Engagement Memo—Audit of Disaster Recovery Processes for the Company’s Operational Technology Systems

We are initiating an audit of Amtrak’s (the company) disaster recovery processes for its operational technology (OT) systems. Our objective will be to assess the company’s disaster recovery processes, including efforts to reduce the risk of disruption to its OT systems. We may expand our scope or modify our objective during the audit. We plan to interview company officials responsible for maintaining disaster recovery processes for its OT systems; review related policies, documents, and procedures; and analyze relevant company data. We will coordinate meetings with staff in advance.

We will perform our work in accordance with generally accepted government auditing standards. Our interactions with the company will be consistent with P/I 2.1.4, which sets forth the relationship between our office and the company. In particular, section 7.0 of the policy discusses coordination between company officials and our Office of Audits.