ARC Paper 2 Internal audit review IT disaster recovery cover

Cairngorms Nation­al Park Author­ity Ugh­dar­ras Pàirc Nàiseanta a’ Mhon­aidh Ruaidh

Audit and Risk Com­mit­tee Paper 2 19 June 2026 Page 1 of 3

For dis­cus­sion

Title: Intern­al audit review – IT dis­aster recov­ery advis­ory Pre­pared by: Cov­er paper-Louise Allen, Head of Fin­ance and Cor­por­ate Oper­a­tions Paper: Shaun Rod­dan, wbg-assign­ment leader

Pur­pose

This paper presents the res­ults of the Intern­al Auditor’s advis­ory review on IT dis­aster recov­ery pro­ced­ures. The pur­pose of the review was to assess Park Authority’s IT Dis­aster Recov­ery arrange­ments in the con­text of cur­rent hybrid work­ing, cloud-based ser­vices, and recent digit­isa­tion. The review focused on the prac­tic­al effect­ive­ness of recov­ery plan­ning, sup­port­ing doc­u­ment­a­tion, and mit­ig­a­tion meas­ures, provid­ing prag­mat­ic recom­mend­a­tions to strengthen IT resi­li­ence going for­ward. This review formed part of our ²⁰²⁵⁄₂₆ Intern­al Audit Annu­al Plan.

Recom­mend­a­tions

The Audit and Risk Com­mit­tee is asked to a) Con­sider the intern­al aud­it­ors report and find­ings. b) Endorse the man­age­ment responses to recom­mend­a­tions for future action and improvements.

Exec­ut­ive Summary

1. The aim of the assign­ment was to provide guid­ance to the Park Author­ity, and in par­tic­u­lar, to its IT and Inform­a­tion Man­age­ment teams, to sup­port the devel­op­ment of pro­por­tion­ate pro­cesses and doc­u­ment­a­tion, giv­ing con­fid­ence that, on com­ple­tion of the improve­ments recom­men­ded, the fol­low­ing object­ives will have been met: a) The Organ­isa­tion has a cur­rent and doc­u­mented IT Dis­aster Recov­ery approach appro­pri­ate to its sys­tems, ser­vices, and oper­a­tion­al needs. b) Roles and respons­ib­il­it­ies for IT recov­ery are clearly defined, com­mu­nic­ated, and under­stood by rel­ev­ant staff. c) Crit­ic­al IT sys­tems, includ­ing cloud-based SaaS, on premises sys­tems, and spe­cial­ist plat­forms such as Geo­graph­ic inform­a­tion sys­tem (GIS), are iden­ti­fied and included in recov­ery plan­ning. d) Backup arrange­ments are suf­fi­cient, reli­able, and aligned with oper­a­tion­al require­ments, includ­ing clar­ity over third-party respons­ib­il­it­ies. e) Recov­ery expect­a­tions, includ­ing Recov­ery Time Object­ives and Recov­ery Point Object­ives, are estab­lished and aligned to busi­ness pri­or­it­ies. f) Resi­li­ence and mit­ig­a­tion meas­ures are in place to reduce the like­li­hood and impact of IT ser­vice dis­rup­tion. g) Test­ing on recov­ery arrange­ments can be car­ried out in a pro­por­tion­ate and prag­mat­ic way, with les­sons from tests and past incid­ents applied to strengthen plans. h) IT Dis­aster Recov­ery plan­ning con­siders cyber-related incid­ents, includ­ing the abil­ity to respond to ransom­ware, data cor­rup­tion, or cloud ser­vice dis­rup­tion, and that mit­ig­a­tion and recov­ery meas­ures are appropriate.

2. The report recog­nises the IT team’s ​‘strong work­ing know­ledge of the Park Authority’s sys­tems and their under­stand­ing of key infra­struc­ture depend­en­cies. It stresses the need for this know­ledge to be doc­u­mented to guide action in the event of a recov­ery situation.

3. Examples of good prac­tice iden­ti­fied are shown in the table below. It is reas­sur­ing to see the pro­gress made in devel­op­ing our IT sys­tems to great­er maturity.

Areas where the Organ­isa­tion is oper­at­ing effect­ively and fol­low­ing good practice:

• A suite of IT policies is in place, includ­ing accept­able use, access man­age­ment, and admin­is­trat­ive account con­trols, sup­por­ted by struc­tured Share­Point site own­er­ship and extern­al shar­ing guidance.

• A third-party inform­a­tion man­age­ment log­ging sys­tem is in place, provid­ing vis­ib­il­ity of sys­tem activ­ity and sup­port­ing audit­ab­il­ity of key actions. This enhances over­sight of inform­a­tion hand­ling and extern­al inter­ac­tions across the environment.

• Microsoft Intune is in use with defined device policies and com­pli­ance con­trols in place, sup­por­ted by mon­it­or­ing and report­ing cap­ab­il­it­ies. This is fur­ther com­ple­men­ted by Microsoft Defend­er and Microsoft 365 secur­ity cap­ab­il­it­ies, includ­ing anti­vir­us and end­point detec­tion and response func­tion­al­ity, which togeth­er provide an estab­lished baseline for end­point secur­ity and device man­age­ment across the Organisation.

• The Organ­isa­tion is mov­ing towards more struc­tured secur­ity prac­tices, includ­ing great­er adop­tion of least priv­ilege prin­ciples and improved man­age­ment of user access across sys­tems. This reflects a pos­it­ive tra­ject­ory in strength­en­ing baseline secur­ity con­trols with­in a com­plex environment.

• The use of shared ser­vice arrange­ments, par­tic­u­larly in rela­tion to GIS and plan­ning sys­tems, provides access to spe­cial­ist cap­ab­il­ity and infra­struc­ture that would be dif­fi­cult to rep­lic­ate intern­ally. These arrange­ments sup­port oper­a­tion­al con­tinu­ity and reflect a prag­mat­ic approach to ser­vice deliv­ery at organ­isa­tion­al scale.

• The Organ­isa­tion has suc­cess­fully transitioned a num­ber of ser­vices into cloud-based or hybrid envir­on­ments, includ­ing M365 and extern­ally hos­ted applications.

1. The Auditor’s recom­mend­a­tions are: a) the devel­op­ment of a con­cise and prac­tic­al IT Dis­aster Recov­ery doc­u­ment b) defin­i­tion of a simple and pro­por­tion­ate approach to sys­tem crit­ic­al­ity and recov­ery expect­a­tions c) review and doc­u­ment­a­tion of backup arrange­ments across all key sys­tems d) devel­op­ment of test­ing pro­to­cols e) the review of GIS data man­age­ment and reten­tion arrange­ments f) the doc­u­ment­a­tion of a form­al Cyber Incid­ent Response Plan

Con­clu­sion

1. This was a help­ful and inform­at­ive piece of work, car­ried out in a sup­port­ive man­ner and well received by the teams at the Park Author­ity. We are grate­ful to the Aud­it­or for his approach and for the recom­mend­a­tions made.

2. The recom­mend­a­tions made were accep­ted by management.

Louise Allen louiseallen@​cairngorms.​co.​uk 03 June 2026