Subject: Internal Audit of Information Technology Disaster Recovery Plan

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Subject: Internal Audit of Information Technology Disaster Recovery Plan"

Transcription

1 RIVERSIDE: AUDIT & ADVISORY SERVICES June 30, 2009 To: Charles Rowley, Associate Vice Chancellor Computing & Communications Subject: Internal Audit of Information Technology Disaster Recovery Plan Ref: R We have completed our audit of the Computing & Communication Disaster Recovery Plan in accordance with the UC Riverside Audit Plan. Our report is attached for your review. We appreciate the cooperation and assistance provided by your staff. Should you have any questions concerning the report, please do not hesitate to contact me. Michael R. Jenson Director xc: Audit Committee Members Director of Computing Infrastructure and Security Harvey Chief Financial and Administrative Officer Gupta

2 UNIVERSITY OF CALIFORNIA AT RIVERSIDE AUDIT & ADVISORY SERVICES MEMBER OF ASSOCIATION OF COLLEGE & UNIVERSITY AUDITORS INTERNAL AUDIT REPORT R INFORMATION TECHNOLOGY DISASTER RECOVERY PLAN JUNE 2009 Approved by: Noahn Montemayor Principal Auditor Michael R. Jenson Director

3 UC RIVERSIDE INFORMATION TECHNOLOGY DISASTER RECOVERY PLAN INTERNAL AUDIT REPORT R JUNE 2009 I. MANAGEMENT SUMMARY Based upon the results of work performed within the scope of the audit, it is our opinion that overall, in compliance with University policies and procedures, UCR Computing & Communication (C&C) has developed a comprehensive Disaster Recovery Plan (DRP) to guide the restoration to campus of essential enterprise wide systems in the event of a major disaster and subsequent systems failure. Positive observations included: * The C&C DRP has been appropriately tested and communicated to key campus stakeholders. * C&C has established a Disaster Recovery Committee, with well-defined individual roles and responsibilities, delegations of authority, contact information, and emergency communications plans and procedures if the DRP is invoked. * Three suitable alternate locations are available and prepared to house the Information Technology Emergency Operations Center in case of emergency. Minor items that were not of a magnitude to warrant inclusion in the report were discussed verbally with management. II. INTRODUCTION A. PURPOSE UC Riverside Audit & Advisory Services, as part of its Audit Plan, performed an audit of the C&C DRP to evaluate the Information Technology (IT) function s preparedness in the event of a process disruption, compliance with certain University policies and procedures, efficiency and effectiveness of selected operations, and adequacy of certain internal controls.

4 R June 30, 2009 Page 2 B. BACKGROUND IT systems are vulnerable to a variety of disruptions, ranging from mild (e.g., short-term power outage, disk drive failure) to severe (e.g., equipment destruction, fire). Many vulnerabilities may be minimized or eliminated through technical, management, or operational solutions as part of the organization s risk management effort; however, it is virtually impossible to completely eliminate all risks. For example, in many cases, critical resources may reside outside the organization s control (such as electric power or telecommunications), and the organization may be unable to ensure their availability. Contingency planning is designed to mitigate the risk of system and service unavailability by focusing effective and efficient recovery solutions. 1 IT contingency planning represents a broad scope of activities designed to sustain and recover critical IT services following an emergency. IT contingency planning fits into a much broader emergency preparedness environment that includes organizational and business process continuity and recovery planning. Ultimately, an organization would use a suite of plans to properly prepare response, recovery, and continuity activities for disruptions affecting the organization s IT systems, business processes, and facilities. 2 Universally accepted definitions for IT contingency planning and related planning areas have not been available, and this unavailability has occasionally led to confusion regarding the actual scope and purpose of various types of plans. To provide a common basis of understanding, the National Institute of Standards and Technology (NIST) identifies several types of plans, describes their purpose and scope relative to IT contingency planning, and shows how the various plans relate to each other, each with a specific purpose. 3 The NIST offers the following description to apply to disaster recovery plans: Disaster Recovery Plan (DRP). As suggested by its name, the DRP applies to major, usually catastrophic, events that deny access to the normal facility for an extended period. Frequently, DRP refers to an ITfocused plan designed to restore operability of the target system, application, or computer facility at an alternate site after an emergency. The DRP scope may overlap that of an IT contingency plan; however, the DRP is narrower in scope and does not address minor disruptions that do not require relocation. Dependent on the organization s needs, several DRPs may be appended to the Business Continuity Plan (BCP). 1 National Institute of Standards and Technology (NIST) Special Publication , Contingency Planning Guide for Information Technology Systems 2 Ibid 3 Exhibit attached

5 R June 30, 2009 Page 3 Disaster recovery of IT components supports restoring operations critical to the resumption of business, including regaining access to data (records, hardware, software, etc.), communications ( , phone, etc.), workspace, and other business processes after a disaster. A wellestablished and thoroughly tested DRP must be developed in harmony with the business continuity plan to increase the probability of successfully recovering vital organization records. 4 UCOP Business and Finance Bulletin IS-12, Continuity Planning and Disaster Recovery, establishes guidelines to reduce risk and minimize disruption of campus research and business functions in the event of a catastrophic disaster or extraordinary disruption. UCR C&C is charged with developing and maintaining the DRP to guide the restoration of enterprise wide systems to campus in the event of a major disaster and subsequent systems failure. C. SCOPE The scope of the audit focuses on a review of the C&C DRP and its alignment with enterprise risk management and business continuity plans, policies, standards, guidelines, procedures, laws and regulations that address restoring IT critical services after a disruption. Audit & Advisory Services reviewed the latest version of the C&C DRP and related documents, conducted interviews, observations, examinations, and tests, and reviewed management responses to an internal control questionnaire. These and associated procedures were performed to obtain answers to the following questions: Does the DRP as currently formulated provide an adequate framework within which to address the particular needs of the University in the event of a disaster or emergency of sufficient magnitude or duration that it would require the University to invoke the plan? Are there significant risks that are not being addressed by the DRP in its present form? How can the DRP be further strengthened or improved? III. INTERNAL CONTROLS AND COMPLIANCE As part of the review, internal controls were examined within the scope of the audit. Internal control is a process designed to provide reasonable, but not absolute, assurance regarding the achievement of objectives in the following categories: 4 Global Technology Audit Guide Business Continuity Management; The Institute of Internal Auditors

6 R June 30, 2009 Page 4 * effectiveness and efficiency of operations * reliability of financial reporting * compliance with applicable laws and regulations Substantive audit procedures were performed during May through June Accordingly, this evaluation of internal controls is based on our knowledge as of that time and should be read with that understanding.

7 R DRAFT Exhibit Business Continuity Plan (BCP) Table: Types of Contingency-Related Plans Plan Purpose Scope Provide procedures for sustaining essential business operations while recovering from a significant disruption business process Business Recovery (or Resumption) Plan (BRP) Continuity of Operations Plan (COOP) Continuity of Support Plan/IT Contingency Plan Crisis Communications Plan Cyber Incident Response Plan Disaster Recovery Plan (DRP) Occupant Emergency Plan (OEP) Provide procedures for recovering business operations immediately following a disaster Provide procedures and capabilities to sustain an organization s essential, strategic functions at an alternate site for up to 30 days Provide procedures and capabilities for recovering a major application or general support system Provides procedures for disseminating status reports to personnel and the public Provide strategies to detect, respond to, and limit consequences of malicious cyber incident Provide detailed procedures to facilitate recovery of capabilities at an alternate site Provide coordinated procedures for minimizing loss of life or injury and protecting property damage in response to a physical threat Addresses business processes; IT addressed based only on its support for Addresses business processes; not IT-focused; IT addressed based only on its support for business process Addresses the subset of an organization s missions that are deemed most critical; usually written at headquarters level; not ITfocused Same as IT contingency plan; addresses IT system disruptions; not business process focused Addresses communications with personnel and the public; not IT focused Focuses on information security responses to incidents affecting systems and/or networks Often IT-focused; limited to major disruptions with longterm effects Focuses on personnel and property particular to the specific facility; not business process or IT system functionality based Source: NIST Special Publication , Contingency Planning Guide for Information Technology Systems

8 R DRAFT Exhibit Figure: Interrelationship of Emergency Preparedness Plans Source: NIST Special Publication , Contingency Planning Guide for Information Technology Systems

Subject: Internal Audit of Campus Network Renewal and Replacement Plan

Subject: Internal Audit of Campus Network Renewal and Replacement Plan RIVERSIDE: AUDIT & ADVISORY SERVICES June 29, 2012 To: Chuck Rowley, Associate Vice Chancellor Subject: Internal Audit of Campus Network Renewal and Replacement Plan Ref: R2012-10 We have completed our

More information

FINAL AUDIT REPORT WITH RECOMENDATIONS Information Technology No. 11-001

FINAL AUDIT REPORT WITH RECOMENDATIONS Information Technology No. 11-001 FINAL AUDIT REPORT WITH RECOMENDATIONS Information Technology No. 11-001 SUBJECT: Review of Emergency Plans DATE: September 24, 2010 for Critical Information Technology Operations and Financial Systems

More information

Contingency Planning Guide for Information Technology Systems

Contingency Planning Guide for Information Technology Systems NIST Special Publication 800-34 Contingency Planning Guide for Information Technology Systems Recommendations of the National Institute of Standards and Technology Marianne Swanson, Amy Wohl, Lucinda Pope,

More information

SCOPE; ENFORCEMENT; AUTHORITY; EXCEPTIONS

SCOPE; ENFORCEMENT; AUTHORITY; EXCEPTIONS Title: DRAFT USG Continuity of Operation Plan Policy Policy Number: 2009-Julian Date Topical Security Area: Document Type: Standard Pages: Words: Lines: 5 1,387 182 Issue Date: May-09 Effective Date: Immediately

More information

Business Continuity Planning and Disaster Recovery Planning

Business Continuity Planning and Disaster Recovery Planning 4 Business Continuity Planning and Disaster Recovery Planning Basic Concepts 1. Business Continuity Management: Business Continuity means maintaining the uninterrupted availability of all key business

More information

PAPER-6 PART-1 OF 5 CA A.RAFEQ, FCA

PAPER-6 PART-1 OF 5 CA A.RAFEQ, FCA 1 Chapter-4: Business Continuity Planning and Disaster Recovery Planning PAPER-6 PART-1 OF 5 CA A.RAFEQ, FCA Learning Objectives 2 To understand the concept of Business Continuity Management To understand

More information

Hanh Do, Director, Information System Audit Division, GAA. SUBJECT: Review of HUD s Information Technology Contingency Planning and Preparedness

Hanh Do, Director, Information System Audit Division, GAA. SUBJECT: Review of HUD s Information Technology Contingency Planning and Preparedness Issue Date: August 31, 2006 Audit Report Number 2006-DP-0005 TO: Lisa Schlosser, Chief Information Officer, A FROM: Hanh Do, Director, Information System Audit Division, GAA SUBJECT: Review of HUD s Information

More information

Statement of Guidance

Statement of Guidance Statement of Guidance Business Continuity Management All Licensees 1. Statement of Objectives 1.1. To enhance the resilience of the financial sector and to minimise the potential impact of a major operational

More information

Unit Guide to Business Continuity/Resumption Planning

Unit Guide to Business Continuity/Resumption Planning Unit Guide to Business Continuity/Resumption Planning (February 2009) Revised June 2011 Executive Summary... 3 Purpose and Scope for a Unit Business Continuity Plan(BCP)... 3 Resumption Planning... 4 Assumptions

More information

CENTRAL BANK OF KENYA (CBK) PRUDENTIAL GUIDELINE ON BUSINESS CONTINUITY MANAGEMENT (BCM) FOR INSTITUTIONS LICENSED UNDER THE BANKING ACT

CENTRAL BANK OF KENYA (CBK) PRUDENTIAL GUIDELINE ON BUSINESS CONTINUITY MANAGEMENT (BCM) FOR INSTITUTIONS LICENSED UNDER THE BANKING ACT CENTRAL BANK OF KENYA (CBK) PRUDENTIAL GUIDELINE ON BUSINESS CONTINUITY MANAGEMENT (BCM) FOR INSTITUTIONS LICENSED UNDER THE BANKING ACT JANUARY 2008 GUIDELINE ON BUSINESS CONTINUITY GUIDELINE CBK/PG/14

More information

Archived NIST Technical Series Publication

Archived NIST Technical Series Publication Archived NIST Technical Series Publication The attached publication has been archived (withdrawn), and is provided solely for historical purposes. It may have been superseded by another publication (indicated

More information

Contingency Planning Guide

Contingency Planning Guide Institutional and Sector Modernisation Facility ICT Standards Contingency Planning Guide Document number: ISMF-ICT/3.03 - ICT Security/MISP/SD/CP Version: 1.20 Project Funded by the European Union 1 Document

More information

Evaluation of the Railroad Retirement Board s Disaster Recovery Plan Report No. 06-08, August 14, 2006 INTRODUCTION

Evaluation of the Railroad Retirement Board s Disaster Recovery Plan Report No. 06-08, August 14, 2006 INTRODUCTION Evaluation of the Railroad Retirement Board s Disaster Recovery Plan Report No. 06-08, August 14, 2006 INTRODUCTION This report presents the results of the Office of Inspector General s evaluation of the

More information

DISASTER RECOVERY PLANNING FOR CITY COMPUTER FACILITIES

DISASTER RECOVERY PLANNING FOR CITY COMPUTER FACILITIES APPENDIX 1 DISASTER RECOVERY PLANNING FOR CITY COMPUTER FACILITIES March 2008 Auditor General s Office Jeffrey Griffiths, C.A., C.F.E. Auditor General City of Toronto TABLE OF CONTENTS EXECUTIVE SUMMARY...1

More information

SAMPLE IT CONTINGENCY PLAN FORMAT

SAMPLE IT CONTINGENCY PLAN FORMAT SAMPLE IT CONTINGENCY PLAN FORMAT This sample format provides a template for preparing an information technology (IT) contingency plan. The template is intended to be used as a guide, and the Contingency

More information

NIST SP 800-34, Revision 1 Contingency Planning Guide for Federal Information Systems

NIST SP 800-34, Revision 1 Contingency Planning Guide for Federal Information Systems NIST SP 800-34, Revision 1 Contingency Planning Guide for Federal Information Systems Marianne Swanson NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 1 Table Of Contents Introduction to NIST SP 800-34

More information

June 19, 2013. Bobbi McCracken, Associate Vice Chancellor Financial Services. Subject: Internal Audit of PCI Compliance.

June 19, 2013. Bobbi McCracken, Associate Vice Chancellor Financial Services. Subject: Internal Audit of PCI Compliance. RIVERSIDE: AUDIT & ADVISORY SERVICES June 19, 2013 To: Bobbi McCracken, Associate Vice Chancellor Financial Services Subject: Internal Audit of PCI Compliance Ref: R2013-03 We have completed our audit

More information

Technology Recovery Plan Instructions

Technology Recovery Plan Instructions State of California California Information Security Office Technology Recovery Plan Instructions SIMM 5325-A (Formerly SIMM 65A) September 2013 REVISION HISTORY REVISION DATE OF RELEASE OWNER SUMMARY OF

More information

Continuity Planning and Disaster Recovery

Continuity Planning and Disaster Recovery Responsible Officer: AVP - Information Technology Services & UC Chief Information Officer Responsible Office: IT - Information Technology Services Issuance Date: 7/27/2007 Effective Date: 7/27/2007 Scope:

More information

PAPER-6 PART-3 OF 5 CA A.RAFEQ, FCA

PAPER-6 PART-3 OF 5 CA A.RAFEQ, FCA Chapter-4: Business Continuity Planning and Disaster Recovery Planning PAPER-6 PART-3 OF 5 CA A.RAFEQ, FCA Learning Objectives 2 To understand the concept of Business Continuity Management To understand

More information

85-01-55 Overview of Business Continuity Planning Sally Meglathery Payoff

85-01-55 Overview of Business Continuity Planning Sally Meglathery Payoff 85-01-55 Overview of Business Continuity Planning Sally Meglathery Payoff Because a business continuity plan affects all functional units within the organization, each functional unit must participate

More information

Disaster Recovery and Business Continuity Plan

Disaster Recovery and Business Continuity Plan Disaster Recovery and Business Continuity Plan Table of Contents 1. Introduction... 3 2. Objectives... 3 3. Risks... 3 4. Steps of Disaster Recovery Plan formulation... 3 5. Audit Procedure.... 5 Appendix

More information

March 2007 Report No. 07-009. FDIC s Contract Planning and Management for Business Continuity AUDIT REPORT

March 2007 Report No. 07-009. FDIC s Contract Planning and Management for Business Continuity AUDIT REPORT March 2007 Report No. 07-009 FDIC s Contract Planning and Management for Business Continuity AUDIT REPORT Report No. 07-009 March 2007 FDIC s Contract Planning and Management for Business Continuity Results

More information

CPM-East.com. Workshops: November 18, 2013 Conference: November 19 21, 2013 Expo: November 19 20, 2013 Gaylord Texan Resort, Dallas Texas

CPM-East.com. Workshops: November 18, 2013 Conference: November 19 21, 2013 Expo: November 19 20, 2013 Gaylord Texan Resort, Dallas Texas CPM-East.com Workshops: November 18, 2013 Conference: November 19 21, 2013 Expo: November 19 20, 2013 Gaylord Texan Resort, Dallas Texas Past CPM West Registered Attendees by Title 502 ABW Emergency Manager

More information

OFFICE OF AUDITS & ADVISORY SERVICES IT DISASTER RECOVERY AUDIT FINAL REPORT

OFFICE OF AUDITS & ADVISORY SERVICES IT DISASTER RECOVERY AUDIT FINAL REPORT County of San Diego Auditor and Controller OFFICE OF AUDITS & ADVISORY SERVICES IT DISASTER RECOVERY AUDIT FINAL REPORT Chief of Audits: Juan R. Perez Audit Manager: Lynne Prizzia, CISA, CRISC Senior Auditor:

More information

Success or Failure? Your Keys to Business Continuity Planning. An Ingenuity Whitepaper

Success or Failure? Your Keys to Business Continuity Planning. An Ingenuity Whitepaper Success or Failure? Your Keys to Business Continuity Planning An Ingenuity Whitepaper May 2006 Overview With the level of uncertainty in our world regarding events that can disrupt the operation of an

More information

Disaster Recovery Plan Documentation for Agencies Instructions

Disaster Recovery Plan Documentation for Agencies Instructions California Office of Information Security Disaster Recovery Plan Documentation for Agencies Instructions () November 2009 SCOPE AND PURPOSE The requirements included in this document are applicable to

More information

Interactive-Network Disaster Recovery

Interactive-Network Disaster Recovery Interactive-Network Disaster Recovery BACKGROUND IT systems are vulnerable to a variety of disruptions, ranging from mild (e.g., short-term power outage, disk drive failure) to severe (e.g., terrorism,

More information

Business Continuity Management Review

Business Continuity Management Review Office of Internal Audit Business Continuity Management Review November 14, 2014 Internal Audit Team Shannon Henry Chief Audit Officer & Executive Director of Institutional Compliance Stacy Sneed Audit

More information

DRAFT Disaster Recovery Policy Template

DRAFT Disaster Recovery Policy Template DRAFT Disaster Recovery Policy Template NOTE: This is a boiler plate template much information is needed from to finalizeconsider this document pre-draft FOREWARD... 3 Policy Overview...

More information

State of South Carolina Policy Guidance and Training

State of South Carolina Policy Guidance and Training State of South Carolina Policy Guidance and Training Policy Workshop All Agencies Business Continuity Management Policy June 2014 Agenda Questions & Follow-Up Policy Workshop Overview & Timeline Policy

More information

Company X IT Disaster Recovery Plan (BCP0005)

Company X IT Disaster Recovery Plan (BCP0005) Company X IT Disaster Recovery Plan (BCP0005) 1 of 48 Document version control Version Date Author(s) Summary of changes Document approvals Approving body Roles Version Document distribution Referenced

More information

TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION

TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION Emergency Preparedness at Internal Revenue Service Facilities Needs to Be Improved September 17, 2008 Reference Number: 2008-10-148 This report has cleared

More information

D2-02_01 Disaster Recovery in the modern EPU

D2-02_01 Disaster Recovery in the modern EPU CONSEIL INTERNATIONAL DES GRANDS RESEAUX ELECTRIQUES INTERNATIONAL COUNCIL ON LARGE ELECTRIC SYSTEMS http:d2cigre.org STUDY COMMITTEE D2 INFORMATION SYSTEMS AND TELECOMMUNICATION 2015 Colloquium October

More information

CITY OF SAN ANTONIO OFFICE OF THE CITY AUDITOR. Follow-up Audit of Information Technology Services Department. IT Contingency Planning

CITY OF SAN ANTONIO OFFICE OF THE CITY AUDITOR. Follow-up Audit of Information Technology Services Department. IT Contingency Planning Follow-up Audit of Information Technology Services Department CITY OF SAN ANTONIO OFFICE OF THE CITY AUDITOR Follow-up Audit of Information Technology Services Department Project No. AU13-F05 October 25,

More information

Business Continuity Planning

Business Continuity Planning Business Continuity Planning Erinn Skiba Emergency Management Specialist Hillsborough County Fire Rescue Office of Emergency Management June 26 th, 2013 Welcome History of BCP with Hillsborough County

More information

Business Unit CONTINGENCY PLAN

Business Unit CONTINGENCY PLAN Contingency Plan Template Business Unit CONTINGENCY PLAN Version 1.0 (Date submitted) Submitted By: Business Unit Date Version 1.0 Page 1 1 Plan Review and Updates... 3 2 Introduction... 3 2.1 Purpose...

More information

Virginia Commonwealth University School of Medicine Information Security Standard

Virginia Commonwealth University School of Medicine Information Security Standard Virginia Commonwealth University School of Medicine Information Security Standard Title: Scope: Business Continuity Management Standard for IT Systems This standard is applicable to all VCU School of Medicine

More information

Assessing Your Disaster. Andrews Hooper Pavlik PLC. Andrews Hooper Pavlik PLC

Assessing Your Disaster. Andrews Hooper Pavlik PLC. Andrews Hooper Pavlik PLC Assessing Your Disaster Recovery Plans Gregory H. Soule, CPA, CISA, CISSP, CFE Andrews Hooper Pavlik PLC Andrews Hooper Pavlik PLC Agenda Business Continuity Concepts Impact Analysis Risk Assessment Risk

More information

NIST Special Publication 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems

NIST Special Publication 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems NIST Special Publication 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems Marianne Swanson Pauline Bowen Amy Wohl Phillips Dean Gallup David Lynes NIST Special Publication 800-34

More information

IT DISASTER RECOVERY CALIFORNIA STATE UNIVERSITY, CHANNEL ISLANDS. Audit Report 11-30 August 12, 2011

IT DISASTER RECOVERY CALIFORNIA STATE UNIVERSITY, CHANNEL ISLANDS. Audit Report 11-30 August 12, 2011 IT DISASTER RECOVERY CALIFORNIA STATE UNIVERSITY, CHANNEL ISLANDS Audit Report 11-30 August 12, 2011 Members, Committee on Audit Henry Mendoza, Chair Melinda Guzman, Vice Chair Margaret Fortune Steven

More information

Data Center Assistance Group, Inc. DCAG Contact: Tom Bronack Phone: (718) 591-5553 Email: bronackt@dcag.com Fax: (718) 380-7322

Data Center Assistance Group, Inc. DCAG Contact: Tom Bronack Phone: (718) 591-5553 Email: bronackt@dcag.com Fax: (718) 380-7322 Business Continuity and Disaster Recovery Job Descriptions Table of Contents Business Continuity Services Organization Chart... 2 Director Business Continuity Services Group... 3 Manager of Business Recovery

More information

Developing a Continuity of Operations Program. An Overview

Developing a Continuity of Operations Program. An Overview Developing a Continuity of Operations Program An Overview COOP Overview: Benefits COOP is a good business practice. It enables agencies to continue their essential functions across a broad spectrum of

More information

Guidance Note XGN XXX.1

Guidance Note XGN XXX.1 Guidance Note XGN XXX.1 Risk Assessment and Business Continuity Planning 1. This Guidance Note provides further detail on matters institutions should consider in assessing disruption scenarios and certain

More information

Business Continuity and Disaster Recovery Planning

Business Continuity and Disaster Recovery Planning Business Continuity and Disaster Recovery Planning Jennifer Brandt, CISA A p r i l 16, 2015 HISTORY OF STINNETT & ASSOCIATES Stinnett & Associates (Stinnett) is a professional advisory firm offering services

More information

2014 NABRICO Conference

2014 NABRICO Conference Business Continuity Planning 2014 NABRICO Conference September 19, 2014 6 CityPlace Drive, Suite 900 St. Louis, Missouri 63141 314.983.1200 1520 S. Fifth Street, Suite 309 St. Charles, Missouri 63303 636.255.3000

More information

Office of Inspector General

Office of Inspector General DEPARTMENT OF HOMELAND SECURITY Office of Inspector General Security Weaknesses Increase Risks to Critical United States Secret Service Database (Redacted) Notice: The Department of Homeland Security,

More information

Disaster Recovery/Business Continuity

Disaster Recovery/Business Continuity CITY AUDITOR'S OFFICE Disaster Recovery/Business Continuity March 6, 2015 AUDIT REPORT NO. 1511 CITY COUNCIL Mayor W.J. Jim Lane Suzanne Klapp Virginia Korte Kathy Littlefield Vice Mayor Linda Milhaven

More information

BUSINESS CONTINUITY MANAGEMENT GUIDELINES FOR BANKS AND FINANCIAL INSTITUTIONS

BUSINESS CONTINUITY MANAGEMENT GUIDELINES FOR BANKS AND FINANCIAL INSTITUTIONS BUSINESS CONTINUITY MANAGEMENT GUIDELINES FOR BANKS AND FINANCIAL INSTITUTIONS DIRECTORATE OF BANKING SUPERVISION AUGUST 2009 TABLE OF CONTENTS PAGE 1.0 INTRODUCTION..3 1.1 Background...3 1.2 Citation...3

More information

Stepping Through the Business Continuity Plan Audit

Stepping Through the Business Continuity Plan Audit Stepping Through the Business Continuity Plan Audit Doug Menendez Graybar Electric Company Presentation to MidAmerica Contingency Planning Forum February 16, 2012 Introduction Whether it is from internal

More information

Ohio Supercomputer Center

Ohio Supercomputer Center Ohio Supercomputer Center IT Business Continuity Planning No: Effective: OSC-13 06/02/2009 Issued By: Kevin Wohlever Director of Supercomputer Operations Published By: Ohio Supercomputer Center Original

More information

BUSINESS CONTINUITY PLANNING

BUSINESS CONTINUITY PLANNING Policy 8.3.2 Business Responsible Party: President s Office BUSINESS CONTINUITY PLANNING Overview The UT Health Science Center at San Antonio (Health Science Center) is committed to its employees, students,

More information

CRISP Technologies Inc.

CRISP Technologies Inc. Resumption Planning (BCRP ) Consulting with BCRP Methodology and Workflow CRISP Technologies Inc. Table of Contents TABLE OF CONTENTS... 2 1 CONSULTING WITH THE CRISP BCRP METHODOLOGY... 3 2 CRISP TECHNOLOGIES

More information

BUSINESS CONTINUITY PLAN

BUSINESS CONTINUITY PLAN How to Develop a BUSINESS CONTINUITY PLAN To print to A4, print at 75%. TABLE OF CONTENTS SUMMARY SUMMARY WHAT IS A BUSINESS CONTINUITY PLAN? CHAPTER PREPARING TO WRITE YOUR BUSINESS CONTINUITY PLAN CHAPTER

More information

CONTINUITY OF OPERATIONS AUDIT PROGRAM EVALUATION AND AUDIT

CONTINUITY OF OPERATIONS AUDIT PROGRAM EVALUATION AND AUDIT CONTINUITY OF OPERATIONS AUDIT PROGRAM EVALUATION AND AUDIT April 16, 2014 INTRODUCTION Purpose The purpose of the audit is to give assurance that the development of the Metropolitan Council s Continuity

More information

Office of the Superintendent of Financial Institutions. Internal Audit on Corporate Services: Security and Administrative Services

Office of the Superintendent of Financial Institutions. Internal Audit on Corporate Services: Security and Administrative Services Office of the Superintendent of Financial Institutions Internal Audit on Corporate Services: Security and Administrative Services April 2014 Table of Contents 1. Background... 3 2. Audit Objective, Scope

More information

Intel Business Continuity Practices

Intel Business Continuity Practices Intel Business Continuity Practices As a global corporation with locations and suppliers all over the world, Intel requires every designated Intel organization to embed business continuity as a core business

More information

Business Continuity Policy

Business Continuity Policy Business Continuity Policy Ref. No. TP/028 Title: Business Continuity Policy Page 1 of 15 DOCUMENT PROFILE and CONTROL. Purpose of the document: Provides an overview of the London Ambulance Service NHS

More information

UNITED STATES COMMISSION ON CIVIL RIGHTS. Fiscal Year 2012 Federal Information Security Management Act Evaluation

UNITED STATES COMMISSION ON CIVIL RIGHTS. Fiscal Year 2012 Federal Information Security Management Act Evaluation Memorandum UNITED STATES COMMISSION ON CIVIL RIGHTS Date: November 15, 2012 To: From: Subject: The Honorable Commissioners Frances Garcia, Inspector General Fiscal Year 2012 Federal Information Security

More information

Business Continuity Planning Toolkit. (For Deployment of BCP to Campus Departments in Phase 2)

Business Continuity Planning Toolkit. (For Deployment of BCP to Campus Departments in Phase 2) Business Continuity Planning Toolkit (For Deployment of BCP to Campus Departments in Phase 2) August 2010 CONTENTS: Background Assumptions Business Impact Analysis Risk (Vulnerabilities) Assessment Backup

More information

Identify and Protect Your Vital Records

Identify and Protect Your Vital Records Identify and Protect Your Vital Records INTRODUCTION The Federal Emergency Management Agency s Federal Preparedness Circular 65 states The protection and ready availability of electronic and hardcopy documents,

More information

Flinders University IT Disaster Recovery Framework

Flinders University IT Disaster Recovery Framework Flinders University IT Disaster Recovery Framework Establishment: Flinders University, 1 August 2013 Last Amended: Manager, ITS Security Services, 4 October 2013 Nature of Amendment: Initial release Date

More information

Principles for BCM requirements for the Dutch financial sector and its providers.

Principles for BCM requirements for the Dutch financial sector and its providers. Principles for BCM requirements for the Dutch financial sector and its providers. Platform Business Continuity Vitale Infrastructuur Financiële sector (BC VIF) Werkgroep BCM requirements 21 September 2011

More information

Business Continuity Planning for Risk Reduction

Business Continuity Planning for Risk Reduction Business Continuity Planning for Risk Reduction Ion PLUMB ionplumb@yahoo.com Andreea ZAMFIR zamfir_andreea_ileana@yahoo.com Delia TUDOR tudordelia@yahoo.com Faculty of Management Academy of Economic Studies

More information

Business Continuity Plan

Business Continuity Plan Business Continuity Plan October 2007 Agenda Business continuity plan definition Evolution of the business continuity plan Business continuity plan life cycle FFIEC & Business continuity plan Questions

More information

The PNC Financial Services Group, Inc. Business Continuity Program

The PNC Financial Services Group, Inc. Business Continuity Program The PNC Financial Services Group, Inc. Business Continuity Program 1 Content Overview A. Introduction Page 3 B. Governance Model Page 4 C. Program Components Page 4 Business Impact Analysis (BIA) Page

More information

Columbus City Schools Office of Internal Audit

Columbus City Schools Office of Internal Audit Information Technology Disaster Recovery Plan Review Report Date: March 24, 2011 Internal Audit Mission Statement To support the overall mission of the Columbus City Schools by providing quality management

More information

INFOSEC.MY KNOWLEDGE SHARING SESSION

INFOSEC.MY KNOWLEDGE SHARING SESSION INFOSEC.MY KNOWLEDGE SHARING SESSION Integration BCM into your Organization: Challenges & Opportunities 31 st October 2007 1 Prabha Ramanathan ( CBCP, MBCI, MBCS, MSCS) Certified Business Continuity Professional.have

More information

How to write a DISASTER RECOVERY PLAN. To print to A4, print at 75%.

How to write a DISASTER RECOVERY PLAN. To print to A4, print at 75%. How to write a DISASTER RECOVERY PLAN To print to A4, print at 75%. TABLE OF CONTENTS SUMMARY SUMMARY WHAT IS A DRP AND HOW CAN IT HELP MY COMPANY? CHAPTER PREPARING TO WRITE YOUR DISASTER RECOVERY PLAN

More information

Disaster Recovery Policy

Disaster Recovery Policy Disaster Recovery Policy Organizational Functional Area: Policy for: Executive Division Bank Disaster Recovery Program Board Reviewed: September 14, 2011 Department/Individual Responsible for Maintaining/Updating

More information

EMERGENCY PREPAREDNESS PLAN Business Continuity Plan

EMERGENCY PREPAREDNESS PLAN Business Continuity Plan EMERGENCY PREPAREDNESS PLAN Business Continuity Plan GIS Bankers Insurance Group Powered by DISASTER PREPAREDNESS Implementation Small Business Guide to Business Continuity Planning Surviving a Catastrophic

More information

CHAPTER 1: BUSINESS CONTINUITY MANAGEMENT STRATEGY AND POLICY

CHAPTER 1: BUSINESS CONTINUITY MANAGEMENT STRATEGY AND POLICY Zurich Management Services Limited Registered in England: No 2741053 Registered Office The Zurich Centre, 3000 Parkway Whiteley, Fareham Hampshire, PO15 7JZ CHAPTER 1: BUSINESS CONTINUITY MANAGEMENT STRATEGY

More information

Domain 3 Business Continuity and Disaster Recovery Planning

Domain 3 Business Continuity and Disaster Recovery Planning Domain 3 Business Continuity and Disaster Recovery Planning Steps (ISC) 2 steps [Har10] Project initiation Business Impact Analysis (BIA) Recovery strategy Plan design and development Implementation Testing

More information

CISM Certified Information Security Manager

CISM Certified Information Security Manager CISM Certified Information Security Manager Firebrand Custom Designed Courseware Chapter 4 Information Security Incident Management Exam Relevance Ensure that the CISM candidate Establish an effective

More information

Post-Class Quiz: Business Continuity & Disaster Recovery Planning Domain

Post-Class Quiz: Business Continuity & Disaster Recovery Planning Domain 1. What is the most common planned performance duration for a continuity of operations plan (COOP)? A. 30 days B. 60 days C. 90 days D. It depends on the severity of a disaster. 2. What is the business

More information

Guidelines 1 on Information Technology Security

Guidelines 1 on Information Technology Security Guidelines 1 on Information Technology Security Introduction The State Bank of Pakistan recognizes that financial industry is built around the sanctity of the financial transactions. Owing to the critical

More information

UNIVERSITY OF CALIFORNIA DAVIS INTERNAL AUDIT SERVICES. Information and Educational Technology Data Center and Client Services Project #08-21

UNIVERSITY OF CALIFORNIA DAVIS INTERNAL AUDIT SERVICES. Information and Educational Technology Data Center and Client Services Project #08-21 DAVIS INTERNAL AUDIT SERVICES Information and Educational Technology Data Center and Client Services Project #08-21 June 2009 Fieldwork Performed by: Tony Firpo, Principal Auditor Reviewed by: Leslyn Kraus,

More information

Federal Financial Institutions Examination Council FFIEC. Business Continuity Planning BCP MARCH 2003 MARCH 2008 IT EXAMINATION

Federal Financial Institutions Examination Council FFIEC. Business Continuity Planning BCP MARCH 2003 MARCH 2008 IT EXAMINATION Federal Financial Institutions Examination Council FFIEC Business Continuity Planning MARCH 2003 MARCH 2008 BCP IT EXAMINATION H ANDBOOK TABLE OF CONTENTS INTRODUCTION... 1 BOARD AND SENIOR MANAGEMENT

More information

SCHEDULE 25. Business Continuity

SCHEDULE 25. Business Continuity SCHEDULE 25 Business Continuity 1. Scope 1.1 This schedule covers TfL s requirements in respect of: any circumstance or event which renders, or which TfL considers likely to render, it necessary or desirable

More information

Internal Audit Department NeighborWorks America. Audit Review of the Business Continuity Plan (BCP) Management and Documentation

Internal Audit Department NeighborWorks America. Audit Review of the Business Continuity Plan (BCP) Management and Documentation Department NeighborWorks America Audit Review of the Business Continuity Plan (BCP) and Documentation Project Number: ADMN.BCP.2013 Audit Review of of BCP Table of Contents Project Completion Letter...

More information

Cornell University EMERGENCY MANAGEMENT PROGRAM

Cornell University EMERGENCY MANAGEMENT PROGRAM Cornell University EMERGENCY MANAGEMENT PROGRAM Table of Contents Table of Contents Section 1 INTRODUCTION... 2 Section 2 EMERGENCY MANAGEMENT COMPONENTS... 3 Prevention-Mitigation Plan... 3 Preparedness

More information

Department of Budget & Management. State of Maryland Information Technology (IT) Disaster Recovery Guidelines Version 4.0

Department of Budget & Management. State of Maryland Information Technology (IT) Disaster Recovery Guidelines Version 4.0 Department of Budget & Management State of Maryland Information Technology (IT) Disaster Recovery Guidelines Version 4.0 July 2006 TABLE OF CONTENTS 1.0 INTRODUCTION...1 1.1 Purpose...1 1.2 Scope...1 1.3

More information

Audit Report. Natural Resources Conservation Service Water and Climate Information System Review of Application Controls Portland, Oregon

Audit Report. Natural Resources Conservation Service Water and Climate Information System Review of Application Controls Portland, Oregon U.S. Department of Agriculture Office of Inspector General Western Region Audit Report Natural Resources Conservation Service Water and Climate Information System Review of Application Controls Portland,

More information

A Business Continuity Plan for Government. George Bomar Dianne Casey Texas Department of Licensing and Regulation

A Business Continuity Plan for Government. George Bomar Dianne Casey Texas Department of Licensing and Regulation A Business Continuity Plan for Government George Bomar Dianne Casey Texas Department of Licensing and Regulation A practiced logistical plan for how an organization will recover and restore partially or

More information

BUSINESS CONTINUITY POLICY

BUSINESS CONTINUITY POLICY BUSINESS CONTINUITY POLICY Last Review Date Approving Body n/a Audit Committee Date of Approval 9 th January 2014 Date of Implementation 1 st February 2014 Next Review Date February 2017 Review Responsibility

More information

FINAL AUDIT REPORT. Audit of the arrangements for business continuity and disaster recovery for non- PeopleSoft applications in UNHCR

FINAL AUDIT REPORT. Audit of the arrangements for business continuity and disaster recovery for non- PeopleSoft applications in UNHCR FINAL AUDIT REPORT Audit of the arrangements for business continuity and disaster recovery for non- PeopleSoft applications in UNHCR BACKGROUND The field offices of the United Nations High Commissioner

More information

Business Continuity and Disaster Planning

Business Continuity and Disaster Planning WHITE PAPER Business Continuity and Disaster Planning A guide to preparing for the unexpected Robert Drewniak Director, Strategic & Advisory Services Disasters are not always the result of high winds and

More information

2014 Audit of the Board s Information Security Program

2014 Audit of the Board s Information Security Program O FFICE OF I NSPECTOR GENERAL Audit Report 2014-IT-B-019 2014 Audit of the Board s Information Security Program November 14, 2014 B OARD OF G OVERNORS OF THE F EDERAL R ESERVE S YSTEM C ONSUMER FINANCIAL

More information

Overview of how to test a. Business Continuity Plan

Overview of how to test a. Business Continuity Plan Overview of how to test a Business Continuity Plan Prepared by: Thomas Bronack Phone: (718) 591-5553 Email: bronackt@dcag.com BRP/DRP Test Plan Creation and Exercise Page: 1 Table of Contents BCP/DRP Test

More information

With the large number of. How to Avoid Disaster: RIM s Crucial Role in Business Continuity Planning. Virginia A. Jones, CRM, FAI RIM FUNDAMENTALS

With the large number of. How to Avoid Disaster: RIM s Crucial Role in Business Continuity Planning. Virginia A. Jones, CRM, FAI RIM FUNDAMENTALS How to Avoid Disaster: RIM s Crucial Role in Business Continuity Planning The world has experienced a great deal of natural and man-made upheaval and destruction in the past few years, including tornadoes,

More information

Federal Financial Institutions Examination Council FFIEC BCP. Business Continuity Planning FEBRUARY 2015 IT EXAMINATION H ANDBOOK

Federal Financial Institutions Examination Council FFIEC BCP. Business Continuity Planning FEBRUARY 2015 IT EXAMINATION H ANDBOOK Federal Financial Institutions Examination Council FFIEC Business Continuity Planning BCP FEBRUARY 2015 IT EXAMINATION H ANDBOOK Table of Contents Introduction 1 Board and Senior Management Responsibilities

More information

CISSP Common Body of Knowledge: Business Continuity & Disaster Recovery Planning Domain Version: 5.9.2

CISSP Common Body of Knowledge: Business Continuity & Disaster Recovery Planning Domain Version: 5.9.2 CISSP Common Body of Knowledge: Business Continuity & Disaster Recovery Planning Domain Version: 5.9.2 CISSP Common Body of Knowledge Review by Alfred Ouyang is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike

More information

By: Tracy Hall. Community Bank Auditors Group Taking Your Business Continuity Plan To The Next Level. June 9, 2015

By: Tracy Hall. Community Bank Auditors Group Taking Your Business Continuity Plan To The Next Level. June 9, 2015 Community Bank Auditors Group Taking Your Business Continuity Plan To The Next Level June 9, 2015 By: Tracy Hall MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2015 Wolf & Company,

More information

COMCARE BUSINESS CONTINUITY MANAGEMENT

COMCARE BUSINESS CONTINUITY MANAGEMENT COMCARE BUSINESS CONTINUITY MANAGEMENT Title Business Continuity Management Version 2.1 Authorised by Executive Committee Effective date Authorisation date 10/7/2012 10/7/2012 COMCARE BUSINESS CONTINUITY

More information

REPORT TO MANAGEMENT ON REVIEW OF DISASTER RECOVERY PLAN LAMAR INSTITUTE OF TECHNOLOGY

REPORT TO MANAGEMENT ON REVIEW OF DISASTER RECOVERY PLAN LAMAR INSTITUTE OF TECHNOLOGY REPORT TO MANAGEMENT ON REVIEW OF DISASTER REOVERY PLAN LAMAR INSTITUTE OF TEHNOLOGY DEEMBER 2002 LAMAR INSTITUTE OF TEHNOLOGY TABLE OF ONTENTS Fiscal Year TABLE OF ONTENTS TRANSMITTAL LETTER...3 EXEUTIVE

More information

NIST Special Publication 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems

NIST Special Publication 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems NIST Special Publication 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems Marianne Swanson Pauline Bowen Amy Wohl Phillips Dean Gallup David Lynes NIST Special Publication 800-34

More information

2015 CEO & Board University Taking Your Business Continuity Plan To The Next Level. Tracy L. Hall, MBCP

2015 CEO & Board University Taking Your Business Continuity Plan To The Next Level. Tracy L. Hall, MBCP 2015 CEO & Board University Taking Your Business Continuity Plan To The Next Level Tracy L. Hall, MBCP MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2015 Wolf & Company, P.C.

More information

State Agency Cyber Security Survey v 3.4 2 October 2014. State Agency Cybersecurity Survey v 3.4

State Agency Cyber Security Survey v 3.4 2 October 2014. State Agency Cybersecurity Survey v 3.4 State Agency Cybersecurity Survey v 3.4 The purpose of this survey is to identify your agencies current capabilities with respect to information systems/cyber security and any challenges and/or successes

More information

Business Continuity Business Continuity Management Policy

Business Continuity Business Continuity Management Policy Business Continuity Business Continuity Management Policy : Date of Issue: 28 January 2009 Version no: 1.1 Review Date: January 2010 Document Owner: Patricia Hughes Document Authoriser: Tony Curtis 1 Version

More information