Harborview Accounting LLC — document set

This program sets out how Harborview Accounting LLC protects its information, systems, and the data entrusted to it by customers and partners. It applies to everyone who works in or with the business — employees, contractors, and temporary staff — and to every device and service used for business purposes.

The controls in this program are proportionate to the size and nature of the business. They exist to keep the business operating, to meet the expectations of customers and insurance carriers, and to satisfy legal obligations around the data the business handles.

Because Harborview Accounting LLC handles personal information, this program also supports the business’s legal obligations for protecting it — the specific regimes that apply are set out under “Legal & regulatory obligations” below. Questions that go beyond day-to-day security practice are escalated to the owner, who takes advice where the answer isn’t obvious.

The business owner (or managing director) is accountable for this policy. A named security lead is responsible for day-to-day operation: managing accounts, checking that controls remain in place, and acting as the first point of contact for concerns. The current security lead is recorded alongside this policy.

Every member of staff is responsible for following this policy, for reporting anything suspicious promptly, and for asking before working around a control. No one is expected to diagnose a security problem — only to report it.

Harborview Accounting LLC is rolling out multi-factor authentication (MFA) across all accounts on Microsoft 365, starting with email and administrator accounts. New accounts are created with MFA enabled from day one, and the owner will review rollout progress monthly until it is complete. Completing this rollout is the business’s highest-priority security action.

MFA is not yet confirmed on all of the business’s other important logins — online banking, administrator consoles, remote access. Extending MFA to these accounts follows immediately after email in priority: they are the logins attackers move to once email is hardened.

Staff use the business’s password manager to generate and store a strong, unique password for every work account. Passwords are never reused across services, never shared over email or chat, and never written down in the open.

Administrator access to Microsoft 365 is limited to the smallest number of people who genuinely need it. Administrator accounts are used only for administration — day-to-day email and documents happen in ordinary user accounts.

When someone joins, they receive only the access their role needs. When someone leaves, access is removed no later than their last working day, using the leaver checklist at Appendix B.

Some work happens on personally owned devices. Any device used for business purposes — company or personal — must have a screen lock (5 minutes or less), an up-to-date operating system, and full-disk encryption enabled; the business verifies all three within 30 days of adopting this policy and at each annual review. Business data on a personal device stays inside business accounts (Microsoft 365); it is not copied into personal apps or storage.

Harborview Accounting LLC is putting endpoint protection (antivirus/EDR) in place on every device used for work. Built-in protection (such as Microsoft Defender) is enabled everywhere immediately as the baseline; the business will confirm coverage on all devices as a priority action. Insurers routinely ask for this control.

Operating systems, browsers, and applications install security updates automatically. Updates are not deferred indefinitely: a device that keeps failing to update is looked into, not ignored.

No work device runs an operating system or application that has stopped receiving security updates. When software reaches the end of its support life, it is upgraded or the device is replaced — not kept in service.

Business data lives in the business’s cloud storage and office server, inside business accounts — not in personal email, personal cloud drives, or on USB sticks. Access to sensitive folders is limited to the people who need them.

The business handles personal information about customers and contacts. It is collected only for a clear business purpose, kept only as long as it is needed, and disposed of securely when it is not — including paper copies, which are shredded rather than binned.

Confidential client material is stored in client-specific folders with access limited to the team working on that client. It is shared externally only through controlled links or agreed secure channels — never as open attachments to the wrong thread.

The office server is kept in a locked or supervised space, updated like any other device, and covered by the backup arrangements in this policy.

Every US state has a data-breach notification law. If personal information is exposed, the duty to notify is set by the law of the state where each affected individual lives — not only the state the business operates from — so a single incident can engage several states’ rules at once. Notification is generally required without unreasonable delay; many states set an outside limit of 30 to 60 days from discovery, though several set no fixed outer deadline and rely on the “without unreasonable delay” standard alone. “Discovery” is itself statutorily defined in most states and can be imputed — the clock frequently starts when the breach reasonably should have been known, not when someone actually noticed it. A number of states also require notice to the state attorney general once a threshold number of residents is affected. Establishing which laws apply is part of the assessment step in the business’s Incident Response Plan, taken with counsel where the answer is not obvious.

Harborview Accounting LLC operates from Massachusetts and treats Massachusetts’s breach-notification statute as its baseline, alongside the law of any other state where an affected individual lives. The specific statute, its deadlines, and its attorney-general reporting threshold are confirmed with counsel rather than assumed — this program records that the obligation exists and who is responsible for meeting it, not the text of the statute.

The business does work — such as tax preparation, bookkeeping, financial or investment advice, arranging financing or leases, or debt collection — that brings many small firms within the FTC’s definition of a “financial institution” for the purposes of its Safeguards Rule. That Rule asks for a written information security program (this document), together with: a named Qualified Individual responsible for it; a written risk assessment; access controls and a record of where customer information is held; secure development practices for any application the business builds in-house, and a change-management procedure for changes to systems holding customer information; logging and monitoring sufficient to detect unauthorized access to those systems; encryption of customer information in transit and at rest, unless the Qualified Individual approves an equivalent compensating control in writing; multi-factor authentication for any individual accessing any information system, unless the Qualified Individual approves an equivalent control in writing; once the business holds information on 5,000 or more consumers, continuous monitoring of its information systems or an annual penetration test together with vulnerability assessments at least twice a year; secure disposal of customer information within two years of the last time it was needed for business purposes, except where longer retention is necessary for business operations or other legitimate purposes or is required by law — with the retention policy itself reviewed periodically; staff training; written oversight of service providers; a written incident response plan; and a written report to the owner or board at least annually. The owner names the Qualified Individual alongside this program.

The Rule scales with size. A firm holding information on fewer than 5,000 consumers is relieved of several of the elements above — the written risk assessment, continuous monitoring or annual penetration testing, the written incident response plan, and the annual written report — though not of the Rule itself, and not of the program, the Qualified Individual, the access controls, the encryption, or the multi-factor authentication. The relief does not reach the Rule’s breach-reporting duty either: a security event meeting the reporting threshold is reported within 30 days regardless of how many consumers’ information the business holds. Whether the Rule applies to this business at all, and if so which of its elements, is a legal determination the business confirms with counsel; this program does not make that determination and does not by itself establish compliance with it.

Accepting card payments carries obligations from the card brands, administered through the business’s payment provider or acquiring bank: an annual self-assessment questionnaire (SAQ) matched to how the business accepts cards, and, in some cases, a quarterly external scan. Using a payment provider narrows which questionnaire applies; it does not remove the obligation, and it does not cover a checkout page the business hosts itself — that page’s own security stays the business’s responsibility even when the payment itself is processed elsewhere. The business completes the questionnaire its provider asks for and keeps the completed copy with this program. PCI DSS is a contractual standard rather than a federal law, though several states reference it in their own statutes.

A growing number of states give their residents rights over personal information held about them — typically to see it, correct it, delete it, and opt out of its sale. Most states set a volume or revenue threshold and many businesses of this size fall below them, but not every state uses one — Texas and Nebraska, for instance, reach any entity doing business in the state that processes personal data and does not qualify as a small business under the federal Small Business Administration’s own definition. Separately, a business already regulated under the Gramm-Leach-Bliley Act or as a HIPAA covered entity or business associate is frequently exempt from these state laws, in whole or in part, precisely because it is already regulated elsewhere — whether that exemption applies is worth confirming rather than assuming either way. A request does not stop being a request because the business is unsure whether it is covered: any request of this kind is passed to the owner the day it arrives, logged, and answered on advice rather than ad hoc.

A handful of states go further than requiring notification after the fact and impose their own security-program duty up front — reaching any business that holds their residents’ personal information, wherever the business itself is located. Massachusetts goes furthest: it requires a comprehensive written information security program of any business holding a Massachusetts resident’s personal information, regardless of the business’s own location or size. New York and Rhode Island require a security program with reasonable administrative, technical, and physical safeguards on the same out-of-state basis, without specifying in the statute that the program itself be in writing — though a written program is the ordinary way a business shows it has one. The trigger in every case is the residency of the people whose information is held, not the business’s own address, and which of these actually reaches this business is confirmed with counsel rather than assumed from this list.

Business data is backed up automatically. Backups are protected by the same account security as the rest of the business, so that an attacker who compromises a device cannot also destroy the backups.

The business will carry out its first test restore within 60 days of adopting this policy, and twice yearly thereafter, recording each result. An untested backup is a hope, not a control.

Remote work happens through business accounts on Microsoft 365 over the worker’s own secured connection. Public Wi-Fi is used only with the device’s VPN or hotspot fallback; sensitive work is not done on shared or public computers.

Remote access to the office server goes through a VPN or an equally secured connection — never a port opened directly to the internet.

The business keeps its list of online services and vendors current in the register at Appendix A. A new service is added to the register — and gets MFA and a unique password — before the business starts depending on it.

For every external service, the business records who is responsible for securing it, who manages its accounts, and who is contacted when it fails, and keeps that record current.

Day-to-day IT is handled by an outside provider. That provider’s access is treated with the same care as any administrator’s: named accounts rather than shared logins, MFA on every account the provider uses, and a yearly review of what it can reach. The provider’s responsibilities and contact details are recorded alongside this policy.

Card payments are handled entirely by the business’s payment provider. Harborview Accounting LLC never writes down, emails, or stores full card numbers itself — if a card number arrives by email or note, it is deleted and the customer is asked to pay through the proper channel.

Changes to payment details — the business’s or a supplier’s — are verified by a phone call to a number already on file, never a number supplied in the request itself, before any money moves. Changes above a set threshold need a second person’s approval before they take effect. An emailed request to change bank details is treated as fraudulent until proven otherwise.

Security awareness is currently covered informally when someone joins. The business commits to a short, structured refresher at least yearly — spotting phishing, using MFA, handling data, and how to report a concern — so that awareness no longer depends on who happened to do the onboarding. Completion is logged at Appendix C. Reporting a suspected mistake is always treated as the right move, never a disciplinary matter.

This policy is reviewed once a year — timed to the insurance renewal — and after any significant incident or change to how the business works. The review date and any changes are recorded on the document.

For every online service the business depends on, record in one place: the service name, who administers it, what data it holds, whether MFA and a unique password are set on it, and who to contact if it stops working. Start the register now with the services already named in this policy — Microsoft 365 and the business’s cloud storage and office server — and add every other service before the business starts depending on it.

When someone leaves the business, complete and date each step on their last working day: disable their account on Microsoft 365; remove them from any shared drives or folders; change any shared passwords they knew; collect company-owned devices; and confirm their access to every other business service has been removed. Keep the completed checklist with this policy.

Record, for each member of staff: the date of their onboarding security briefing, and the date of each annual refresher. Keep this log alongside the policy so training coverage can be checked at a glance during the annual review.

This plan tells everyone at Harborview Accounting LLC exactly what to do when something goes wrong: a phishing email that was clicked, a hacked account, ransomware, lost or stolen equipment, or data ending up where it shouldn’t. Its structure follows the widely used incident lifecycle: recognize, contain, assess, recover, learn.

Activate this plan whenever there is a reasonable suspicion of an incident. It is always better to activate and stand down than to wait for certainty — early action is what limits damage.

The incident lead is the security lead, with the owner as deputy. The incident lead directs the response and keeps the timeline; the owner decides external communication and any spend. Both are reachable by phone, and their current numbers are kept with the printed copy of this plan.

Key external contacts are listed alongside this plan and checked at each review: the business’s IT provider (with an out-of-hours number), its cyber insurance carrier’s claims line, and its bank. The IT provider is brought in no later than containment. If the business holds cyber insurance, the carrier is called early — most policies include incident support, and late notification can jeopardize the claim.

Anyone who notices something wrong reports it to the incident lead immediately, by phone or in person — not just by email, which may itself be compromised. Warning signs include: unexpected password-reset emails, sign-in alerts from unfamiliar places, files that won’t open or have strange extensions, colleagues receiving odd emails ‘from’ the business, or a device suddenly slowing or acting oddly.

The reporter writes down what they saw and when, and does not delete anything, run cleanup tools, or turn the device off unless told to — evidence and logs are what make recovery and any insurance claim possible.

For a compromised account: from a known-clean device, change the account password, sign out all active sessions, and check for new mail rules, forwarding addresses, or newly added devices. In Microsoft 365, the administrator does this from the admin console.

For a suspect device: disconnect it from the network (unplug the cable, turn off Wi-Fi) but leave it powered on, and stop using it. For suspected ransomware, disconnect the office server and any connected backup drives first — protecting the backups is the single most important containment step.

If money is involved — a fraudulent payment made or attempted — the bank is called immediately, before anything else in this plan. Banks can sometimes recall payments if contacted within hours.

Once contained, the incident lead establishes: what happened, which accounts, devices, and data were touched, and whether the incident is actually over. If the business has IT support or carrier-provided incident response, they are brought in here at the latest.

Because the business holds personal information, the assessment always answers one specific question: was personal information accessed, taken, or lost? If it may have been, the owner takes advice promptly on which state notification laws are triggered. The test is where each affected individual lives, not where the business is based, so one incident can engage several states at once; deadlines run from discovery — which several states define broadly enough to include when the breach reasonably should have been known, not only when it actually was — and many states set an outside limit of 30 to 60 days, though not all set a fixed limit at all. That makes this a day-one question, not a post-recovery one. Not every incident meets a notification threshold, and over-notifying has its own cost — advice is what settles it, not an assumption either way.

Notifying the individuals affected is often not the only filing. Many states also require notice to the state attorney general, and sometimes to consumer-protection or law-enforcement bodies, once a threshold number of that state’s residents is involved; some require the national consumer reporting agencies to be told as well. Several states also prescribe what the individual notice itself must — and must not — contain, so a generic notice letter is not always enough on its own. Massachusetts’s attorney general publishes how and when to file, and the incident lead checks that page as part of the assessment. The current link is kept with this plan so nobody is searching for it mid-incident.

Where the FTC Safeguards Rule applies to the business, a security event involving the unencrypted customer information of 500 or more consumers must be reported to the Federal Trade Commission through its online form as soon as possible, and no later than 30 days after discovery. The Rule presumes unauthorized acquisition of that information once there has been unauthorized access to it, unless the business has reliable evidence showing acquisition did not occur — an inability to prove data was taken is not itself a reason not to report. Information counts as unencrypted for this purpose if the encryption key was also accessed. This deadline is shorter than most state deadlines and runs independently of them — meeting a state’s 60-day limit does not satisfy it — and it is not one of the elements the under-5,000-consumer relief elsewhere in this program removes.

If client-confidential material may have been exposed, the affected clients are told promptly and honestly by the owner — before they hear it elsewhere. Contract terms with those clients may set specific notification duties; they are checked as part of the assessment.

Recovery starts only when the incident lead is satisfied the attacker’s access is gone: passwords rotated, MFA confirmed on affected accounts, malicious rules and devices removed, and compromised machines wiped or professionally cleaned before rejoining the network.

Data is restored from backup where needed, restoring the most recent copy from before the incident. Restored data is spot-checked before the business relies on it again.

Within two weeks of closing an incident, the incident lead runs a short review with everyone involved: what happened, what the timeline was, what worked, and what single change would most reduce the chance of a repeat. The write-up is kept with this plan, and the change is actually made — an unimplemented lesson is not a lesson.

The plan will be exercised as a short tabletop walkthrough — fifteen minutes, one scenario, everyone in the room — within 12 months of adoption, and annually thereafter, so that the first time anyone reads it is not during a real incident.

This policy explains what you may and may not do with Harborview Accounting LLC’s accounts, devices, and information. It exists to keep the business — and you — out of avoidable trouble, not to catch anyone out. If something here stops you doing your job, say so and it gets looked at; working around it quietly is the one response that isn’t acceptable.

It applies to everyone who works in or with the business — employees, contractors, temporary staff, and anyone else given an account — and to every device used for business, whether the business owns it or you do. It stays in force for as long as you hold that access.

Your accounts are yours. Don’t share a password with a colleague, don’t use someone else’s login “just this once”, and don’t let anyone — including family on a personal device — use a signed-in work account. If someone needs access, they get their own; that’s what makes it possible to tell who did what when something goes wrong.

Use the business’s password manager for every work account, and let it generate the password rather than choosing one yourself. Don’t keep work passwords in a browser profile signed into a personal account, in a notes app, or on paper at your desk.

Never approve a multi-factor authentication prompt you didn’t trigger. A prompt arriving out of the blue means someone else has your password — decline it and tell the owner the same day, even if it stops on its own. Repeated prompts are an attack in progress, not a glitch.

Treat unexpected attachments and links as suspicious, including ones that appear to come from a colleague or a client you know — a convincing sender name is the cheapest part of an attack. Check anything unexpected by a channel other than the one it arrived on: phone the person on a number you already have, don’t reply to the message asking “is this you?”

Any message asking you to change bank details, pay a new account, or move a payment forward urgently is treated as fraudulent until confirmed by phone on a number already on file — regardless of who it appears to come from, including the owner. Nobody at this business will ever be annoyed with you for making that call.

Don’t set up automatic forwarding from a work mailbox to a personal address, and don’t move work email into a personal account to “work on it at home”. Attackers set up forwarding rules for exactly this reason, so the business monitors for them and cannot tell the difference between yours and theirs.

Install software on work devices only from the official app store or the vendor’s own site, and only what you need for the job. Free tools that convert, compress, or “clean up” files are a common way malware arrives — if you need one, ask first.

Because some work happens on personal devices: keep the device’s operating system and apps updated, keep a screen lock on it, and keep business information inside business accounts (Microsoft 365) rather than copying it into personal apps, photo libraries, or personal cloud storage. If the device is lost, sold, or passed on, tell the owner first so business access can be removed.

Don’t plug in USB sticks or external drives of unknown origin, and don’t use them to move business information around. Anything that needs sharing goes through the business’s cloud storage and office server, where access can be seen and withdrawn.

Look after devices physically: lock the screen when you step away, don’t leave a laptop visible in a car, and don’t work on sensitive material where a stranger can read your screen. A device lost in public is reported the same day — the sooner it’s reported, the less it costs.

Business information stays in business systems. Don’t email documents to a personal address, don’t upload them to a personal cloud drive, and don’t keep the only copy of anything on your own device. If you need access somewhere, ask for it rather than routing around it.

Client-confidential material is shared only with the people working on that client, and only through the business’s approved channels. Check the recipient list before sending — the most common breach at a firm this size is a document sent to the wrong person, not an attacker.

When you leave, the information stays. Client lists, documents, templates, and contact databases belong to the business; taking copies isn’t allowed, and returning company devices with business information intact is part of leaving properly.

Public AI assistants — ChatGPT, Claude, Copilot, Gemini, and the rest — are useful and are not banned here. The rule is about what goes into them: don’t paste customer or client information, staff personal information, financial records, passwords, or anything covered by a confidentiality agreement into a tool the business hasn’t approved. Once it’s pasted, the business no longer controls where it sits or who can see it.

Because of the information this business handles, an AI tool is only approved for work involving customer or client material once the owner has checked what the vendor does with the data and, where the business’s obligations require it, has a written agreement in place. Until a tool is on the approved list, use it for general drafting only — never with real client material in the prompt.

Whatever an AI tool produces is your work once you send it. Check it for accuracy before it goes to a client, and never let it make a decision — about a payment, a person, or a client’s affairs — that you couldn’t explain and stand behind yourself.

If your firm prepares and files tax returns for compensation, disclosing or using a client’s tax return information without their prior written consent — in the form the Treasury Department’s regulations prescribes — carries its own federal exposure under IRC § 7216: criminal penalties where the disclosure or use is knowing or reckless, and civil penalties under IRC § 6713 even where it is not. Pasting return information into an AI tool that has not been checked and approved is potentially such a disclosure. Where the business prepares returns, treat return information — a client’s income, filing details, or anything drawn from a return — as never going into an AI tool outside the process the business’s Qualified Individual has approved, and confirm with counsel whether the consent Treasury requires is in place before any tool involving return information is approved at all.

Reasonable personal use of work devices and internet access is fine — checking a bank balance, booking an appointment. Keep it modest, keep it legal, and keep it away from anything that would embarrass the business. Don’t use work accounts to sign up for personal services.

The business can see activity on its own systems — sign-in records, security alerts, and, where there is a genuine reason such as investigating an incident or meeting a legal obligation, the contents of work accounts. It does not monitor personal devices, personal accounts, or private messages, and it does not read work email routinely or out of curiosity. Several states require advance written notice of this kind of monitoring, separately from this policy — see “Electronic monitoring notice” below, issued to each employee at hire. State and federal law also limit what an employer may monitor at all; where this policy and those limits differ, the law wins.

Working away from the office doesn’t change any of this. Use a network you trust or your phone’s hotspot rather than open public Wi-Fi, take calls involving client matters somewhere private, and be aware of who can see your screen in a shared space.

Harborview Accounting LLC monitors activity on the systems, devices, and accounts it provides for work: sign-in records and security alerts always, and, where there is a specific reason such as investigating an incident or meeting a legal obligation, the content of work accounts and communications. This does not extend to personal devices, personal accounts, or private messages. This notice is given to each employee, in writing, at or before the start of their employment; a copy is posted where staff can see it; and the employee’s signed acknowledgment that they received and read it is kept on file alongside this program. Several states require electronic-monitoring notice of this kind and prescribe their own form, timing, or posting requirement for it; where a state’s own requirement is more specific than this notice, the business follows the state’s version, and whether this notice satisfies a particular state’s statute is confirmed with counsel rather than assumed.

If you click something you shouldn’t have, send something to the wrong person, or lose a device — say so immediately, to the owner, by phone or in person. Nobody is disciplined for reporting a mistake promptly. The damage from an incident is set almost entirely by how fast it’s reported, and an hour of silence costs more than any error you could make.

Deliberately ignoring this policy — sharing accounts, moving business information out of business systems, disabling security controls, or concealing an incident — is a disciplinary matter. That is the only part of this document that is about consequences; everything else is about making it easy to do the right thing.

This plan covers the first days after Harborview Accounting LLC loses access to the systems it works on — through ransomware, a failed device or server, an outage at a supplier, a fire or flood, or simply losing the person who knows how something works. It is deliberately short: a plan nobody has read is worth less than one page everyone has.

It sits alongside the Incident Response Plan rather than repeating it. That plan answers “what do we do about the attack?”; this one answers “how do we keep serving customers while it’s being dealt with?” In a real incident both are open at once.

Restoration happens in a set order, decided now rather than in the moment: first the ability to communicate (Microsoft 365), then access to current working files in the business’s cloud storage and office server, then everything else. Anything not on that list waits, however loudly it asks.

Taking payment ranks with communication: a business that cannot invoice or accept payment for a week has a cash problem on top of a security one. The business keeps a way to raise an invoice and take payment that does not depend on its main systems being up, and the owner knows what it is without looking it up.

The office server is the single point of failure most likely to stop work entirely. Its role, what runs on it, and what is needed to rebuild it — license keys, configuration notes, supplier contacts — are recorded and kept somewhere that survives the server itself, not only on it.

Client and regulatory deadlines don’t pause for an outage. Where a filing, submission, or client commitment falls due while systems are down, the owner tells the client or authority early rather than missing it silently — an early call is almost always forgiven; a missed deadline discovered later is not.

Two numbers matter, and the owner records them here as decisions rather than hopes. How long the business can work without its main systems before the damage is serious: the working target is one business day. How much recent work it can afford to lose and redo: the working target is one day. If either number is wrong for this business, the owner changes it in this document — a target nobody has thought about is the one that fails.

Those targets are only as good as the backup behind them, which is why the restore test in the security program is on this plan’s critical path too: the first time anyone finds out how long a restore takes should not be the day it matters. The measured restore time is recorded here after the first test.

While systems are down the business keeps trading on paper and phone: a written note of every job, order, and payment taken, reconciled into the system once it’s back. Whoever takes the note keeps it — reconstructing a day’s work from memory a week later is how businesses lose money after the incident is over.

A phone signed into Microsoft 365 usually keeps working when a laptop or office network doesn’t, and is the fastest route back to email and current files. Staff are told this in advance so nobody sits idle waiting for a desktop to be fixed.

Because the team works remotely, an outage rarely stops everyone at once — but it also means nobody can walk to a colleague’s desk to find out what’s happening. The owner sends one update at the start and end of each day of an outage, to a channel everyone can reach without the affected system, and says explicitly when there is nothing new.

One page of contacts is kept both in the business’s systems and printed somewhere reachable: staff mobile numbers, the bank, the insurance carrier’s claims line, the landlord or building contact, and every supplier the business could not trade without for a week. It is checked at the annual review, because the number that matters is the one that has quietly changed.

The external IT provider’s out-of-hours number, the agreed response time, and what the contract actually covers outside business hours are recorded here. Discovering at 6pm on a Friday that support is business-hours-only is a continuity problem, not an IT one.

This plan is walked through once a year, timed to the insurance renewal, as a fifteen-minute conversation: if the main systems were unavailable tomorrow morning, what would each person actually do? Anything that turns out to be untrue gets corrected in this document the same day, which is the entire point of the exercise.

A continuity plan that has never been tested against a real restore is a document, not a capability. The restore test committed to in the security program is what turns this plan from the first into the second, and its result is recorded against the targets above.