Reference no: EM133772994

Question 

Organizations exist in a globally competitive environment where there are threats such as natural disasters, geopolitical threats, and cybersecurity risks. As such, organization leaders must develop a business continuity plan to ensure the successful continuation of the organization during a period of disruption. Students will conduct a risk assessment, business impact analysis, and bring out a business continuity plan for their selected organization. Students will use the virtual system and vulnerability assessment tools to simulate systems security vulnerabilities within the organization's business application systems.

Part 1:

Conduct a qualitative risk assessment and assess the impact the risk will have on the organization after conducting a vulnerability scanning of the provided systems. Address the following:

Identify critical systems and their impact on the organization.

Highlight high-risk findings and recommend mitigation strategies.

Explain what is to be done in each case identified above to compensate for controls that cannot be implemented (an alternate control).

Part 2:

Develop a contingency plan to include: business continuity, disaster recovery, and incident response. This will not be a technical risk assessment, but an assessment of the organization selected. Address the following:

Explain the contingency plan to address and prioritize compliance gaps.

Provide a cost/benefit analysis.

Describe when some controls cannot be implemented (because implementing these controls will reduce business functionality or endanger human lives).

Demonstrate how compensating controls can ensure the noncompliant system can continue to operate within the secured and compliant environment.

Differentiate the likelihood of a cybersecurity breach within the compliant environment and its impact on the organization (make sure to consider emerging risks, threats, and vulnerabilities).

Part 3:

For your organization, take the NIST cybersecurity framework controls and reduce them to system configuration requirements and system test cases with pass/fail criteria.