Subject: Internal Audit of Information Technology Disaster Recovery Plan
|
|
- Henry Bennett
- 7 years ago
- Views:
Transcription
1 RIVERSIDE: AUDIT & ADVISORY SERVICES June 30, 2009 To: Charles Rowley, Associate Vice Chancellor Computing & Communications Subject: Internal Audit of Information Technology Disaster Recovery Plan Ref: R We have completed our audit of the Computing & Communication Disaster Recovery Plan in accordance with the UC Riverside Audit Plan. Our report is attached for your review. We appreciate the cooperation and assistance provided by your staff. Should you have any questions concerning the report, please do not hesitate to contact me. Michael R. Jenson Director xc: Audit Committee Members Director of Computing Infrastructure and Security Harvey Chief Financial and Administrative Officer Gupta
2 UNIVERSITY OF CALIFORNIA AT RIVERSIDE AUDIT & ADVISORY SERVICES MEMBER OF ASSOCIATION OF COLLEGE & UNIVERSITY AUDITORS INTERNAL AUDIT REPORT R INFORMATION TECHNOLOGY DISASTER RECOVERY PLAN JUNE 2009 Approved by: Noahn Montemayor Principal Auditor Michael R. Jenson Director
3 UC RIVERSIDE INFORMATION TECHNOLOGY DISASTER RECOVERY PLAN INTERNAL AUDIT REPORT R JUNE 2009 I. MANAGEMENT SUMMARY Based upon the results of work performed within the scope of the audit, it is our opinion that overall, in compliance with University policies and procedures, UCR Computing & Communication (C&C) has developed a comprehensive Disaster Recovery Plan (DRP) to guide the restoration to campus of essential enterprise wide systems in the event of a major disaster and subsequent systems failure. Positive observations included: * The C&C DRP has been appropriately tested and communicated to key campus stakeholders. * C&C has established a Disaster Recovery Committee, with well-defined individual roles and responsibilities, delegations of authority, contact information, and emergency communications plans and procedures if the DRP is invoked. * Three suitable alternate locations are available and prepared to house the Information Technology Emergency Operations Center in case of emergency. Minor items that were not of a magnitude to warrant inclusion in the report were discussed verbally with management. II. INTRODUCTION A. PURPOSE UC Riverside Audit & Advisory Services, as part of its Audit Plan, performed an audit of the C&C DRP to evaluate the Information Technology (IT) function s preparedness in the event of a process disruption, compliance with certain University policies and procedures, efficiency and effectiveness of selected operations, and adequacy of certain internal controls.
4 R June 30, 2009 Page 2 B. BACKGROUND IT systems are vulnerable to a variety of disruptions, ranging from mild (e.g., short-term power outage, disk drive failure) to severe (e.g., equipment destruction, fire). Many vulnerabilities may be minimized or eliminated through technical, management, or operational solutions as part of the organization s risk management effort; however, it is virtually impossible to completely eliminate all risks. For example, in many cases, critical resources may reside outside the organization s control (such as electric power or telecommunications), and the organization may be unable to ensure their availability. Contingency planning is designed to mitigate the risk of system and service unavailability by focusing effective and efficient recovery solutions. 1 IT contingency planning represents a broad scope of activities designed to sustain and recover critical IT services following an emergency. IT contingency planning fits into a much broader emergency preparedness environment that includes organizational and business process continuity and recovery planning. Ultimately, an organization would use a suite of plans to properly prepare response, recovery, and continuity activities for disruptions affecting the organization s IT systems, business processes, and facilities. 2 Universally accepted definitions for IT contingency planning and related planning areas have not been available, and this unavailability has occasionally led to confusion regarding the actual scope and purpose of various types of plans. To provide a common basis of understanding, the National Institute of Standards and Technology (NIST) identifies several types of plans, describes their purpose and scope relative to IT contingency planning, and shows how the various plans relate to each other, each with a specific purpose. 3 The NIST offers the following description to apply to disaster recovery plans: Disaster Recovery Plan (DRP). As suggested by its name, the DRP applies to major, usually catastrophic, events that deny access to the normal facility for an extended period. Frequently, DRP refers to an ITfocused plan designed to restore operability of the target system, application, or computer facility at an alternate site after an emergency. The DRP scope may overlap that of an IT contingency plan; however, the DRP is narrower in scope and does not address minor disruptions that do not require relocation. Dependent on the organization s needs, several DRPs may be appended to the Business Continuity Plan (BCP). 1 National Institute of Standards and Technology (NIST) Special Publication , Contingency Planning Guide for Information Technology Systems 2 Ibid 3 Exhibit attached
5 R June 30, 2009 Page 3 Disaster recovery of IT components supports restoring operations critical to the resumption of business, including regaining access to data (records, hardware, software, etc.), communications ( , phone, etc.), workspace, and other business processes after a disaster. A wellestablished and thoroughly tested DRP must be developed in harmony with the business continuity plan to increase the probability of successfully recovering vital organization records. 4 UCOP Business and Finance Bulletin IS-12, Continuity Planning and Disaster Recovery, establishes guidelines to reduce risk and minimize disruption of campus research and business functions in the event of a catastrophic disaster or extraordinary disruption. UCR C&C is charged with developing and maintaining the DRP to guide the restoration of enterprise wide systems to campus in the event of a major disaster and subsequent systems failure. C. SCOPE The scope of the audit focuses on a review of the C&C DRP and its alignment with enterprise risk management and business continuity plans, policies, standards, guidelines, procedures, laws and regulations that address restoring IT critical services after a disruption. Audit & Advisory Services reviewed the latest version of the C&C DRP and related documents, conducted interviews, observations, examinations, and tests, and reviewed management responses to an internal control questionnaire. These and associated procedures were performed to obtain answers to the following questions: Does the DRP as currently formulated provide an adequate framework within which to address the particular needs of the University in the event of a disaster or emergency of sufficient magnitude or duration that it would require the University to invoke the plan? Are there significant risks that are not being addressed by the DRP in its present form? How can the DRP be further strengthened or improved? III. INTERNAL CONTROLS AND COMPLIANCE As part of the review, internal controls were examined within the scope of the audit. Internal control is a process designed to provide reasonable, but not absolute, assurance regarding the achievement of objectives in the following categories: 4 Global Technology Audit Guide Business Continuity Management; The Institute of Internal Auditors
6 R June 30, 2009 Page 4 * effectiveness and efficiency of operations * reliability of financial reporting * compliance with applicable laws and regulations Substantive audit procedures were performed during May through June Accordingly, this evaluation of internal controls is based on our knowledge as of that time and should be read with that understanding.
7 R DRAFT Exhibit Business Continuity Plan (BCP) Table: Types of Contingency-Related Plans Plan Purpose Scope Provide procedures for sustaining essential business operations while recovering from a significant disruption business process Business Recovery (or Resumption) Plan (BRP) Continuity of Operations Plan (COOP) Continuity of Support Plan/IT Contingency Plan Crisis Communications Plan Cyber Incident Response Plan Disaster Recovery Plan (DRP) Occupant Emergency Plan (OEP) Provide procedures for recovering business operations immediately following a disaster Provide procedures and capabilities to sustain an organization s essential, strategic functions at an alternate site for up to 30 days Provide procedures and capabilities for recovering a major application or general support system Provides procedures for disseminating status reports to personnel and the public Provide strategies to detect, respond to, and limit consequences of malicious cyber incident Provide detailed procedures to facilitate recovery of capabilities at an alternate site Provide coordinated procedures for minimizing loss of life or injury and protecting property damage in response to a physical threat Addresses business processes; IT addressed based only on its support for Addresses business processes; not IT-focused; IT addressed based only on its support for business process Addresses the subset of an organization s missions that are deemed most critical; usually written at headquarters level; not ITfocused Same as IT contingency plan; addresses IT system disruptions; not business process focused Addresses communications with personnel and the public; not IT focused Focuses on information security responses to incidents affecting systems and/or networks Often IT-focused; limited to major disruptions with longterm effects Focuses on personnel and property particular to the specific facility; not business process or IT system functionality based Source: NIST Special Publication , Contingency Planning Guide for Information Technology Systems
8 R DRAFT Exhibit Figure: Interrelationship of Emergency Preparedness Plans Source: NIST Special Publication , Contingency Planning Guide for Information Technology Systems
,"ENT 0..- ~ -1-0. Q c. ;:* *1 ~ J U.S. DEPARTMENTOF HOUSINGAND URBAN DEVELOPMENT THEDEPUTYSECRETARY WASHINGTON, DC 20410-0050.
,"ENT 0..- ~ -1-0 Q c. ;:* *1 ~ J c.~.
More informationFINAL AUDIT REPORT WITH RECOMENDATIONS Information Technology No. 11-001
FINAL AUDIT REPORT WITH RECOMENDATIONS Information Technology No. 11-001 SUBJECT: Review of Emergency Plans DATE: September 24, 2010 for Critical Information Technology Operations and Financial Systems
More informationContingency Planning Guide for Information Technology Systems
NIST Special Publication 800-34 Contingency Planning Guide for Information Technology Systems Recommendations of the National Institute of Standards and Technology Marianne Swanson, Amy Wohl, Lucinda Pope,
More informationSCOPE; ENFORCEMENT; AUTHORITY; EXCEPTIONS
Title: DRAFT USG Continuity of Operation Plan Policy Policy Number: 2009-Julian Date Topical Security Area: Document Type: Standard Pages: Words: Lines: 5 1,387 182 Issue Date: May-09 Effective Date: Immediately
More informationHanh Do, Director, Information System Audit Division, GAA. SUBJECT: Review of HUD s Information Technology Contingency Planning and Preparedness
Issue Date: August 31, 2006 Audit Report Number 2006-DP-0005 TO: Lisa Schlosser, Chief Information Officer, A FROM: Hanh Do, Director, Information System Audit Division, GAA SUBJECT: Review of HUD s Information
More informationContingency Planning Guide
Institutional and Sector Modernisation Facility ICT Standards Contingency Planning Guide Document number: ISMF-ICT/3.03 - ICT Security/MISP/SD/CP Version: 1.20 Project Funded by the European Union 1 Document
More informationContinuity Planning and Disaster Recovery
Responsible Officer: AVP - Information Technology Services & UC Chief Information Officer Responsible Office: IT - Information Technology Services Issuance Date: 7/27/2007 Effective Date: 7/27/2007 Scope:
More informationDISASTER RECOVERY PLANNING FOR CITY COMPUTER FACILITIES
APPENDIX 1 DISASTER RECOVERY PLANNING FOR CITY COMPUTER FACILITIES March 2008 Auditor General s Office Jeffrey Griffiths, C.A., C.F.E. Auditor General City of Toronto TABLE OF CONTENTS EXECUTIVE SUMMARY...1
More informationUnit Guide to Business Continuity/Resumption Planning
Unit Guide to Business Continuity/Resumption Planning (February 2009) Revised June 2011 Executive Summary... 3 Purpose and Scope for a Unit Business Continuity Plan(BCP)... 3 Resumption Planning... 4 Assumptions
More informationBusiness Continuity Planning and Disaster Recovery Planning
4 Business Continuity Planning and Disaster Recovery Planning Basic Concepts 1. Business Continuity Management: Business Continuity means maintaining the uninterrupted availability of all key business
More informationStatement of Guidance
Statement of Guidance Business Continuity Management All Licensees 1. Statement of Objectives 1.1. To enhance the resilience of the financial sector and to minimise the potential impact of a major operational
More informationPAPER-6 PART-1 OF 5 CA A.RAFEQ, FCA
1 Chapter-4: Business Continuity Planning and Disaster Recovery Planning PAPER-6 PART-1 OF 5 CA A.RAFEQ, FCA Learning Objectives 2 To understand the concept of Business Continuity Management To understand
More informationBusiness Continuity Planning Toolkit. (For Deployment of BCP to Campus Departments in Phase 2)
Business Continuity Planning Toolkit (For Deployment of BCP to Campus Departments in Phase 2) August 2010 CONTENTS: Background Assumptions Business Impact Analysis Risk (Vulnerabilities) Assessment Backup
More informationUNIVERSITY OF CALIFORNIA DAVIS INTERNAL AUDIT SERVICES. Information and Educational Technology Data Center and Client Services Project #08-21
DAVIS INTERNAL AUDIT SERVICES Information and Educational Technology Data Center and Client Services Project #08-21 June 2009 Fieldwork Performed by: Tony Firpo, Principal Auditor Reviewed by: Leslyn Kraus,
More informationSAMPLE IT CONTINGENCY PLAN FORMAT
SAMPLE IT CONTINGENCY PLAN FORMAT This sample format provides a template for preparing an information technology (IT) contingency plan. The template is intended to be used as a guide, and the Contingency
More informationNIST SP 800-34, Revision 1 Contingency Planning Guide for Federal Information Systems
NIST SP 800-34, Revision 1 Contingency Planning Guide for Federal Information Systems Marianne Swanson NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 1 Table Of Contents Introduction to NIST SP 800-34
More informationMarch 2007 Report No. 07-009. FDIC s Contract Planning and Management for Business Continuity AUDIT REPORT
March 2007 Report No. 07-009 FDIC s Contract Planning and Management for Business Continuity AUDIT REPORT Report No. 07-009 March 2007 FDIC s Contract Planning and Management for Business Continuity Results
More information85-01-55 Overview of Business Continuity Planning Sally Meglathery Payoff
85-01-55 Overview of Business Continuity Planning Sally Meglathery Payoff Because a business continuity plan affects all functional units within the organization, each functional unit must participate
More informationEvaluation of the Railroad Retirement Board s Disaster Recovery Plan Report No. 06-08, August 14, 2006 INTRODUCTION
Evaluation of the Railroad Retirement Board s Disaster Recovery Plan Report No. 06-08, August 14, 2006 INTRODUCTION This report presents the results of the Office of Inspector General s evaluation of the
More informationVirginia Commonwealth University School of Medicine Information Security Standard
Virginia Commonwealth University School of Medicine Information Security Standard Title: Scope: Business Continuity Management Standard for IT Systems This standard is applicable to all VCU School of Medicine
More informationJune 19, 2013. Bobbi McCracken, Associate Vice Chancellor Financial Services. Subject: Internal Audit of PCI Compliance.
RIVERSIDE: AUDIT & ADVISORY SERVICES June 19, 2013 To: Bobbi McCracken, Associate Vice Chancellor Financial Services Subject: Internal Audit of PCI Compliance Ref: R2013-03 We have completed our audit
More informationCENTRAL BANK OF KENYA (CBK) PRUDENTIAL GUIDELINE ON BUSINESS CONTINUITY MANAGEMENT (BCM) FOR INSTITUTIONS LICENSED UNDER THE BANKING ACT
CENTRAL BANK OF KENYA (CBK) PRUDENTIAL GUIDELINE ON BUSINESS CONTINUITY MANAGEMENT (BCM) FOR INSTITUTIONS LICENSED UNDER THE BANKING ACT JANUARY 2008 GUIDELINE ON BUSINESS CONTINUITY GUIDELINE CBK/PG/14
More informationFlinders University IT Disaster Recovery Framework
Flinders University IT Disaster Recovery Framework Establishment: Flinders University, 1 August 2013 Last Amended: Manager, ITS Security Services, 4 October 2013 Nature of Amendment: Initial release Date
More informationTechnology Recovery Plan Instructions
State of California California Information Security Office Technology Recovery Plan Instructions SIMM 5325-A (Formerly SIMM 65A) September 2013 REVISION HISTORY REVISION DATE OF RELEASE OWNER SUMMARY OF
More informationDisaster Recovery and Business Continuity Plan
Disaster Recovery and Business Continuity Plan Table of Contents 1. Introduction... 3 2. Objectives... 3 3. Risks... 3 4. Steps of Disaster Recovery Plan formulation... 3 5. Audit Procedure.... 5 Appendix
More informationWith the large number of. How to Avoid Disaster: RIM s Crucial Role in Business Continuity Planning. Virginia A. Jones, CRM, FAI RIM FUNDAMENTALS
How to Avoid Disaster: RIM s Crucial Role in Business Continuity Planning The world has experienced a great deal of natural and man-made upheaval and destruction in the past few years, including tornadoes,
More informationTREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION
TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION Emergency Preparedness at Internal Revenue Service Facilities Needs to Be Improved September 17, 2008 Reference Number: 2008-10-148 This report has cleared
More informationInteractive-Network Disaster Recovery
Interactive-Network Disaster Recovery BACKGROUND IT systems are vulnerable to a variety of disruptions, ranging from mild (e.g., short-term power outage, disk drive failure) to severe (e.g., terrorism,
More informationBUSINESS CONTINUITY PLANNING
Policy 8.3.2 Business Responsible Party: President s Office BUSINESS CONTINUITY PLANNING Overview The UT Health Science Center at San Antonio (Health Science Center) is committed to its employees, students,
More informationCITY OF SAN ANTONIO OFFICE OF THE CITY AUDITOR. Follow-up Audit of Information Technology Services Department. IT Contingency Planning
Follow-up Audit of Information Technology Services Department CITY OF SAN ANTONIO OFFICE OF THE CITY AUDITOR Follow-up Audit of Information Technology Services Department Project No. AU13-F05 October 25,
More informationPAPER-6 PART-3 OF 5 CA A.RAFEQ, FCA
Chapter-4: Business Continuity Planning and Disaster Recovery Planning PAPER-6 PART-3 OF 5 CA A.RAFEQ, FCA Learning Objectives 2 To understand the concept of Business Continuity Management To understand
More informationDisaster Recovery Plan Documentation for Agencies Instructions
California Office of Information Security Disaster Recovery Plan Documentation for Agencies Instructions () November 2009 SCOPE AND PURPOSE The requirements included in this document are applicable to
More informationDRAFT BUSINESS CONTINUITY MANAGEMENT POLICY
DRAFT BUSINESS CONTINUITY MANAGEMENT POLICY This document outlines a set of policies and procedures for formalising a Business Continuity programme, and provides guidelines for developing, maintaining
More informationTable of Contents... 1
... 1 Chapter 1 Introduction... 4 1.1 Executive Summary... 4 1.2 Goals and Objectives... 5 1.3 Senior Management and Board of Directors Responsibilities... 5 1.4 Business Continuity Planning Processes...
More informationState of South Carolina Policy Guidance and Training
State of South Carolina Policy Guidance and Training Policy Workshop All Agencies Business Continuity Management Policy June 2014 Agenda Questions & Follow-Up Policy Workshop Overview & Timeline Policy
More informationCHAPTER 1: BUSINESS CONTINUITY MANAGEMENT STRATEGY AND POLICY
Zurich Management Services Limited Registered in England: No 2741053 Registered Office The Zurich Centre, 3000 Parkway Whiteley, Fareham Hampshire, PO15 7JZ CHAPTER 1: BUSINESS CONTINUITY MANAGEMENT STRATEGY
More informationNIST Special Publication 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems
NIST Special Publication 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems Marianne Swanson Pauline Bowen Amy Wohl Phillips Dean Gallup David Lynes NIST Special Publication 800-34
More informationBusiness Continuity Policy
Business Continuity Policy Ref. No. TP/028 Title: Business Continuity Policy Page 1 of 15 DOCUMENT PROFILE and CONTROL. Purpose of the document: Provides an overview of the London Ambulance Service NHS
More informationBusiness Continuity Management
Business Continuity Management Policy Statement & Strategy July 2009 Basildon District Council Business Continuity Management Policy Statement The Council is committed to ensuring robust and effective
More informationIMS-ISA Incident Response Guideline
THE UNIVERSITY OF TEXAS HEALTH SCIENCE CENTER AT SAN ANTONIO IMS-ISA Incident Response Guideline Incident Response Information Security and Assurance 12/31/2009 This document serves as a guideline for
More informationBusiness Continuity Plans
Version Number Issue 2 Business Continuity Policy Date Revision Complete Policy Owner Author Reason for Revision Proof Read April 2016 Business Improvement Manager Emma Earle, Business Services Officer
More informationINFOSEC.MY KNOWLEDGE SHARING SESSION
INFOSEC.MY KNOWLEDGE SHARING SESSION Integration BCM into your Organization: Challenges & Opportunities 31 st October 2007 1 Prabha Ramanathan ( CBCP, MBCI, MBCS, MSCS) Certified Business Continuity Professional.have
More informationIT DISASTER RECOVERY CALIFORNIA STATE UNIVERSITY, CHANNEL ISLANDS. Audit Report 11-30 August 12, 2011
IT DISASTER RECOVERY CALIFORNIA STATE UNIVERSITY, CHANNEL ISLANDS Audit Report 11-30 August 12, 2011 Members, Committee on Audit Henry Mendoza, Chair Melinda Guzman, Vice Chair Margaret Fortune Steven
More informationThe PNC Financial Services Group, Inc. Business Continuity Program
The PNC Financial Services Group, Inc. Business Continuity Program 1 Content Overview A. Introduction Page 3 B. Governance Model Page 4 C. Program Components Page 4 Business Impact Analysis (BIA) Page
More informationCPM-East.com. Workshops: November 18, 2013 Conference: November 19 21, 2013 Expo: November 19 20, 2013 Gaylord Texan Resort, Dallas Texas
CPM-East.com Workshops: November 18, 2013 Conference: November 19 21, 2013 Expo: November 19 20, 2013 Gaylord Texan Resort, Dallas Texas Past CPM West Registered Attendees by Title 502 ABW Emergency Manager
More informationBusiness Unit CONTINGENCY PLAN
Contingency Plan Template Business Unit CONTINGENCY PLAN Version 1.0 (Date submitted) Submitted By: Business Unit Date Version 1.0 Page 1 1 Plan Review and Updates... 3 2 Introduction... 3 2.1 Purpose...
More informationDeveloping a Continuity of Operations Program. An Overview
Developing a Continuity of Operations Program An Overview COOP Overview: Benefits COOP is a good business practice. It enables agencies to continue their essential functions across a broad spectrum of
More informationGuidelines 1 on Information Technology Security
Guidelines 1 on Information Technology Security Introduction The State Bank of Pakistan recognizes that financial industry is built around the sanctity of the financial transactions. Owing to the critical
More informationPost-Class Quiz: Business Continuity & Disaster Recovery Planning Domain
1. What is the most common planned performance duration for a continuity of operations plan (COOP)? A. 30 days B. 60 days C. 90 days D. It depends on the severity of a disaster. 2. What is the business
More informationBUSINESS CONTINUITY PLAN
How to Develop a BUSINESS CONTINUITY PLAN To print to A4, print at 75%. TABLE OF CONTENTS SUMMARY SUMMARY WHAT IS A BUSINESS CONTINUITY PLAN? CHAPTER PREPARING TO WRITE YOUR BUSINESS CONTINUITY PLAN CHAPTER
More informationBusiness Continuity Management Review
Office of Internal Audit Business Continuity Management Review November 14, 2014 Internal Audit Team Shannon Henry Chief Audit Officer & Executive Director of Institutional Compliance Stacy Sneed Audit
More informationSUPERVISORY AND REGULATORY GUIDELINES: PU19-0406 BUSINESS CONTINUITY GUIDELINES
SUPERVISORY AND REGULATORY GUIDELINES: PU19-0406 Business Continuity Issued: 1 st May, 2007 Revised: 14 th October 2008 BUSINESS CONTINUITY GUIDELINES I. INTRODUCTION The Central Bank of The Bahamas (
More informationPrinciples for BCM requirements for the Dutch financial sector and its providers.
Principles for BCM requirements for the Dutch financial sector and its providers. Platform Business Continuity Vitale Infrastructuur Financiële sector (BC VIF) Werkgroep BCM requirements 21 September 2011
More informationIntel Business Continuity Practices
Intel Business Continuity Practices As a global corporation with locations and suppliers all over the world, Intel requires every designated Intel organization to embed business continuity as a core business
More informationBusiness Continuity Planning
Business Continuity Planning Erinn Skiba Emergency Management Specialist Hillsborough County Fire Rescue Office of Emergency Management June 26 th, 2013 Welcome History of BCP with Hillsborough County
More informationWestern Intergovernmental Audit Forum
Western Intergovernmental Audit Forum Business Continuity & Disaster Recovery Planning September 12, 2013 Presented by: City of Phoenix City Auditor Department Aaron Cook, Sr Internal Auditor IT Audit
More informationCRISP Technologies Inc.
Resumption Planning (BCRP ) Consulting with BCRP Methodology and Workflow CRISP Technologies Inc. Table of Contents TABLE OF CONTENTS... 2 1 CONSULTING WITH THE CRISP BCRP METHODOLOGY... 3 2 CRISP TECHNOLOGIES
More informationD2-02_01 Disaster Recovery in the modern EPU
CONSEIL INTERNATIONAL DES GRANDS RESEAUX ELECTRIQUES INTERNATIONAL COUNCIL ON LARGE ELECTRIC SYSTEMS http:d2cigre.org STUDY COMMITTEE D2 INFORMATION SYSTEMS AND TELECOMMUNICATION 2015 Colloquium October
More informationBusiness Continuity Planning for Risk Reduction
Business Continuity Planning for Risk Reduction Ion PLUMB ionplumb@yahoo.com Andreea ZAMFIR zamfir_andreea_ileana@yahoo.com Delia TUDOR tudordelia@yahoo.com Faculty of Management Academy of Economic Studies
More informationDisaster Recovery/Business Continuity
CITY AUDITOR'S OFFICE Disaster Recovery/Business Continuity March 6, 2015 AUDIT REPORT NO. 1511 CITY COUNCIL Mayor W.J. Jim Lane Suzanne Klapp Virginia Korte Kathy Littlefield Vice Mayor Linda Milhaven
More informationData Center Assistance Group, Inc. DCAG Contact: Tom Bronack Phone: (718) 591-5553 Email: bronackt@dcag.com Fax: (718) 380-7322
Business Continuity and Disaster Recovery Job Descriptions Table of Contents Business Continuity Services Organization Chart... 2 Director Business Continuity Services Group... 3 Manager of Business Recovery
More informationAssessing Your Disaster. Andrews Hooper Pavlik PLC. Andrews Hooper Pavlik PLC
Assessing Your Disaster Recovery Plans Gregory H. Soule, CPA, CISA, CISSP, CFE Andrews Hooper Pavlik PLC Andrews Hooper Pavlik PLC Agenda Business Continuity Concepts Impact Analysis Risk Assessment Risk
More informationHow to write a DISASTER RECOVERY PLAN. To print to A4, print at 75%.
How to write a DISASTER RECOVERY PLAN To print to A4, print at 75%. TABLE OF CONTENTS SUMMARY SUMMARY WHAT IS A DRP AND HOW CAN IT HELP MY COMPANY? CHAPTER PREPARING TO WRITE YOUR DISASTER RECOVERY PLAN
More informationCISM Certified Information Security Manager
CISM Certified Information Security Manager Firebrand Custom Designed Courseware Chapter 4 Information Security Incident Management Exam Relevance Ensure that the CISM candidate Establish an effective
More informationOhio Supercomputer Center
Ohio Supercomputer Center IT Business Continuity Planning No: Effective: OSC-13 06/02/2009 Issued By: Kevin Wohlever Director of Supercomputer Operations Published By: Ohio Supercomputer Center Original
More informationDepartment of Budget & Management. State of Maryland Information Technology (IT) Disaster Recovery Guidelines Version 4.0
Department of Budget & Management State of Maryland Information Technology (IT) Disaster Recovery Guidelines Version 4.0 July 2006 TABLE OF CONTENTS 1.0 INTRODUCTION...1 1.1 Purpose...1 1.2 Scope...1 1.3
More informationCONNECTION BETWEEN RISK MANAGEMENT AND BUSINESS CONTINUITY DECEMBER 11, 2014
New York State Internal Control Association Business Continuity Work Group CONNECTION BETWEEN RISK MANAGEMENT AND BUSINESS CONTINUITY DECEMBER 11, 2014 Thomas Lukacs Director of Risk Management New York
More informationSouth West Lincolnshire NHS Clinical Commissioning Group Business Continuity Policy
South West Lincolnshire NHS Clinical Commissioning Group Business Continuity Policy Reference No: CG 01 Version: Version 1 Approval date 18 December 2013 Date ratified: 18 December 2013 Name of Author
More informationOFFICE OF AUDITS & ADVISORY SERVICES IT DISASTER RECOVERY AUDIT FINAL REPORT
County of San Diego Auditor and Controller OFFICE OF AUDITS & ADVISORY SERVICES IT DISASTER RECOVERY AUDIT FINAL REPORT Chief of Audits: Juan R. Perez Audit Manager: Lynne Prizzia, CISA, CRISC Senior Auditor:
More informationThe Commonwealth of Massachusetts
A. JOSEPH DeNUCCI AUDITOR The Commonwealth of Massachusetts AUDITOR OF THE COMMONWEALTH ONE ASHBURTON PLACE, ROOM 1819 BOSTON, MASSACHUSETTS 02108 TEL. (617) 727-6200 No. 2008-1308-4T OFFICE OF THE STATE
More informationIssue 1.0. UoG/ILS/IS 001. Information Security and Assurance Policy. Information Security and Compliance Manager
Document Reference Number Date Title Author Owning Department Version Approval Date Review Date Approving Body UoG/ILS/IS 001 January 2016 Information Security and Assurance Policy Information Security
More informationBUSINESS CONTINUITY POLICY
BUSINESS CONTINUITY POLICY Last Review Date Approving Body n/a Audit Committee Date of Approval 9 th January 2014 Date of Implementation 1 st February 2014 Next Review Date February 2017 Review Responsibility
More informationDRAFT Disaster Recovery Policy Template
DRAFT Disaster Recovery Policy Template NOTE: This is a boiler plate template much information is needed from to finalizeconsider this document pre-draft FOREWARD... 3 Policy Overview...
More informationSuccess or Failure? Your Keys to Business Continuity Planning. An Ingenuity Whitepaper
Success or Failure? Your Keys to Business Continuity Planning An Ingenuity Whitepaper May 2006 Overview With the level of uncertainty in our world regarding events that can disrupt the operation of an
More informationTemple university. Auditing a business continuity management BCM. November, 2015
Temple university Auditing a business continuity management BCM November, 2015 Auditing BCM Agenda 1. Introduction 2. Definitions 3. Standards 4. BCM key elements IT Governance class - IT audit program
More informationBusiness Continuity and Disaster Recovery Planning
Business Continuity and Disaster Recovery Planning Jennifer Brandt, CISA A p r i l 16, 2015 HISTORY OF STINNETT & ASSOCIATES Stinnett & Associates (Stinnett) is a professional advisory firm offering services
More informationESCB definitions of major business continuity terms in relation to payment and securities settlement systems 1
ESCB definitions of major business continuity terms in relation to payment and securities settlement systems 1 June 2007 The ESCB has developed a glossary of major business continuity terms for market
More informationOverview TECHIS60851. Manage information security business resilience activities
Overview Information security business resilience encompasses business continuity and disaster recovery from information security threats. As well as addressing the consequences of a major security incident,
More informationUNION COLLEGE INCIDENT RESPONSE PLAN
UNION COLLEGE INCIDENT RESPONSE PLAN The college is committed to supporting the safety and welfare of all its students, faculty, staff and visitors. It also consists of academic, research and other facilities,
More informationIdentify and Protect Your Vital Records
Identify and Protect Your Vital Records INTRODUCTION The Federal Emergency Management Agency s Federal Preparedness Circular 65 states The protection and ready availability of electronic and hardcopy documents,
More informationNIST Special Publication 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems
NIST Special Publication 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems Marianne Swanson Pauline Bowen Amy Wohl Phillips Dean Gallup David Lynes NIST Special Publication 800-34
More informationNEEDS BASED PLANNING FOR IT DISASTER RECOVERY
The Define/Align/Approve Reference Series NEEDS BASED PLANNING FOR IT DISASTER RECOVERY Disaster recovery planning is essential it s also expensive. That s why every step taken and dollar spent must be
More informationSTATE OF CYBER SECURITY IN ETHIOPIA
ETIOPIAN TELECOMMUNICATIONS AGENCY STATE OF CYBER SECURITY IN ETHIOPIA By Mr. Balcha Reba Ethiopian Telecommunications Agency Standards and Inspection Department Head, Standards Division email: tele.agency@ethionet.et
More informationColumbus City Schools Office of Internal Audit
Information Technology Disaster Recovery Plan Review Report Date: March 24, 2011 Internal Audit Mission Statement To support the overall mission of the Columbus City Schools by providing quality management
More informationCornell University EMERGENCY MANAGEMENT PROGRAM
Cornell University EMERGENCY MANAGEMENT PROGRAM Table of Contents Table of Contents Section 1 INTRODUCTION... 2 Section 2 EMERGENCY MANAGEMENT COMPONENTS... 3 Prevention-Mitigation Plan... 3 Preparedness
More informationEMERGENCY PREPAREDNESS PLAN Business Continuity Plan
EMERGENCY PREPAREDNESS PLAN Business Continuity Plan GIS Bankers Insurance Group Powered by DISASTER PREPAREDNESS Implementation Small Business Guide to Business Continuity Planning Surviving a Catastrophic
More information2014 NABRICO Conference
Business Continuity Planning 2014 NABRICO Conference September 19, 2014 6 CityPlace Drive, Suite 900 St. Louis, Missouri 63141 314.983.1200 1520 S. Fifth Street, Suite 309 St. Charles, Missouri 63303 636.255.3000
More informationBUSINESS CONTINUITY MANAGEMENT GUIDELINES FOR BANKS AND FINANCIAL INSTITUTIONS
BUSINESS CONTINUITY MANAGEMENT GUIDELINES FOR BANKS AND FINANCIAL INSTITUTIONS DIRECTORATE OF BANKING SUPERVISION AUGUST 2009 TABLE OF CONTENTS PAGE 1.0 INTRODUCTION..3 1.1 Background...3 1.2 Citation...3
More informationInternal Audit Report ITS CHANGE MANAGEMENT PROCESS. Report No. SC-11-11
Internal Audit Report ITS CHANGE MANAGEMENT PROCESS Report No. SC-11-11 March 2011 SANTA CRUZ: INTERNAL AUDIT March 31, 2011 MARY DOYLE Vice Chancellor Information Technology Re: Internal Audit Report
More informationA Business Continuity Plan for Government. George Bomar Dianne Casey Texas Department of Licensing and Regulation
A Business Continuity Plan for Government George Bomar Dianne Casey Texas Department of Licensing and Regulation A practiced logistical plan for how an organization will recover and restore partially or
More informationBusiness Continuity Plan
Business Continuity Plan October 2007 Agenda Business continuity plan definition Evolution of the business continuity plan Business continuity plan life cycle FFIEC & Business continuity plan Questions
More informationOffice of Inspector General
DEPARTMENT OF HOMELAND SECURITY Office of Inspector General Security Weaknesses Increase Risks to Critical United States Secret Service Database (Redacted) Notice: The Department of Homeland Security,
More informationHow To Manage A Business Continuity Strategy
Business continuity strategy 2009 2012 Table of contents 1 Why this strategy is needed 3 2 Aim of the strategy 4 3 Our approach to business continuity 4 PROCESS 4 STRUCTURE 5 DOCUMENTATION 6 DISRUPTION
More informationState Agency Cyber Security Survey v 3.4 2 October 2014. State Agency Cybersecurity Survey v 3.4
State Agency Cybersecurity Survey v 3.4 The purpose of this survey is to identify your agencies current capabilities with respect to information systems/cyber security and any challenges and/or successes
More informationCOMCARE BUSINESS CONTINUITY MANAGEMENT
COMCARE BUSINESS CONTINUITY MANAGEMENT Title Business Continuity Management Version 2.1 Authorised by Executive Committee Effective date Authorisation date 10/7/2012 10/7/2012 COMCARE BUSINESS CONTINUITY
More informationTHORNBURG INVESTMENT MANAGEMENT THORNBURG INVESTMENT TRUST. Business Continuity Plan
THORNBURG INVESTMENT MANAGEMENT THORNBURG INVESTMENT TRUST Business Continuity Plan June 2012 Purpose The purpose of this Business Continuity Plan ( BCP ) is to define the strategies and the plans which
More informationGuidance Note XGN XXX.1
Guidance Note XGN XXX.1 Risk Assessment and Business Continuity Planning 1. This Guidance Note provides further detail on matters institutions should consider in assessing disruption scenarios and certain
More informationFederal Financial Institutions Examination Council FFIEC. Business Continuity Planning BCP MARCH 2003 MARCH 2008 IT EXAMINATION
Federal Financial Institutions Examination Council FFIEC Business Continuity Planning MARCH 2003 MARCH 2008 BCP IT EXAMINATION H ANDBOOK TABLE OF CONTENTS INTRODUCTION... 1 BOARD AND SENIOR MANAGEMENT
More informationInternal Audit Department NeighborWorks America. Audit Review of the Business Continuity Plan (BCP) Management and Documentation
Department NeighborWorks America Audit Review of the Business Continuity Plan (BCP) and Documentation Project Number: ADMN.BCP.2013 Audit Review of of BCP Table of Contents Project Completion Letter...
More informationInformation Security Management: Business Continuity Planning. Presentation by Stanislav Nurilov March 9th, 2005 CS 996: Info. Sec. Mgmt.
Information Security Management: Business Continuity Planning Presentation by Stanislav Nurilov March 9th, 2005 CS 996: Info. Sec. Mgmt. Overview BCP: Definition BCP: Need for (Why?) BCP: When BCP: Who
More information