Background and Context

The Australian Maritime Safety Authority (AMSA) is the national agency responsible for maritime safety, protection of the marine environment, and maritime and aviation search and rescue. It is governed by the Australian Maritime Safety Authority Act 1990 and other relevant legislation.

A list of office locations is available online at https://www.amsa.gov.au/about/who-we-are/amsa-state-and-territory-offices.

AMSA is undergoing a major review and refresh of its Business Continuity Plan (BCP) and ICT Disaster Recovery Plan (DRP). The work has been split into two streams, one focused on the overarching BCP and one focused on the ICT DRP. The BCP stream has been in-flight for some time and has made good progress and we are now looking to partner with an organisation to work with AMSA to uplift our DRP.

The BCP stream has completed Business Impact Assessments across the organisation and has identified critical business processes and the underlying systems and data that support these processes. In addition requirements around Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) has been captured.

Services Required / Deliverables

We are looking for an organisation to bring in best practice Disaster Recovery Frameworks to build a DRP for AMSA from scratch rather than updating the existing plan.

Disaster Recovery Plan / Framework (including but not limited to)

• Governance processes and strategy to enact and manage ICT disaster recovery;
• Communications plan;
• Definition of critical systems;
• Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO);
• Considerations of the role of 3rd party service providers, suppliers and vendors;
• Normalisation to BAU operations;
• DR testing approach;
• Maintenance and continuous improvement activities relating to the DR framework.

Detailed Recovery Plans

• Provide guidance on structure, inclusions and level of detail that should be included in each plan (noting that the content will be completed by AMSA and its service providers).

Disaster Recovery Testing

• Awareness and training session for all staff with responsibilities in the DRP or underlying recovery plans.
• Oversight and review of the first Disaster Recovery Test under the new framework and plan.