Skip to main content

4. Mitigations

For each service impact you identify in section 3.4, think about what you can do in advance to prepare the firm for the loss of that service. Consider both response and recovery requirements.

Examples follow (replace/edit as required).

Service Impact Response Requirements Recovery Requirements
Physical files unavailable
  • Physically copy or digitize all critical physical files and store in an offsite location
  • Consider how to access the offsite physical or digital copies
Enter the Recovery Requirement
Office equipment unavailable
  • Consider how to access to suitable office equipment (e.g. print, copy, fax)
Enter the Recovery Requirement
Conference rooms unavailable
  • Arrange for access to suitable temporary shared conference room space
Enter the Recovery Requirement
End user computers unavailable
  • Consider how to access to suitable temporary or permanent end user computers
  • Consider if it is necessary to back up data stored on end user computers
  • If so, implement a backup and restoration strategy that meets desired RTO and RPO
IT infrastructure permanently lost
  • Consider how to access to suitable replacement IT infrastructure
  • Implement a backup and restoration strategy for IT infrastructure configurations that meets desired RTO and RPO
Workspaces permanently lost
  • Consider where people will work if the office is unavailable
  • Make any possible preparations in advance (e.g. work from home plan, shared office space plan)
Enter the Recovery Requirement
Digital work product stored at the office is unavailable
  • Consider how to provide access to backup data
  • Implement an in-office work product backup and restoration strategy that meets desired RTO and RPO
Cloud-based email service is unavailable
  • Consider how to communicate with clients during the service outage
  • Consider methods of preserving historical content during service outages
  • Implement a cloud-based email backup and restoration strategy that meets desired RTO and RPO