Audit of. Information Technology Disaster Recovery. March 11, 2005

Size: px
Start display at page:

Download "Audit of. Information Technology Disaster Recovery. March 11, 2005"

Transcription

1 Audit of Information Technology Disaster Recovery March 11, 2005 Report

2 MISSION STATEMENT The School Board of Palm Beach County is committed to excellence in education and preparation of all our students with the knowledge, skills, and ethics required for responsible citizenship and productive employment. Arthur C. Johnson, Ph.D. * Superintendent of Schools School Board Members Tom Lynch, Chair William C. Graham Vice Chair* Paulette Burdick* Monroe Benaim, M.D. Mark Hansen Sandra Richmond Debra Robinson, M.D. Audit Committee Members Cindy Adair, Chair Richard Roberts, Vice Chair Max Davis Kevin James Noah Silver Arthur Sinai JulieAnn Rico Allison* Pam Popaca* *Ex-Officio Audit Committee Members

3 Audit of Information Technology Disaster Recovery Table of Contents Page EXECUTIVE SUMMARY 1 PURPOSE AND AUTHORITY SCOPE AND METHODOLOGY BACKGROUND CONCLUSIONS 1. School Infonnation Backups Not Sent Off-Site 4 2. Fuel Tank in IT Generator Not Full for Hurricane Frances 4 3. Temperature Not Properly Regulated in Off-Site Backup Storage Vault 6 4. A 19% Discount for a Hot-Site Contract not Captured 7 5. Two CD's Containing Critical Infonnation for Students and Employees Should be Stored in Off-Site Location 7 6. Disaster Recovery Documentation 8 7. Network Servers Not Backed up and Sent Off-Site Weekly 9 APPENDICES Management's Responses A. Department ofinfonnation Technology 10 B. Department ofmaintenance and Plant Operations 12 C. Department ofschool Food Service 13

4 Audit of Information Technology Disaster Recovery Executive Summary The primary objective ofhaving an IT Disaster Recovery Plan is to ensure the preservation of data integrity and backups. Backups provide assurance that important data and information is maintained for continued operation should disasters occur. Computer information should be backed up and stored at an off-site access-controlled location to protect against theft and damages caused by acts ofgod. The School District contracts its system backup services with Sterling Records Management in Boynton Beach, Florida. A "hot-site" is the duplicate ofan entire computer and network infrastructure installed at a remote location. The hardware then only needs to be set-up in order to run computer systems critical for continued operations. The District has a contract with SunGard Corporation in providing for a "hot-site" location in Philadelphia, Pennsylvania in the event ofa disaster. The Audit ofit Disaster Recovery included review ofplans, related contracts, observation ofthe backup location, and backup procedures and systems. The audit concluded that: Backups for school data and School Food Service were not sent to the District's official offsite location. The fuel tank for the generator at Fulton Holland used to support IT was only half full during Hurricane Frances. There was no generator to support the MAXIMO system. The temperature control in the Sterling off-site backup storage vault was not properly regulated. The District could save six to seven thousand dollars per year by using the State contract for Disaster Recovery. Management concurred with all ofthe audit findings. 1

5 THE SCHOOL DISTRICT OF LUNG CHIU, CPA ARTHUR C. JOHNSON, Ph.D. PALM BEACH COUNTY. FLORIDA DISTRICT AUDITOR SUPERINTENDENT OFFICE OF DISTRICTAUDITOR 3346 FOREST HILL BOULEVARD, SUITE WEST PALM BEACH, FL ~BEACH~ _ FAX: (561) MEIVlURANDUM TO: FROM: Honorable Chair and Members ofthe School Board Arthur C. Johnson, Ph.D., Superintendent ofschools Chair and Members ofaudit Committee kl..e... Lung Chiu, CPA, District Auditor DATE: March 11, 2005 SUBJECT: Audit of Information Technology Disaster Recovery PURPOSE AND AUTHORITY Pursuant to the District's Audit Plan of , we have audited the District's Information Technology (IT) Disaster Recovery Plan. The primary objective ofthe audit was to determine whether (1) c>perational information and student data maintained by the mainframe and network, is backed up and stored off-site regularly; (2) backup power source needed to support IT in the event ofa disaster is maintained properly; (3) backup and hot-site facilities are properly maintained, and (4) IT contingency plans are sufficient and have been executed in order to respond effectively in the event ofa disaster. SCOPE AND METHODOLOGY The audit was performed by Ellen Steinhoff, CISA, during October through December 2004, in accordance with Government Auditing Standards. In addition to interviewing staffofthe offsite backup facility, Computer Operations, and Network Department, this audit included a review ofthe following: Tape backup procedures and sufficiency ofvault facility for storage. Tapes headers to verify that data on the backup tapes matched labels. Off-site backup facility (Sterling Records). Maintenance ofbackup power source needed to support District IT in the event ofa disaster (e.g., generator, Uninterrupted Power Supply (UPS)). IT Disaster Recovery ManuaL Disaster Recovery Service provider (SunGard) contract document and payments. Action plans and test results from yearly disaster recovery test at SunGard hot-site in Philadelphia, P A. IT pre-hurricane preparation and results for Hurricanes Frances and Jeanne in Auditor General and internal audit findings related to disaster recovery. AN EQUAL d,portunity EMPLOYER

6 Audit conclusions were brought to the attention ofstaff during the audit so that necessary corrective actions could be implemented immediately. The draft report was sent to the appropriate departments for review and comments, and the responses are included in the Appendices. We appreciate staffs cooperation and courtesy extended to us during the audit. The final draft report was presented to the Audit Committee at its March 11, 2005 meeting. BACKGROUND The primary objective of an IT Disaster Recovery Plan is to preserve the integrity ofdata backups. Backups provide assurance that important data and information is maintained for continued operation should disasters occur. Computer information is to be backed up and stored at an off-site access-controlled location to protect against theft and damages caused by acts of God. The School District's contract for such backup services is with Sterling Records Management in Boynton Beach, Florida. A "hot-site" is the duplicate ofan entire computer and network infrastructure installed at a remote location. The hardware then only needs to be set-up in order to run computer systems critical for continued operations. The District has a contract with SunGard Corporation to use their "hot-site" location in Philadelphia, Pennsylvania in the event of a disaster. An ideal scenario for disaster recovery should be comprised of: Ensuring the safety ofpersonnel; notifying management and business continuity personnel; assessing damage; activating the command center, and declaring a disaster. Ifneeded: (1) relocating staff to perform recovery work, (2) sending computer data to the hot-site, and (3) restoring computer software from most recent backups. Restoring (1) communications for critical functions, (2) systems for computer applications, and (3) the data Any data not backed-up may never be restored. During September 2004, when Hurricanes Frances and Jeanne hit Florida, the District did not find it necessary to use the "hot-site" in Philadelphia. As required by the District's IT Disaster Recovery plans, staff met in advance ofthe storms and rescheduled Payroll to prepare paychecks at an earlier date. The mainframe at the District Administration Center was properly powered down according to IT pre-hurricane procedures. Data tapes were sent off-site to Sterling, ready to be sent to the "hot-site" at SunGard in Philadelphia. The IT Disaster Recovery Manual (page 2-1) requires that up to 8 hours ofemergency electrical power be provided for IT by an un-interrupted power supply (UPS). In case ofa power outage, this UPS will be used to temporarily run the computer systems at District Administration Center, 3

7 until the Kohler motor generator takes over. The generator is supported by a 1500-gallon diesel fuel tank. A full tank would provide IT with two full days ( 48 hours) worth ofpower. Full load system tests were performed on the UPS system and the generator on May 2, 2004, and September 19, 2004, respectively. All systems were deemed fully operational. CONCLUSIONS 1. School Information Backups Not Sent Off-Site. Staff had not yet set up a procedure to send all schools' weekly backup tapes ofstudent data at the school centers to the off-site location at Sterling Records. These tapes contain critical student data such as grades and test scores. Additionally, School Food Services has been unable to establish off-site rotation of their server's backup due to their location in Riviera Beach. To ensure continuity ofoperations in case ofa disaster, copies ofcritical data should be stored in an off-site location. If Hurricanes Frances and Jeanne had caused damages to IT facilities that required the District to use the data stored on these backups, or an unexpected disaster occurred at the schools or Food Services and the backups were destroyed, the needed data would not have been available. We recommend that school and Food Services backup tapes be sent periodically to the District's off-site location. Management's Response: Information Technology: Concur. The District has purchased Double-Take software, which will allow a 2417 continuous backup ofeach remote server at the bit-level. (Please see page 10). School Food Service: I concur with yourfindings. I have made plans to have our weekly tape backups from our Central Office brought to the Fulton Holland Educational Services Center weekly so they can be picked up by Sterling and stored offsite. I have also asked Network Services to include us in the planningfor the new backup software package that is being purchased. We hope to be using the software by the end ofthe school year. (Please see page 13). 2. Fuel Tank in IT Generator Not Full for Hurricane Frances. Unexpected problems with generators topped the list ofdisaster recovery "lessons learned" during the 2004 hurricane season for local companies and the School District. Review of the District's maintenance schedule for the generator and discussions with maintenance staff revealed the following: Time Period Issue Start of 2004 hurricane season Fuel tank three quarters full No record of generator maintenance for one month. 4

8 Time Period August 31, 2004 (immediately prior to Hurricane Frances). September, 2004 Issue Fuel tank halffull (could provide 24 hours ofpower). No power available for the MAXIMO system located on Summit Boulevard after both hurricanes. Work performed after the 2004 hurricanes was not submitted immediately into MAXIMO. No record ofgenerator maintenance for one month. (Possibly due to hurricanes). According to Facilities Management, a pre-hurricane generator check was performed on August 12,2004, prior to Hurricane Charlie. After noting a low fuel tank level, a fuel company was contacted to top offthe tank. However, due to power outages at the fuel loading docks, the fuel tank was never filled prior to Hurricane Frances. IT Computer Operations records show that pre-hurricane preparations took approximately 20 hours for Hurricane Frances and 24 hours for Hurricane Jeanne. This work included completion ofdaily processing (including payroll and vendor check runs), closing computer files, performing necessary tape backups, and sending the tapes to off-site storage location (Sterling). Computer Operations staffassumed that there was a full tank offuel that could provide approximately 48 hours ofpower to prepare for Hurricane Frances, in case ofpower outages. Actually the fuel could only supply power for 24 hours. In the event ofa power failure preceding the hurricane (or any other disaster), needed backups will not be available. After Hurricane Frances, Facilities Management suggested increasing the size ofthe fuel tank from one-to-two days ofpower to five-to-seven days ofpower. Alternatively, natural gas generators could be purchased to provide a more reliable fuel source and avoid the issue offuel delivery before and after power outages. We also recommend that staff: Perform and document periodic maintenance for IT generator, especially before and during hurricane season. Add written procedures to the hurricane disaster plan to ensure that the District Administration Center generator has sufficient fuel. Consider relocating the MAXIMO system to the District Administration Center, or providing a backup power supply to support MAXIMO (and Fleet) in the event ofa power outage. Management's Response: Maintenance and Plant Operations: Concur. The Central Services Team Leader in M & PO will take the necessary steps to perform and document the ITgenerator preventive maintenance. He will be responsible for providing a copy ofthe maintenance log to IT. This 5

9 will be provided on a monthly basis commencing with his receipt ofthis management response. The Utility Manager will submit the procedural amendments to Risk Management for inclusion in the next update ofthe Hurricane Procedure Manual. The Utility Manager will take the necessary internal steps to ensure that the fuel tanks are filled to proper capacity to allow the generator to operate for the run time designed for the system upon receipt ofthis management response. M & PO supports the relocation ofthe operating system to ensure functionality ofthe work order system during disaster events. M & PO will request that IT include this transition in their work plan. (Please see page 12). Information Technology: Concur. While the MAXIMO system has UPS protection, extended outages are not protected by a dedicated generator. The relocation ofthis equipment will require enhanced connectivity. (Please see page 10). 3. Temperature Not Properly Regulated in Off-Site Backup Storage Vault. On October 28, 2004, we inspected the vault where the District's backup tapes are stored at the off-site location at Sterling Management in Boynton Beach, Florida. We noted that the temperature reading on the wall in the vault was 67.9 degrees F (close to the required standard), but the humidity reading was 50 percent. (The standard is between 20% and 30%.) According to the Florida Administrative Code, Standards and Requirements EIB Electronic Recordkeeping: "(11) Maintenance ofelectronic Records. (a) STANDARD. Agencies shall maintain all long-term and permanent backup/security electronic recording media in a storage facility, either on-site or off-site, with constant temperature (below 68 degrees Fahrenheit) and relative humidity (20 to 30 percent) controls." In addition, Request for Proposal (RFP) submitted by Sterling stated that "the vault hygrometer system is monitored on a daily basis by Sterling staff, and an audit log is kept". However, our review ofthe log on October 28, 2004, indicated that: This review had not been performed for one month (September 29 to October 28, 2004). Prior to the last review on September 29,2004, the reading was not always taken daily. The temperature recorded prior to September 30,2004 was between 69 and 72 degrees F, one to four degrees above the recommended temperature. Ifthe temperature and/or humidity levels are too high, data on the tapes could be damaged or destroyed. We discussed these issues with Sterling staff and were told that the situation would be corrected, and that this problem was due to recent staff turnover. Sterling should perform in accordance with the RFP provisions in monitoring the hygrometer system. IT Computer 6

10 Operations should ensure Sterling Management properly monitors the temperature and humidity ofthe site, as stated in the RFP. Management's Response: Concur. IT Data Center Operations staffwill periodically monitor that Sterling Management, the District's off-site vendor, complies with the temperature and humidity specifications. (Please see page 10). 4. A 19% Discount for a Hot-Site Contract not Captured. In November 2002, the District signed a five-year contract with SunGard for disaster recovery services. We contacted the State Technology Office (STO) for a copy ofa new Service Level Agreement they negotiated in 2004 with SunGard disaster recovery services that offered a 19% discount. IT was not familiar with this agreement and discount. The Service Level Agreement states (page 37): "The STO will also offir a nineteen percent (19%) discount, less any applicable STO service fees, to any additional current customers who elect to subscribe for STO Disaster Recovery Services, provided that such Customer is able to commit to a minimum thirty-six (36) month extension to the then remaining term ofthis agreement (i.e. 60 months remaining on this contract - current customer has 12 months remaining on current Service Provider contract customer can commit to a 48 month extension). " During July 1, 2003 to June 30, 2004, the District paid SunGard a total of$34,485. As an example, the savings from using the state contract would have been $6,552 with the 19% discount for one year. However, according to the STO, the discount would not apply to the $10,000 incurred whenever a disaster is declared or the $2,500 daily usage fee. Since the SunGard contract is still valid unti12007, and given that the state contract provides a 19% discount, IT should approach SunGard to see ifthe existing contract could be amended to include the 19% discount, currently offered by the state. Management's Response: Concur. The School District cannot take advantage ofthe STO contract until the District's existing contract is within 24 months ofcoverage expiration (December 2005). IT will evaluate the required 36-month contract extension and available discount opportunities in conjunction with technology changes associated with new business and student application projects. (Please see page 10). 5. Two CD's Containing Critical Information for Students and Employees Should be Stored in Off-Site Location. Staffhad developed two useful CD's to be used in case ofa disaster. However they had not yet considered sending the CD's to the off-site backup location (Sterling Records). These CD's were: 1. Copy ofinterim Data Warehouse containing student demographics, test scores, grades, class schedules, and special programs (ESE, LEP). This CD would provide a count of students by area in the event ofrescheduling ofclasses or bus routes. 7

11 2. Copy ofemployee Data containing employee demographics, job, location, base salary, duty days, bargaining unit, certification areas. This CD could be used to identify the employees for possible reassignments during disasters. We recommend that a backup ofthe above CD's be rotated to the off-site backup location regularly, especially when a disaster such as a hurricane is pending. Management's Response: Concur during hurricane preparations. The CD's hold redundant data at a point-in-time and are not needed for disaster recovery. The CD's will, however, be created as part ofthe hurricane preparations for off-site storage. (Please see page 10). 6. Disaster Recovery Documentation. No alternate disaster recovery site is designated in case Network Applications are destroyed at the District Administration Center or Summit Boulevard. Network restoration procedures are not part ofthe IT Disaster Recovery Plan. District personnel can go to SunGard in Philadelphia, Pennsylvania and restore the Districts' mainframe system only. A review ofthe IT Disaster Recovery Plan revealed the following: -- Source Enterprise Data Security Audit in Comments Network systems such as the work order processing system (MAXIMO) and the transportation management system (FleetAnywhere) were not included in the IT Disaster Recovery Plan. Enterprise Data Security Audit in District's outside auditor, KPMG 2001 Management Lette~. A comprehensive information system risk assessment had not been performed. If existing equipment is to be replaced in the event ofa disaster at a pre-designated site, the plan should outline the location(s) and include all Network systems and the servers that support them. Additionally, all computer systems should be included in the IT Disaster Recovery Plan. IT should conduct a risk assessment to include software and hardware details and prioritize all systems in case ofa disaster. The IT disaster recovery plan should also be updated accordingly to include all mission critical computer systems. Additionally, the disaster recovery plan should be periodically tested to ensure all the District's needs are met. Management's Response: Concur. With the IT reorganization, a Security department has been established and when staffed a risk assessment will be performed. The disaster recovery plan is fully tested locally at least once a year and periodically at a hot site in Philadelphia. (Please see page 10). 8

12 7. Network Servers Not Backed up and Sent Off-Site Weekly. According to the Data Center Backup & Restore - Fulton-Holland Building Backup Guidelines for.. Windows 2000 Servers Manual, as ofseptember 2003, there were "78 Windows 2000 servers (LAN servers) in the data-center." Our review oflan server back ups revealed that seven servers (11 %) were not included in the weekly backup and off-site rotation. These seven included the primary and secondary servers for: System Description, Number ofservers Not Backed Up Outlook WEB Mail Server Internet Explorer 3 SIRSI School Access to the Library 2 System DNS (Domain Name Service) Index to Internet Services 2 While these seven servers do not contain application data, reconfiguring them has proven to be time consuming because it requires the expertise ofnetwork staff. For example, a reconfiguration needed in November 2004 ofa 'SIRSI' server took 1.5 days to complete. Comparatively, to restore that server's configuration from a backup would have taken about 2 hours. All network servers should be backed up regularly. Network Services should ensure that backups are rotated off-site to minimize the level ofloss in the event ofa disaster. Ifthe 2004 hurricanes had caused damages that required the District to restore data from these servers, it would have been time consuming. In addition, the District's disaster recovery plan assumes the existing IT staffwould be involved in the restoration process. This may be true for a small disaster, such as a local fire. However, in a large disaster at the District Administration Center, such as a direct hurricane hit, where the area surrounding District Administration Center may also be affected, IT staffmay not be available to assist in the reconfiguration. Network should perform a complete review of all LAN servers to ensure that all data is backed up and sent off-site regularly. Configuration settings for all the major devices on the network should be kept accessible and up-to-date in order to expedite the recovery. Management's Response: Concur. (Please see page 10). End ofreport 9

13 Appendix A Management's Response Department ofinformation Technology THE SCHOOL DISTRICT LINDA G. MAINORD ARTHUR C. JOHNSON, Ph.D. OF PALM BEACH COUNTY, FLORIDA CHIEF TECHNOLOGY OFFICER SUPERINTENDENT INFORMATION TECHNOLOGY 3348 FOREST HILL BOULEVARD WEST PALM BEACH, FL (561) February 16, 2005 MEMORANDUM TO: Il IllW~1iil FEB ~ DISTRICT AUDITOR SUBJECT: IT Management Response: Draft Report - Audit of Infonnation Technology Disaster Recovery The IT management responses to the Draft Report - Recovery follows. Audit of Infonnation Technology Disaster L School Information Backups Not Sent Off-Site. We recommend that school and Food Services backup tapes be sent periodically to the District's off-site location. Management's Response: Concur. The District has purchased Double-Take software which will allow a 2417 continuous backup ofeach remote server at the bit-level. 2. Fuel Tank in IT Generator Not fuji for Hurricane Frances. Consider relocating the MAXIMO system to the District Administration Center, or providing a backup power supply to support MAXIMO (and Fleet) in the event ofa power outage. Management's Response: Concur. While the MAXIMO system has UPS protection, extended outages are not protected by a de<licated generator. The relocation of this equipment will require enhanced connectivity. 3. Temperature Not Properly Regulated in Off-Site Backup Storage Vault. IT Computer Operations should ensure Sterling Management properly monitors the temperature and humidity ofthe site, as stated in the RFP. Management's Response: Concur. IT Data Center Operations staff will periodically monitor that Sterling Management, the District's off-site storage vendor, complies with the temperature and humidity specifications. 4. A 19% Discount for a Hot-Site Contract not Captured. Since the SunGard contract is still valid until 2007, and given that the state contract provides a 19% discount, IT should approach SunGard to see if the existing contract could be amended to include the discount, currently offered by the state. Management's Response: Concur. The School District cannot take advantage of the STO contract until the District's existing contract is within 24 months ofcoverage expiration (December 2005). IT will evaluate the required 36 month contract extension and available discount opportunities in conjunction with technology changes associated with new business and student application projects. 10

14 Appendix A Management's Response Department ofinformation Technology 5. Two CD's Containing Critical Information for Students and Employees Should be Stored in Off-Site Location. 1. Copy ofinterim Data Warehouse oontaining student demographics Copy ofemployee Data oontaining employee demographics.... We reoommend that a backup of the above CD's be rotated to the off-site backup location regularly, especially when a disaster such as a hurricane is pending. Management's Response: Concur during hurricane preparations. The CD's hold redundant data at a point-in-time and are not needed for disaster recovery. The CD's will, however, be created as part ofthe hurricane preparations for off-site storage. 6. Disaster Recovery Documentation. a) Ifexisting equipment is to be replaced in the event of a disaster at a pre-designated site, the plan should outline the location(s) and include all Network systems and the servers that support them. Additionally, all oomputer systems should be included in the ITDisaster Reoovery Plan. b) IT should oonduct a risk assessment to include software and hardware details and prioritize all systems in case ofa disaster. The IT disaster reoovery plan should also be updated acoordingly to include all mission critical oomputer systems. Additionally, the disaster reoovery plan should be periodically tested to ensure all the District's needs are met. Management's Response: Concur. a) Concur. b) With the IT reorganization, a Security department has been established and when staffed a risk assessment will be perfonned. The disaster reoovery plan is fully tested locally at least once a year and periodically at a hot site in Philadelphia. 7. Network Servers Not Backed up and Sent Off-Site Weekly. Network should perfonn a oomplete review of all LAN servers to ensure that all data is backed up and sent off-site regularly. Configuration settings for all the major devices on the network should be kept accessible and up-to-date in order to expedite ~e reoovery. Management's Response: Concur. CC: Joseph Moore Larry Padgett Marion Weil II

15 AppendixB Management's Response Department ofmaintenance andplant Operations THE SCHOOlDISTRICT OF ARTHUR C, JOHNSON. Ph,D MARTIN A. METS PALM BEACH COUNTY, FLORIDA SUPERINTENDENT DIRECTOR MAINTENANCE & PlANTOPERATIONS DEPARTMENTOF MAINTENANCE &PLANT OPERATIONS 3300 Summit Boulevard West Palm Beach, FL (561) FAX: (561) Memorandum To: From: LungChiu District Auditor Martin A. Met~ Director, M&P 0 Date: February 8, 2005 DISTRICT AUDITOR Subject: Audit of Information Technology Disaster Recovery Maintenance and Plant Operations staff has reviewed the draft audit of the above referenced subject and provide the following response: Recommendation: Perfonn and document periodic maintenance for IT generators, especially before and during hurricane season. Response: Concur. The Central Services Team Leader in M & PO will take the necessary steps to perfonn and document the IT generator preventive maintenance. He will be responsible for providing a copy of the maintenance log to IT. This will be provided on a monthly basis commencing with his receipt ofthis management response. Recommendation: Add written procedures to the hurricane disaster plan to ensure that the District Administration Center generator has sufficient fuel. Response: Concur. The Utility Manager will submit the procedural amendments to Risk Management for inclusion in the next update ofthe Hurricane Procedure Manual. The Utility Manager will take the necessary internal steps to ensure that the fuel tanks are filled to proper capacity to allow the generator to operate for the run time designed for the system upon receipt ofthis management response. Recommendation: Consider relocating the MAXJMO system to the District Administration Center, or providing a backup power supply to support MAXIMO (and fleet) in the event of a power outage. Response: Concur. M & PO supports the relocation of the operating system to ensure functionality ofthe work order system during disaster events. M & PO will request that IT include this transition in their work plan. pc: Joseph Sanches LeeKapp William Pinto Steve Backhus AN EQUAl OPPORTUNITY EMPLOYER 12

16 AppendixC Management's Response DepaTiUnento/SchoolJFoodService THE SCHOOl DISmcr Of PALM BEACH COUN'lY, F1.0RICA ARTHUR C, JOHNSON, Ph. tl. SUPERINTENDENT SCHOOL FOOD SERVICE 3661 NORTH INTERSTATE PARK ROAD, SlJ"ITE 100 RIVIERA BEACH, F1.ORlM (561) c fax: (561)383,0043 January 27, 2005 MEMORANDUM TO: FROM: RE: Lung Chiu, District Auditor Steve Bonino, Acting Director, School Food Response to Information Technology Disaster Recovery Audit Thank you for including the School Food Service Department in your disaster recovery audit. I concur with your findings. I have made plans to have our weekly tape backups from our Central Office brought to the Fulton Holland Educational Services Center weekly so they can be picked up by Sterling and stored off site. I have also asked Network Services to include us in the planning for the new backup software package that is being purchased. We hope to be using the software by the end of the school year. Thank you again for continued support and assistance. m~, DISTRICT AUDITOR Palm Beach County Schools #3 in the NATION! for details 13

Audit of. Information Technology Help Desk

Audit of. Information Technology Help Desk Audit of Information Technology Help Desk October 10,2003 Report 2003-15 MISSIONSTATEMENT The School Board of Palm Beach County is committed to excellence in education and preparation ofall our students

More information

Audit of. Software Inventory Procedures

Audit of. Software Inventory Procedures Audit of Software Inventory Procedures April 22, 2003 Report 2003-8 MISSIONSTATEMENT The School Board of Palm Beach County is committed to excellence in education and preparation of all our students with

More information

Audit of. Boca Raton Middle School's Community School Program

Audit of. Boca Raton Middle School's Community School Program Audit of Boca Raton Middle School's Community School Program November 12,2004 Report 2004-15 MISSIONSTATEMENT The School Board of Palm Beach County is committed to excellence in education and preparation

More information

Audit of. District s Information Technology Disaster Recovery Plan

Audit of. District s Information Technology Disaster Recovery Plan Audit of District s Information Technology Disaster Recovery Plan April 11, 2014 Report #2014-03 MISSION STATEMENT The School Board of Palm Beach County is committed to providing a world class education

More information

Audit of. Accounts Payable Procedures

Audit of. Accounts Payable Procedures Audit of Accounts Payable Procedures March 6, 2006 Report 2006-03 Audit of Accounts Payable Procedures Table of Contents Page EXECUTIVE SUMMARY PURPOSE AND AUTHORITY SCOPE' AND METHODOLOGY BACKGROUND 1

More information

Audit of. Procedures for Payroll Deductions

Audit of. Procedures for Payroll Deductions Audit of Procedures for Payroll Deductions September 12, 2003 Report 2003-13 MISSIONSTATEMENT The School Board of Palm Beach County is committed to excellence in education and preparation of all our students

More information

Audit of Cellular Phones Usage and Charges

Audit of Cellular Phones Usage and Charges Audit of Cellular Phones Usage and Charges May 19,2003 REPORT 2003-9 MISSIONSTATEMENT The School Board of Palm Beach County is committed to excellence in education and preparation of all our students with

More information

Contract Compliance Audit of. WHLS of Florida, Inc., for Fiscal Year 2006. January 19, 2007

Contract Compliance Audit of. WHLS of Florida, Inc., for Fiscal Year 2006. January 19, 2007 Contract Compliance Audit of WHLS of Florida, Inc., for Fiscal Year 2006 January 19, 2007 Report 2007-03 Contract Compliance Audit of WHLS of Florida, Inc., for Fiscal Year 2006 Table of Contents PURPOSE

More information

Follow-up Audit of. Fees Paid to Construction Managers

Follow-up Audit of. Fees Paid to Construction Managers Follow-up Audit of Fees Paid to Construction Managers June 11, 2015 Report #2015-07 MISSION STATEMENT The School Board of Palm Beach County is committed to providing a world class education with excellence

More information

Audit of. Workers Compensation Program

Audit of. Workers Compensation Program Audit of Workers Compensation Program October 23, 2014 Report #2014-06 MISSION STATEMENT The School Board of Palm Beach County is committed to providing a world class education with excellence and equity

More information

MANAGEMENT AUDIT REPORT DISASTER RECOVERY PLAN DEPARTMENT OF FINANCE AND ADMINISTRATIVE SERVICES INFORMATION TECHNOLOGY SERVICES DIVISION

MANAGEMENT AUDIT REPORT DISASTER RECOVERY PLAN DEPARTMENT OF FINANCE AND ADMINISTRATIVE SERVICES INFORMATION TECHNOLOGY SERVICES DIVISION MANAGEMENT AUDIT REPORT OF DISASTER RECOVERY PLAN DEPARTMENT OF FINANCE AND ADMINISTRATIVE SERVICES INFORMATION TECHNOLOGY SERVICES DIVISION REPORT NO. 13-101 City of Albuquerque Office of Internal Audit

More information

District. Disaster Recovery Plan

District. Disaster Recovery Plan District Disaster Recovery Plan The following pages outline the recovery process for the ABC School District **this document must be kept in paper form by the ** **emergency recovery team** 1 1. Introduction

More information

Review of. Freedom Shores Elementary Parent-Teacher Association's Bank Accounts

Review of. Freedom Shores Elementary Parent-Teacher Association's Bank Accounts Review of Freedom Shores Elementary Parent-Teacher Association's Bank Accounts December 7, 2007 Report 2007-17 Review of Freedom Shores Elementary Parent-Teacher Association's Bank Accounts Table of Contents

More information

Audit of. G-Star School of the Arts For Motion Pictures and Television

Audit of. G-Star School of the Arts For Motion Pictures and Television Audit of G-Star School of the Arts For Motion Pictures and Television September 14, 2007 Report 2007-11 Audit of G-Star School of the Arts for Motion Pictures and Television Table of Contents PURPOSE AND

More information

Information System Audit Report Office Of The State Comptroller

Information System Audit Report Office Of The State Comptroller STATE OF CONNECTICUT Information System Audit Report Office Of The State Comptroller AUDITORS OF PUBLIC ACCOUNTS KEVIN P. JOHNSTON ROBERT G. JAEKLE TABLE OF CONTENTS EXECUTIVE SUMMARY...1 AUDIT OBJECTIVES,

More information

FIRST AND FINAL ADDENDUM RFP FOR ROOFING SERVICES FOR DISASTER RECOVERY ASSISTANCE

FIRST AND FINAL ADDENDUM RFP FOR ROOFING SERVICES FOR DISASTER RECOVERY ASSISTANCE THE SCHOOL DISTRICT SHARON SWAN ARTHUR C. JOHNSON, Ph.D. OF PALM BEACH COUNTY, FLORIDA DIRECTOR SUPERINTENDENT CONSTRUCTION PURCHASING DEPARTMENT 3661 INTERSTATE PARK ROAD NORTH, SUITE 200 RIVIERA BEACH,

More information

Audit of the Disaster Recovery Plan

Audit of the Disaster Recovery Plan Audit of the Disaster Recovery Plan Report # 11-05 Prepared by Office of Inspector General J. Timothy Beirnes, CPA, Inspector General Kit Robbins, CISA, CISM, CRISC, Lead Information Systems Auditor TABLE

More information

Audit of Third Party Administration for Workers' Compensation

Audit of Third Party Administration for Workers' Compensation Audit of Third Party Administration for Workers' Compensation March 5, 2004 REPORT 2004-01 Audit of Third Party Administration for Worker's Compensation Table of Contents Page EXECUTIVE SUMMARY PURPOSE

More information

IT Disaster Recovery Plan Template. By Paul Kirvan, CISA, CISSP, FBCI, CBCP

<Client Name> IT Disaster Recovery Plan Template. By Paul Kirvan, CISA, CISSP, FBCI, CBCP IT Disaster Recovery Plan Template By Paul Kirvan, CISA, CISSP, FBCI, CBCP Revision History REVISION DATE NAME DESCRIPTION Original 1.0 2 Table of Contents Information Technology Statement

More information

Auditing in an Automated Environment: Appendix C: Computer Operations

Auditing in an Automated Environment: Appendix C: Computer Operations Agency Prepared By Initials Date Reviewed By Audit Program - Computer Operations W/P Ref Page 1 of 1 Procedures Initials Date Reference/Comments OBJECTIVE - To document the review of the computer operations

More information

IT Disaster Recovery Plan Template

IT Disaster Recovery Plan Template HOPONE INTERNET CORP IT Disaster Recovery Plan Template Compliments of: Tim Sexton 1/1/2015 An information technology (IT) disaster recovery (DR) plan provides a structured approach for responding to unplanned

More information

Office of Inspector General

Office of Inspector General DEPARTMENT OF HOMELAND SECURITY Office of Inspector General INFORMATION TECHNOLOGY: Final Obstacles Removed To Eliminate Customs Disaster Recovery Material Weakness Office of Information Technology OIG-IT-03-01

More information

July 30, 2009. Internal Audit Report 2009-08 Information Technology Business Continuity Plan Information Technology Department

July 30, 2009. Internal Audit Report 2009-08 Information Technology Business Continuity Plan Information Technology Department Internal Audit Report 2009-08 Introduction. The Municipality depends heavily on technology and automated information systems, and their disruption for even a few days could have a severe impact on critical

More information

Offsite Disaster Recovery Plan

Offsite Disaster Recovery Plan 1 Offsite Disaster Recovery Plan Offsite Disaster Recovery Plan Presented By: Natan Verkhovsky President Disty Portal Inc. 2 Offsite Disaster Recovery Plan Introduction This document is a comprehensive

More information

Audit of. Football Stadium Taxes

Audit of. Football Stadium Taxes Audit of Football Stadium Taxes October 15, 2004 Report 2004-11 MISSIONSTATEMENT The School Board of Palm Beach County is committed to excellence in education and preparation of all our students with the

More information

Alabama State Port Authority

Alabama State Port Authority DISASTER RECOVERY HOTSITE REQUEST FOR PROPOSAL Alabama State Port Authority Issued April 27, 2010 Alabama State Port Authority Table of Contents 1.0 OVERVIEW... 1 1.1 INTRODUCTION... 1 1.2 SCHEDULE OF

More information

Local Government Cyber Security:

Local Government Cyber Security: Local Government Cyber Security: Guidelines for Backing Up Information A Non-Technical Guide Essential for Elected Officials Administrative Officials Business Managers Multi-State Information Sharing and

More information

AUDITOR GENERAL WILLIAM O. MONROE, CPA

AUDITOR GENERAL WILLIAM O. MONROE, CPA AUDITOR GENERAL WILLIAM O. MONROE, CPA HILLSBOROUGH COUNTY DISTRICT SCHOOL BOARD LAWSON FINANCIALS MODULE Information Technology Audit SUMMARY To support its financial management needs, the Hillsborough

More information

Disaster Recovery Checklist Disaster Recovery Plan for

Disaster Recovery Checklist Disaster Recovery Plan for <System One> Disaster Recovery Plan for SYSTEM OVERVIEW PRODUCTION SERVER HOT SITE SERVER APPLICATIONS (Use bold for Hot Site) ASSOCIATED SERVERS KEY CONTACTS Hardware Vendor System Owners Database Owner

More information

Clovis Municipal School District Information Technology (IT) Disaster Recovery Plan

Clovis Municipal School District Information Technology (IT) Disaster Recovery Plan Clovis Municipal School District Information Technology (IT) Disaster Recovery Plan Revision History REVISION DATE NAME DESCRIPTION Draft 1.0 Eric Wimbish IT Backup Disaster Table of Contents Information

More information

Exhibit to Data Center Services Service Component Provider Master Services Agreement

Exhibit to Data Center Services Service Component Provider Master Services Agreement Exhibit to Data Center Services Service Component Provider Master Services Agreement DIR Contract No. DIR-DCS-SCP-MSA-002 Between The State of Texas, acting by and through the Texas Department of Information

More information

NETWORK SERVICES WITH SOME CREDIT UNIONS PROCESSING 800,000 TRANSACTIONS ANNUALLY AND MOVING OVER 500 MILLION, SYSTEM UPTIME IS CRITICAL.

NETWORK SERVICES WITH SOME CREDIT UNIONS PROCESSING 800,000 TRANSACTIONS ANNUALLY AND MOVING OVER 500 MILLION, SYSTEM UPTIME IS CRITICAL. NETWORK SERVICES WITH SOME CREDIT UNIONS PROCESSING 800,000 TRANSACTIONS ANNUALLY AND MOVING OVER 500 MILLION, SYSTEM UPTIME IS CRITICAL. Your Credit Union information is irreplaceable. Data loss can result

More information

The Commonwealth of Massachusetts

The Commonwealth of Massachusetts A. JOSEPH DeNUCCI AUDITOR The Commonwealth of Massachusetts AUDITOR OF THE COMMONWEALTH ONE ASHBURTON PLACE, ROOM 1819 BOSTON, MASSACHUSETTS 02108 TEL. (617) 727-6200 No. 2008-1308-4T OFFICE OF THE STATE

More information

UNIVERSITY INFORMATION TECHNOLOGY SERVICES (UITS) & INFORMATION WAREHOUSE FUNCTIONAL ANNEX 13

UNIVERSITY INFORMATION TECHNOLOGY SERVICES (UITS) & INFORMATION WAREHOUSE FUNCTIONAL ANNEX 13 UNIVERSITY INFORMATION TECHNOLOGY SERVICES (UITS) & INFORMATION WAREHOUSE FUNCTIONAL ANNEX 13 Revision: December 19, 2012 Supersedes: June 9, 2009 Effective Date: January 30, 2012 OBJECTIVES The primary

More information

NASCIO STATE RECOGNITION AWARDS 2015

NASCIO STATE RECOGNITION AWARDS 2015 DEPARTMENT OF TECHNOLOGY AND INFORMATION STATE OF DELAWARE 801 SILVER LAKE BLVD. DOVER, DELAWARE 19904 The Honorable James L. Collins, Chief Information Officer NASCIO STATE RECOGNITION AWARDS 2015 DELAWARE

More information

Ohio Supercomputer Center

Ohio Supercomputer Center Ohio Supercomputer Center IT Business Continuity Planning No: Effective: OSC-13 06/02/2009 Issued By: Kevin Wohlever Director of Supercomputer Operations Published By: Ohio Supercomputer Center Original

More information

Palm Beach State College. Information Technology. Service Level Agreement

Palm Beach State College. Information Technology. Service Level Agreement Palm Beach State College Information Technology Service Level Agreement (Revision: Feb 14 2014) Table of Contents Section 1.0 INTRODUCTION 1.1 Purpose and Objective 1.2 Parties to the Agreement 1.3 Commencement

More information

June 2008 Report No. 08-038. An Audit Report on The Department of Information Resources and the Consolidation of the State s Data Centers

June 2008 Report No. 08-038. An Audit Report on The Department of Information Resources and the Consolidation of the State s Data Centers John Keel, CPA State Auditor An Audit Report on The Department of Information Resources and the Consolidation of the State s Data Centers Report No. 08-038 An Audit Report on The Department of Information

More information

Disaster Recovery and Business Continuity Plan

Disaster Recovery and Business Continuity Plan Disaster Recovery and Business Continuity Plan Table of Contents 1. Introduction... 3 2. Objectives... 3 3. Risks... 3 4. Steps of Disaster Recovery Plan formulation... 3 5. Audit Procedure.... 5 Appendix

More information

DISASTER RECOVERY PLAN

DISASTER RECOVERY PLAN DISASTER RECOVERY PLAN Section 1. Goals of a Disaster Recovery Plan The major goals of a disaster recovery plan are: To minimize interruptions to normal operations. To limit the extent of disruption and

More information

DETAIL AUDIT PROGRAM Information Systems General Controls Review

DETAIL AUDIT PROGRAM Information Systems General Controls Review Contributed 4/23/99 by Steve_Parker/TBE/Teledyne@teledyne.com DETAIL AUDIT PROGRAM Information Systems General Controls Review 1.0 Introduction The objectives of this audit are to review policies, procedures,

More information

IT DISASTER RECOVERY BEST PRACTICES AND LESSONS LEARNED FROM HURRICANE SANDY. White Paper Series

IT DISASTER RECOVERY BEST PRACTICES AND LESSONS LEARNED FROM HURRICANE SANDY. White Paper Series IT DISASTER RECOVERY BEST PRACTICES AND LESSONS LEARNED FROM HURRICANE SANDY White Paper Series 2 IT DISASTER RECOVERY BEST PRACTICES AND LESSONS LEARNED FROM HURRICANE SANDY In late October 2012, Hurricane

More information

Information System Audit. Arkansas Administrative Statewide Information System (AASIS) General Controls

Information System Audit. Arkansas Administrative Statewide Information System (AASIS) General Controls Information System Audit Arkansas Administrative Statewide Information System (AASIS) General Controls ARKANSAS DIVISION OF LEGISLATIVE AUDIT April 12, 2002 April 12, 2002 Members of the Legislative Joint

More information

B U S I N E S S C O N T I N U I T Y P L A N

B U S I N E S S C O N T I N U I T Y P L A N B U S I N E S S C O N T I N U I T Y P L A N 1 Last Review / Update: December 9, 2015 Table of Contents Purpose...3 Background...3 Books and Records Back-up and Recovery...4 Mission Critical Systems...

More information

Audit, Finance and Legislative Committee Mayor Craig Lowe, Chair Mayor-Commissioner Pro Tem Thomas Hawkins, Member

Audit, Finance and Legislative Committee Mayor Craig Lowe, Chair Mayor-Commissioner Pro Tem Thomas Hawkins, Member City of Gainesville Inter-Office Communication April 3, 2012 TO: FROM: SUBJECT: Audit, Finance and Legislative Committee Mayor Craig Lowe, Chair Mayor-Commissioner Pro Tem Thomas Hawkins, Member Brent

More information

Department of Public Utilities Customer Information System (BANNER)

Department of Public Utilities Customer Information System (BANNER) REPORT # 2010-06 AUDIT of the Customer Information System (BANNER) January 2010 TABLE OF CONTENTS Executive Summary..... i Comprehensive List of Recommendations. iii Introduction, Objective, Methodology

More information

Regulatory Notice 13-25

Regulatory Notice 13-25 Regulatory Notice 13-25 FINRA, the SEC and CFTC Issue Joint Advisory on Executive Summary Following Hurricane Sandy, which caused widespread damage on the northeast coast of the United States in October

More information

Maryland Transportation Authority

Maryland Transportation Authority Audit Report Maryland Transportation Authority March 2014 OFFICE OF LEGISLATIVE AUDITS DEPARTMENT OF LEGISLATIVE SERVICES MARYLAND GENERAL ASSEMBLY This report and any related follow-up correspondence

More information

911 Data Center Operations Performance Audit

911 Data Center Operations Performance Audit 911 Data Center Operations Performance Audit June 2010 Office of the Auditor Audit Services Division City and County of Denver Dennis J. Gallagher Auditor The Auditor of the City and County of Denver is

More information

Disaster Recovery Planning The Process

Disaster Recovery Planning The Process Disaster Recovery Planning The Process Introduction We began our planning processes after experiencing several disasters, including a building fire, an environmental contamination, faulty discharge of

More information

SECTION 15 INFORMATION TECHNOLOGY

SECTION 15 INFORMATION TECHNOLOGY SECTION 15 INFORMATION TECHNOLOGY 15.1 Purpose 15.2 Authorization 15.3 Internal Controls 15.4 Computer Resources 15.5 Network/Systems Access 15.6 Disaster Recovery Plan (DRP) 15.1 PURPOSE The Navajo County

More information

City of West Palm Beach Internal Audit Department

City of West Palm Beach Internal Audit Department POST AUDIT REVIEW OF THE WAREHOUSE AND INVENTORY Report No. PAR 16-02 October 26, 2015 City of West Palm Beach Internal Audit Department Roger Strout, City Internal Auditor, CIA, CRMA, CFE, CICA Elena

More information

Hanh Do, Director, Information System Audit Division, GAA. SUBJECT: Review of HUD s Information Technology Contingency Planning and Preparedness

Hanh Do, Director, Information System Audit Division, GAA. SUBJECT: Review of HUD s Information Technology Contingency Planning and Preparedness Issue Date: August 31, 2006 Audit Report Number 2006-DP-0005 TO: Lisa Schlosser, Chief Information Officer, A FROM: Hanh Do, Director, Information System Audit Division, GAA SUBJECT: Review of HUD s Information

More information

HOW TO CREATE A VITAL RECORDS PROTECTION PLAN. New York State Unified Court System Division of Court Operations Office of Records Management

HOW TO CREATE A VITAL RECORDS PROTECTION PLAN. New York State Unified Court System Division of Court Operations Office of Records Management HOW TO CREATE A VITAL RECORDS PROTECTION PLAN New York State Unified Court System Division of Court Operations Office of Records Management June 2003 TABLE OF CONTENTS Purpose of a Vital Records Protection

More information

Those who do not remember the past are condemned to repeat it. - George Santayana - Philosopher

Those who do not remember the past are condemned to repeat it. - George Santayana - Philosopher Those who do not remember the past are condemned to repeat it. - George Santayana - Philosopher ERP Implementation Update Implementation Overview High Level Project Plan Monthly Milestones July Activities

More information

OFFICE OF THE CITY AUDITOR

OFFICE OF THE CITY AUDITOR OFFICE OF THE CITY AUDITOR AUDIT OF THE VITAL STATISTICS BIRTH AND DEATH CERTIFICATE IMAGING SYSTEM Paul T. Garner Assistant City Auditor Prepared by: Tony Aguilar, CISA Sr. IT Auditor Bill Steer, CPA,

More information

Jacksonville University Information Technology Department Disaster Recovery Plan. (Rev: July 2013)

Jacksonville University Information Technology Department Disaster Recovery Plan. (Rev: July 2013) Jacksonville University Information Technology Department Disaster Recovery Plan (Rev: July 2013) Table of Contents Introduction 3 Objectives/Constraints 4 Assumptions 4 Critical Systems 5 Incidents Requiring

More information

Department of Information Technology Data Center Disaster Recovery Audit Report Final Report. September 2006

Department of Information Technology Data Center Disaster Recovery Audit Report Final Report. September 2006 Department of Information Technology Data Center Disaster Recovery Audit Report Final Report September 2006 promoting efficient & effective local government Executive Summary Our audit found that a comprehensive

More information

DISASTER RECOVERY PLAN For UNIVERSITY COMPUTING. Fayetteville State University

DISASTER RECOVERY PLAN For UNIVERSITY COMPUTING. Fayetteville State University DISASTER RECOVERY PLAN For UNIVERSITY COMPUTING Fayetteville State University PREFACE This document titled Disaster recovery plan is simply a plan that addresses immediate and temporary restoration of

More information

IT - General Controls Questionnaire

IT - General Controls Questionnaire IT - General Controls Questionnaire Internal Control Questionnaire Question Yes No N/A Remarks G1. ACCESS CONTROLS Access controls are comprised of those policies and procedures that are designed to allow

More information

Questions for Vendors Revised

Questions for Vendors Revised Questions for Vendors Revised Company Profile: Successful completion of the Contract will require a substantial commitment of Contractor's resources and personnel. This section profiles the organization

More information

Resource Ordering and Status System. User Business Resumption Plan

Resource Ordering and Status System. User Business Resumption Plan Resource Ordering and Status System User Business Resumption Plan I. INTRODUCTION This document is the disaster preparedness and recovery plan for users of the Resource Ordering and Statusing System (ROSS).

More information

Information Technology Internal Audit Report

Information Technology Internal Audit Report Information Technology Internal Audit Report Report #2014-05 July 25, 2014 Table of Contents Page Executive Summary... 3 Background Information... 4 Background... 4 Audit Objectives... 4 Scope and Testing

More information

FINAL AUDIT REPORT WITH RECOMENDATIONS Information Technology No. 11-001

FINAL AUDIT REPORT WITH RECOMENDATIONS Information Technology No. 11-001 FINAL AUDIT REPORT WITH RECOMENDATIONS Information Technology No. 11-001 SUBJECT: Review of Emergency Plans DATE: September 24, 2010 for Critical Information Technology Operations and Financial Systems

More information

Memorandum. ACTION: Report on Computer Security Controls of Financial Management System, FTA FE-2000-098. May 23, 2000.

Memorandum. ACTION: Report on Computer Security Controls of Financial Management System, FTA FE-2000-098. May 23, 2000. U.S. Department of Transportation Office of the Secretary of Transportation Office of Inspector General Memorandum ACTION: Report on Computer Security Controls of Financial Management System, FTA FE-2000-098

More information

OKHAHLAMBA LOCAL MUNICIPALITY

OKHAHLAMBA LOCAL MUNICIPALITY OKHAHLAMBA LOCAL MUNICIPALITY I.T DISASTER RECOVERY PLAN 2012/2013 TABLE OF CONTENTS 1. INTRODUCTION 1 1.1 PURPOSE 2 1.2 OBJECTIVES 2 1.3 SCOPE 2 1.4 DISASTER RECOVERY STRATEGY 2 1.5 DISASTER DEFINITION

More information

DATA CENTER OPERATIONS

DATA CENTER OPERATIONS REPORT NO. 2011-082 JANUARY 2011 NORTHWOOD SHARED RESOURCE CENTER DATA CENTER OPERATIONS Information Technology Operational Audit EXECUTIVE DIRECTOR OF THE NORTHWOOD SHARED RESOURCE CENTER Pursuant to

More information

EMAIL MANAGEMENT GUIDELINES

EMAIL MANAGEMENT GUIDELINES EMAIL MANAGEMENT GUIDELINES FOR COUNTIES AND MUNICIPALITIES 1. Purpose The purpose of these guidelines is to ensure that the electronic mail records of county and municipal government officials and employees

More information

Memorandum of Understanding (MOU) Northwest Regional Data Center. School Board of Palm Beach County MOU # NWRM0011

Memorandum of Understanding (MOU) Northwest Regional Data Center. School Board of Palm Beach County MOU # NWRM0011 Memorandum of Understanding (MOU) By and Between Northwest Regional Data Center and School Board of Palm Beach County MOU # NWRM0011 PROJECT: Disaster Recovery/Business Continuity PM: Annie Zhang/Bill

More information

CounselorMax and ORS Managed Hosting RFP 15-NW-0016

CounselorMax and ORS Managed Hosting RFP 15-NW-0016 CounselorMax and ORS Managed Hosting RFP 15-NW-0016 Posting Date 4/22/2015 Proposal submission deadline 5/15/2015, 5:00 PM ET Purpose of the RFP NeighborWorks America has a requirement for managed hosting

More information

AMBULATORY SURGICAL CENTERS (Based upon AHCA Form # 3130-2003 JUL 94)

AMBULATORY SURGICAL CENTERS (Based upon AHCA Form # 3130-2003 JUL 94) (Based upon AHCA Form # 3130-2003 JUL 94) The document below is the cross-reference used by Palm Beach County Division of Emergency Management for the annual review and re-certification of your CEMP. Review

More information

Union County. Electronic Records and Document Imaging Policy

Union County. Electronic Records and Document Imaging Policy Union County Electronic Records and Document Imaging Policy Adopted by the Union County Board of Commissioners December 2, 2013 1 Table of Contents 1. Purpose... 3 2. Responsible Parties... 3 3. Availability

More information

TUFTS HEALTH PLAN CORPORATE CONTINUITY STRATEGY FREQUENTLY ASKED QUESTIONS OVERVIEW CORPORATE CONTINUITY PROGRAM.

TUFTS HEALTH PLAN CORPORATE CONTINUITY STRATEGY FREQUENTLY ASKED QUESTIONS OVERVIEW CORPORATE CONTINUITY PROGRAM. TUFTS HEALTH PLAN CORPORATE CONTINUITY STRATEGY FREQUENTLY ASKED QUESTIONS July 2015 OVERVIEW The intent of this document is to provide external customers and auditors with a high-level overview of the

More information

Justifying an Investment in Disaster Recovery

Justifying an Investment in Disaster Recovery Justifying an Investment in Disaster Recovery Presented by: Ward Quarles Director, Marketing & Communications WTS, Inc. Candide Lopez Vice President, Information Technology Bal Seal Engineering Introductions

More information

Ms. Debbie Davenport Auditor General Office of the Auditor General 2910 North 44 th Street, Suite 410 Phoenix, Arizona 85018. Dear Ms.

Ms. Debbie Davenport Auditor General Office of the Auditor General 2910 North 44 th Street, Suite 410 Phoenix, Arizona 85018. Dear Ms. Janet Napolitano Governor ARIZONA DEPARTMENT OF ECONOMIC SECURITY 1717 W. Jefferson P.O. Box 6123 Phoenix, AZ 85005 David A. Berns Director Ms. Debbie Davenport Auditor General Office of the Auditor General

More information

National Archives and Records Administration

National Archives and Records Administration Date August 28, 2008 8601 Adelphi Road College Park, Maryland 20740-6001 Reply to Attn of Office ofinspector General (OIG) Subject OIG Report no. 08-11, Review of Subcontract Costs on the Electronic Records

More information

TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION

TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION Disaster Recovery Testing Is Being Adequately Performed, but Problem Reporting and Tracking Can Be Improved May 3, 2012 Reference Number: 2012-20-041 This

More information

Identify and Protect Your Vital Records

Identify and Protect Your Vital Records Identify and Protect Your Vital Records INTRODUCTION The Federal Emergency Management Agency s Federal Preparedness Circular 65 states The protection and ready availability of electronic and hardcopy documents,

More information

AMBULATORY SURGICAL CENTERS

AMBULATORY SURGICAL CENTERS AMBULATORY SURGICAL CENTERS STATUTE RULE CRITERIA Current until changed by State Legislature or AHCA Hospitals and Ambulatory Surgical Centers Statutory Reference 3 395.1055 (1)(c), Florida Statutes Rules

More information

Audit of Information Technology Asset-Management Controls - DOA - Information and Technology Management Division MARTIN MATSON City Comptroller

Audit of Information Technology Asset-Management Controls - DOA - Information and Technology Management Division MARTIN MATSON City Comptroller Audit of Information Technology Asset-Management Controls - DOA - Information and Technology Management Division MARTIN MATSON City Comptroller AYCHA SIRVANCI, CPA Audit Manager City of Milwaukee, Wisconsin

More information

DISASTER RECOVERY PROCEDURES

DISASTER RECOVERY PROCEDURES DISASTER RECOVERY PROCEDURES THE RESOURCE CENTERS 4360 Northlake Blvd Ste 206 Palm Beach Gardens, FL 33410 Ph: (800) 206-0116 Fax: (561) 624-3278 Should circumstances demand activation of a business recovery

More information

The 9 Ugliest Mistakes Made with Data Backup and How to Avoid Them

The 9 Ugliest Mistakes Made with Data Backup and How to Avoid Them The 9 Ugliest Mistakes Made with Data Backup and How to Avoid Them If your data is important to your business and you cannot afford to have your operations halted for days even weeks due to data loss or

More information

DRAFT Disaster Recovery Policy Template

DRAFT Disaster Recovery Policy Template DRAFT Disaster Recovery Policy Template NOTE: This is a boiler plate template much information is needed from to finalizeconsider this document pre-draft FOREWARD... 3 Policy Overview...

More information

Tufts Health Plan Corporate Continuity Strategy

Tufts Health Plan Corporate Continuity Strategy Tufts Health Plan Corporate Continuity Strategy July 2015 OVERVIEW The intent of this document is to provide external customers and auditors with a highlevel overview of the Tufts Health Plan Corporate

More information

Backup Strategies for Small Business

Backup Strategies for Small Business Backup Strategies for Small Business StarTech Group, Inc. Jim Scalise 11.15.2014 1 StarTech Group, Inc. 2771-29 Monument Rd. PMB 232 Jacksonville, FL 32225 CONTENTS BACKUP STRATEGIES.. 1 CLOUD BACKUP 2

More information

EMERGENCY MANAGEMENT PLANNING CRITERIA FOR AMBULATORY SURGICAL CENTERS

EMERGENCY MANAGEMENT PLANNING CRITERIA FOR AMBULATORY SURGICAL CENTERS EMERGENCY MANAGEMENT PLANNING CRITERIA FOR AMBULATORY SURGICAL CENTERS The following criteria are to be used when developing Comprehensive Emergency Management Plans (CEMP) for all ambulatory surgical

More information

MANAGEMENT AUDIT REPORT SECURING CRITICAL DATA CITYWIDE REPORT NO. 09-106. City of Albuquerque Office of Internal Audit and Investigations

MANAGEMENT AUDIT REPORT SECURING CRITICAL DATA CITYWIDE REPORT NO. 09-106. City of Albuquerque Office of Internal Audit and Investigations MANAGEMENT AUDIT REPORT OF SECURING CRITICAL DATA CITYWIDE REPORT NO. 09-106 City of Albuquerque Office of Internal Audit and Investigations Securing Critical Data Citywide Report No. 09-106 Executive

More information

The Practice of Internal Controls. Cornell Municipal Clerks School July 16, 2014

The Practice of Internal Controls. Cornell Municipal Clerks School July 16, 2014 The Practice of Internal Controls Cornell Municipal Clerks School July 16, 2014 Page 1 July 18, 2014 Cash Receipts (Collection procedures) Centralize cash collections within a department or for the local

More information

Wall Advisors, Inc. Business Continuity Plan Summary. Last Updated : January, 2014

Wall Advisors, Inc. Business Continuity Plan Summary. Last Updated : January, 2014 Wall Advisors, Inc. Business Continuity Plan Summary Last Updated : January, 2014 Introduction In the wake of the events of September 11, 2001, the securities markets and investment management industry

More information

DISASTER RECOVERY. Omniture Disaster Plan. June 2, 2008 Version 2.0

DISASTER RECOVERY. Omniture Disaster Plan. June 2, 2008 Version 2.0 DISASTER RECOVERY Omniture Disaster Plan June 2, 2008 Version 2.0 CHAPTER 1 1 Disaster Recovery Plan Overview In the event that one of our data collection environments are unavailable due to an event,

More information

CENTER FOR NUCLEAR WASTE REGULATORY ANALYSES

CENTER FOR NUCLEAR WASTE REGULATORY ANALYSES Page 1 of 5 ELECTRONIC FILE ARCHIVAL AND BACKUP PROCEDURES EFFECTIVITY AND APPROVAL Revision 1 of this procedure became effective on July 6, 2004. This procedure consists of the pages and changes listed

More information

Open Source Mainframe Backup with Hercules

Open Source Mainframe Backup with Hercules Open Source Mainframe Backup with Hercules An Overview of the Hercules Disaster Recovery Solution 1 Issue: Mainframe Computer Backup Why? Business Need stay in business 60% of all organizations that have

More information

DISASTER RECOVERY PLANNING FOR CITY COMPUTER FACILITIES

DISASTER RECOVERY PLANNING FOR CITY COMPUTER FACILITIES APPENDIX 1 DISASTER RECOVERY PLANNING FOR CITY COMPUTER FACILITIES March 2008 Auditor General s Office Jeffrey Griffiths, C.A., C.F.E. Auditor General City of Toronto TABLE OF CONTENTS EXECUTIVE SUMMARY...1

More information

Technology Recovery Plan Instructions

Technology Recovery Plan Instructions State of California California Information Security Office Technology Recovery Plan Instructions SIMM 5325-A (Formerly SIMM 65A) September 2013 REVISION HISTORY REVISION DATE OF RELEASE OWNER SUMMARY OF

More information

Disaster Recovery Plan Documentation for Agencies Instructions

Disaster Recovery Plan Documentation for Agencies Instructions California Office of Information Security Disaster Recovery Plan Documentation for Agencies Instructions () November 2009 SCOPE AND PURPOSE The requirements included in this document are applicable to

More information

Protecting Your Business

Protecting Your Business Protecting Your Business Business Continuity/Disaster Recovery Planning Robert Haberman Senior Product Manager BCP/DRP TELUS BUSINESS SOLUTIONS Business Continuity/Disaster Recovery Planning 1 Agenda:

More information

CSB Policy And Procedures

CSB Policy And Procedures Page 1 of 9 Policy Statement CSB Policy And Procedures The equipment, software systems, and databases that comprise the ephi System are critical components that enable the [CSB] to function in an effective

More information

ALABAMA STATE DEPARTMENT OF EDUCATION. Pupil Transportation Disaster Preparedness

ALABAMA STATE DEPARTMENT OF EDUCATION. Pupil Transportation Disaster Preparedness ALABAMA STATE DEPARTMENT OF EDUCATION Pupil Transportation Disaster Preparedness Purpose To provide aid to local education agencies (LEA s) in order that minimal disruption of transportation service before,

More information

Putnam/Northern Westchester BOCES Internal Audit Report on Information Technology

Putnam/Northern Westchester BOCES Internal Audit Report on Information Technology 6G Putnam/Northern Westchester BOCES Internal Audit Report on Information Technology TABLE OF CONTENTS Page Report on Internal Controls Related to Information Technology Network and Network Security 1

More information

BACKUP SECURITY GUIDELINE

BACKUP SECURITY GUIDELINE Section: Information Security Revised: December 2004 Guideline: Description: Backup Security Guidelines: are recommended processes, models, or actions to assist with implementing procedures with respect

More information