Item - 2023.AU3.7

The Audit Committee recommends that:

1. City Council direct that the Confidential Attachment 1 to the report (November 16, 2023) from the Chief Technology Officer, the Chief Information Security Officer, and the Executive Director, Toronto Emergency Management, remain confidential in its entirety, as it involves the security of property of the City.

2. City Council request the Chief Technology Officer, in co-ordination with the Chief Information Security Officer and the Executive Director, Toronto Emergency Management to report to the Audit Committee in the third quarter of 2024 on the status and progress of the Information Technology Disaster Recovery Plan from each City of Toronto division, agency and corporation; the status update should also be reported for City of Toronto's Corporate Technology Services Disaster Recovery Plan, including business continuity and cyber major incident.

This report provides a status update on the Information Technology (IT) Disaster Recovery Plan pursuant to a City Council decision under AU13.9 - Status Update of the Information Technology Disaster Recovery Plan on July 19, 2022. In this motion, the City Council has requested the Chief Technology Officer, in co-ordination with the Chief Information Security Officer and the Executive Director, Toronto Emergency Management to report to the Audit Committee in the third quarter of 2023 on the status of the Information Technology disaster recovery plan from each City of Toronto division, agency and corporation including the status update for the Enterprise Information Technology Disaster Recovery Program, business continuity, and cyber major incident response.

The City of Toronto creates and manages large volumes of information systems and data. The impact of data loss and outage of information systems due to hardware failure, human error, hacking, malware, or a natural disaster could be significant. Should such an event occur, an Information Technology Disaster Recovery Plan is designed to assist in the recovery efforts while protecting Information Technology assets and ensuring business continuity.

This report provides information on the approach undertaken by Technology Services Division (TSD), in collaboration with Toronto Emergency Management (TEM) and the Office of the Chief Information Security Officer (CISO), in gathering input from the City's different divisional Information Technology units, agencies and corporations about the current state of their plans relating to Information Technology disaster recovery, business continuity, and cyber incident response. Additionally, this report provides information on the status of the Enterprise Information Technology Disaster Recovery Program led by Technology Services Division, which aims to improve the overall disaster recovery capability of the City of Toronto’s mission-critical applications and foundational Information Technology systems in the face of unforeseen events such as natural disasters, major cyber-attacks and / or hardware failures. An update is given on the City's business continuity and cyber major incident response plan. The analysis and details of this update are provided in Confidential Attachment #1