Neatly onto our third module, disaster recovery. If we can mitigate, if we can prevent, then it helps prevent the need for business continuity and disaster recovery. Investing in some of those preventative measures helps avoid the need for some of these areas. But just as with business continuity, we want to look at the goal of disaster recovery, what we're trying to manage here. Disaster recovery planning, and also just thinking about it in practice. We are distinguishing between business continuity, keeping things running during that critical state when the contingency has happened to disaster recovery, getting to a more sustainable state. Let's look at NIST's definition. In SP800-34, we see disaster recovery defined as restoring the operability of the target system, application or computer facility infrastructure at an alternate site after an emergency, effectively restoring operations. This is usually what happens after we've had business continuity plans in place, after we've tried to continue operating, we want something more sustainable. We've had long-term impacts, long-term effects. We need to understand what has been disrupted. Usually there's a physical element to this, maybe our primary facility is unavailable. That was the case with the pandemic. There was a physical issue that led to us working differently with technical systems and services. We may need to relocate information systems and operations to a new location. This might be the data center, the computers. This may be the people, if your primary building burns down for example. Your data center, the computers and equipment that were hosted within that building will need relocating or, and possibly and, the people will need somewhere else to work from as well. We've got both of those to think about. What we saw during the pandemic, just picking up on that again, is that the alternative place for people to work commonly was from home. Now that's not a one-size-fits-all environment, but where people commonly for office workers, during business continuity, they worked from home five days a week. As things approached a new normal, we started to see people perhaps working from home two or three days a week, and then in the office, more social distancing. Different way of working, this would be disaster recovery. This is similar to a business continuity plan. We have documentations of instructions, procedures that describe how an organization's mission, or business processes will be sustained during and after a significant disruption. Again, we can use business impact analysis to help us prioritize some of the things that we're doing here. Our plan should involve the correct people, those people that we need to be involved with disaster recovery. We need to understand when we're going to invoke the plan. We need to understand which controls we have available. We have alternate sites. If we have a live data center, in the example I gave a building burning down, our primary office and data center burning down. Have we got a fail-over capability at another data center perhaps? Do we have backups that we can restore information from? Do we need to restore from backups? We think about preventative controls. Within the recovery plan, we need people to decide how we're going to communicate and also some authority to operate, to mandate. Where we have a plan, we need to test the plan. In terms of business continuity and disaster recovery plans, I would say one of the biggest problems we see is that they fall out of currency. They become outdated. Just think about, for example, contact numbers. People's mobile or cell phone numbers. Big problem I see in these plans is when reviewing them, after a few months, if somebody moves on, you need to update that documentation. If we have a new employee replacing an old employee, we take out the legacy number and we introduce the new number. It sounds really simple, really common sense, but it's a big problem with these documents. You go to access them, and they haven't been updated for perhaps two years, and a lot of the information in them is meaningless. A lot of organizations have BC or DR plans, but their effectiveness varies. This is why we want to be reviewing them, I would say at least annually. Some regulated industries have to do it more frequently than that. In practice then, just thinking about pandemic. Well, we've talked a little bit about that. In terms of moving to a new normal, a new way of working, office spaces, I find commonly are still not quite back to the way they were before the pandemic. We're not in business continuity mode, now we've recovered to a different way of working. I've seen some offices were one in three desks or one in two desks are empty, some people are still working from home. There, again, varies wildly depending on the kind of industry, the organization that you're in. Some universities still increasing the use of home working for lectures perhaps, whereas seminars are now in-person. We've got something that is more sustainable. I just offer that challenge. What if we documented about what happened during the pandemic? What was our experience? Important to recognize not everything will go well. Every single adverse event, incident, business continuity, disaster recovery exercise I've been involved in, there has been something that hasn't gone according to plan. That's not a failure. Even if we invest significantly in preparation, there may be things that we need to update and adapt to.