ARC Paper 2 Annex 1 IT disaster recovery report

This document contains an advisory review of the Cairngorms National Park Authority's IT Disaster Recovery arrangements, conducted in May 2026 as part of its internal audit plan for 2025-26. The review assessed the Park Authority's recovery planning, documentation, and mitigation measures, considering current hybrid working, cloud services, and recent digitisation, to provide practical recommendations for strengthening IT resilience. It identified areas of good practice, such as existing IT policies and the adoption of cloud-based services, but also raised six key action points for improvement. These recommendations include establishing a comprehensive IT Disaster Recovery framework and documentation, clearly defining system criticality and recovery expectations, enhancing backup arrangements and third-party assurance, implementing structured testing for IT Disaster Recovery, improving Geographic Information System (GIS) data management, and integrating cyber incident scenarios into recovery planning. The overall aim is to further develop and formalise the Park Authority’s IT resilience.