admittance, where they go within the venue, what they "like," how long they stay in a given location, etc.). The RFID bands can also be connected to an attendee's credit card or debit card account and then used by the attendee to make purchases for food, beverages, and souvenirs. The head of Corporate IT has tentatively given approval for this outsourcing because it leverages cloud-computing capabilities. IT's approval is very important to supporters of this the acquisition because of the company's ban on "Shadow IT." (Only Corporate IT is allowed to issue contracts for information technology related purchases, acquisitions, and outsourcing contracts.) Corporate IT also supports a cloud-based platform since this reduces the amount of infrastructure which IT must support and manage directly.The project has come to a screeching halt, however, due to a request by the Chief Privacy Officer for more information about the benefits of the RFID system and potential privacy issues. Once more, the management interns have been tapped to help out with a research project. The CPO expects and requires an unbiased analysis of the proposed use cases and the security and privacy issues which could be reasonably expected to arise. The defined use cases are: Children (under the age of 13) attending a hotel sponsored “kids club” program. Individuals attending a music festival or other event where IDs must be checked to establish proof of age (legal requirement for local alcoholic beverage consumption).Attendee management for trade shows

The BCP should describe an organization normal operation standards, practices, and procedures for operating systems, including critical systems. Develop standard operating procedures based on the most critical to least critical to continue business operations. Included in the standard operating procedures and best security engineering practices should be operating system fundamentals, operating system security, management of patches, and operating system protections. Determine differences between rogue and authorized access points with consideration to authorized service set identifiers (SSID). Tailor the BCP to recover from a ransomware attack. Include leadership decision-making options for payouts in such currencies as Bitcoin, which uses blockchain technology. Based on the recent outbreaks of ransomware attacks, identify key components of the given topology and describe how a ransomware incident would be contained or identified if an event occurred inside the given topology. What are the network security threats for a ransomware attack? Include these vectors as scenarios in the BCP and address remediation paths. Also include an incident response plan