Disaster Recovery plans. These are

Disaster Recovery plans. These are intended to provide infrastructure and
operations capabilities at another location. These plans assume that such
operations cannot continue at the original location due to forces of nature
(e.g. earthquakes, weather conditions) or deliberate actions such as sabotage,
terrorist attacks, etc.
It should be noted that Disaster Recovery plans focus on physical infrastructure and
will be of limited use if software or data have been corrupted through some form of
cyber-attack.
The next level of planning for continued operations is that of Business Continuity
Planning and addresses the possible unavailability of offices, access to buildings or
significant interruptions of utilities. Business Continuity Planning is not the
responsibility of information systems and I.T. operations providers.
Crisis Management is the third major component of responding to information
security events. It differs from the above two insofar that it involves parties outside
the organisation, i.e. stakeholders, the media and others depending on the nature of the
organisation.
8.4. The legislative landscape
As mentioned earlier, the Council of Europe Convention on Cybercrime is an
established instrument that addresses the cross-border nature of cybercrime. There is
also the European Union Directive 95/46/EC on Data Protection, of which a draft
intended to supersede it was made public early in 2012.
These complements national portfolios of legislation. As technical innovation is
faster than establishing legislation there remain many grey areas. These y vary from
country to country. Corporate legal counsel is best qualified to identify applicable
legislation and brief those responsible for the implementation and operation of
computer systems and services about them