Write a Change Management Policy Report that documents and facilitates the management of systems recovery effort.

Read Systems Recovery scenario below.

Write a Change Management Policy Report that documents and facilitates the management of systems recovery effort.

The report should be of the following length: between 1250 and 2500 words.

Read the following questions carefully and include ALL of the following components in the Change Management Policy Report:

List system changes and justify change rationales for the Change Control Approval Board to evaluate.

Create a system diagram to communicate with stakeholders in change management.

Apply change management to help the system recover from the ransomware attack.

Include the change request reasons and explain how the system functionalities can be improved.

Apply risk management framework (RMF) to control changes and reduce risks to the system.

Create a list of change management benefits to Ackme’s mission.

Please read H. Ackme Oil & Gas Background Material (Links to an external site.) and the scenario information below before attempting your assignments for this module.While Ackme is collecting evidence for the FBI on the Gas Network data leakage, possibly tied to the backdoor on equipment from Critical Infrastructure Company, the systems from the ransomware attack need to be recovered.

PLATFORMS

After careful investigation, the platforms’ risk assessment and COAs resulted in a multi-phased approach to rid the network of the ransomware while abiding with local and national laws. Ackme made a decision to reject the ransom demand.

RESPONSE

The planned equipment upgrades were accelerated where possible, within the limits of the manufacturer. Two of the victim locations were transitioned to the new hardware, one within two weeks and the other within a month. This being the safest option, the team had mitigated risks after completing accelerated tests on an existing site that had already been upgraded. This left two sites in which Ackme had to provide risk assessments on paying the ransomware versus the staged upgrades with the possibility of downtime and re-infection. The platform control room workstations were reimaged with “clean” copies and configuration files from backup were used to recover to the prior state. The team had disconnected the subsystems from the Master Control Room while the collective platform was monitored as best as possible from one of subsystems. During this time communications from the regional center could not reach into the platforms detail operations.After their response Ackme’s engineers were left with at least 3 points of vulnerability:

The vulnerability previously used to install the ransomware may remain, risking recurrence of the attack.

The computers and control devices attached to compromised platform central management systems are in an unknown state in terms of compromise. How far did the attack reach? Was there lateral movement that impacted these systems and does it remain?

The central systems, although recovered, may still be vulnerable to future attacks. The motive of the attacker is very important here. If the goal was to cause disruption, the attack was a success. If it was financially motivated, either for losses to Ackme or gains via the ransomware, the latter was successful.

Requirements: 2500 word max