Joint Audit Report for South Lakeland District Council. & Eden District Council
|
|
|
- Sabrina Jacobs
- 8 years ago
- Views:
Transcription
1 Joint Audit Report for South Lakeland District Council & Eden District Council Audit of IT Data Backup and Recovery Arrangements Audit of Development Management 22nd May th June Page 0
2 Audit Resources Title Name Telephone Audit Manager Gill Martin Lead Auditor(s) Olu Abiwon Page 1
3 Audit of IT Data Backup & Recovery Arrangements Audit Report Distribution For Action: Simon McVey, Assistant Director Policy and Performance Ben Wright, IT Services Manager For Information: David Rawsthorn, Director of Finance Audit Committee The separate audit committee s at South Lakeland District Council and Eden District Council will receive the findings from this audit. South Lakeland District Council s Audit Committee on 23 rd July 2015 will receive the Executive Summary. Eden District Council s Audit Committee on 24 th September 2015 will receive the findings from this audit.
4 1. Background 1.1. This report summarises the findings from the audit of IT Data Recovery. This audit was a planned audit assignment which was undertaken in accordance with the 2014/15 Audit Plan The Council has a statutory duty to safeguard the data and information it holds about service users and about the Council in a responsible way, in accordance with legislation like the Data Protection Act 1998 and the Freedom of Information Act For this reason, it is good practice that the Council ensures that all information and data which it is responsible for is securely and routinely backed up South Lakeland and Eden District Council have a disaster recovery and backup contract with IT Professional Services Limited (ITPS) at a combined cost of 54,000 per annum. This amount includes an annual cost of 23k ( 11.5k each) for operating a secured private network link between the Councils respective data centres and ITPS data centre in Sunderland Evidence was gathered through discussions with relevant staff members, physical inspection of the data centres in Penrith and Kendal, and review of prime source documentation pertaining to the backup of a sample of fivers servers, which were subsequently tested to evaluate the effectiveness of the controls in operation. 2. Audit Approach 2.1. Audit Objectives and Methodology Compliance with the mandatory Public Sector Internal Audit Standards requires that internal audit activity evaluates the exposures to risks relating to the organisation s governance, operations and information systems. A risk based audit approach has been applied which aligns to the five key audit control objectives which are outlined in section 4; detailed findings and recommendations are reported within section 5 of this report Audit Scope and Limitations The Audit Scope was agreed with management prior to the commencement of this audit review. The Client Sponsor for this review was the Assistant Director Policy and Performance and the agreed scope areas for consideration were identified as follows: 3 Page 3
5 Policies & Procedures Backup schedules Data restoration Review of due diligence carried out against the vendor contract There were no instances where the audit work undertaken was impaired by the availability of information. 3. Assurance Opinion 3.1. Each audit review is given an assurance opinion and these are intended to assist Members and Officers in their assessment of the overall level of control and potential impact of any identified system weaknesses. There are 4 levels of assurance opinion which may be applied. The definition for each level is explained in Appendix A From the areas examined and tested as part of this audit review, we consider the current controls operating within Data Recovery and General IT Controls provide Substantial assurance. Note: as audit work is restricted by the areas identified in the Audit Scope and is primarily sample based, full coverage of the system and complete assurance cannot be given to an audit area. 4. Summary of Recommendations, Audit Findings and Report Distribution 4.1. There are three levels of audit recommendation; the definition for each level is explained in Appendix B There are 3 audit recommendations are arising from this audit review and these can be summarised as follows: 4 Page 4
6 No. of recommendations Control Objective High Medium Advisory 1. Management - achievement of the organisation s strategic objectives achieved (see section 5.1.) Regulatory - compliance with laws, regulations, policies, procedures and contracts Information - reliability and integrity of financial and operational information Security - safeguarding of assets (see section 5.2) Value - effectiveness and efficiency of operations and programmes (see section 5.3) Total Number of Recommendations Strengths: The following areas of good practice were identified during the course of the audit: A recent event demonstrated that a reliable recovery A service agreement is in place which sets out the Council and the vendor s obligations, the service requirements and the timescales/targets for system recovery. There is a joint (SLDC and Eden DC) IT disaster recovery plan in place which sets out the policy framework for ensuring that information and data is backed up and can be restored in the event of unforeseen loss of service. Sample testing showed that backups are performed in accordance to the frequency prescribed by the joint IT disaster recovery plan. A backup log is maintained and provided by the vendor as assurance that backups have been performed. The log notifies the Council of any failed backup run and the remedial action that the vendor has taken. Our sample testing showed that backups are predominantly successful and a provision has been made in the service agreement to penalise the vendor where a server backup fails more than once in succession. Backups are run via a private remote network (providing greater security of data transmitted than public networks); this links the local data centres to the off-site data centre in Sunderland. 5 Page 5
7 Physical access to the local data centres is restricted and controlled via swipe cards Areas for development: Improvements in the following areas are necessary in order to strengthen existing control arrangements: High priority matters: There are no high priority matters for report Medium priority issues: There are no medium priority matters for report Advisory issues: The joint IT disaster recovery plan should be reviewed in light of changing needs and/or priorities. The frequency systems backups needs to reflect the perceived level of risk and how service critical the data held on each system is. The disaster recovery and backup contract with ITPS Limited is due for re-tendering. Comment from the Assistant Director - Policy and Performance: I am pleased with substantial assurance outcome from this audit review. The audit has highlight no issues with the recovery service provided and the Shared IT Board is fully aware of the procurement timescales pertaining to the contract and it will be making recommendations on this in the very near future. The effectiveness of our disaster recovery arrangements was also tested in a live situation September 2014 and this highlighted the effectiveness of the procedures which the Council has in place. 6 Page 6
SOUTH LAKELAND DISTRICT COUNCIL INTERNAL AUDIT FINAL REPORT IT 11-02. IT Backup, Recovery and Disaster Recovery Planning
SOUTH LAKELAND DISTRICT COUNCIL INTERNAL AUDIT FINAL REPORT IT 11-02 IT Backup, Recovery and Disaster Recovery Planning Executive Summary Introduction As part of the 2011/12 Audit Plan and following discussions
Audit Report for South Lakeland District Council. People and Places Directorate Neighbourhood Services. Audit of Grounds Maintenance
Audit Report for South Lakeland District Council People and Places Directorate Neighbourhood Services Audit of Grounds Maintenance Cumbria Shared Internal Audit Service: Internal Audit Report 7 th November
Cumbria Constabulary. Business Continuity Planning
Cumbria Constabulary Business Continuity Planning 0 Cumbria Shared Internal Audit Service Images courtesy of Carlisle City Council except: Parks (Chinese Gardens), www.sjstudios.co.uk, Monument (Market
Audit of Business Continuity Planning
Cumbria Office of the Police & Crime Commissioner Audit of Business Continuity Planning 0 Cumbria Shared Internal Audit Service Images courtesy of Carlisle City Council except: Parks (Chinese Gardens),
University of Sunderland Business Assurance Information Security Policy
University of Sunderland Business Assurance Information Security Policy Document Classification: Public Policy Reference Central Register Policy Reference Faculty / Service IG 003 Policy Owner Assistant
FINAL. Internal Audit Report. Data Centre Operations and Security
FINAL Internal Audit Report Data Centre Operations and Security Document Details: Reference: Report nos from monitoring spreadsheet/2013.14 Senior Manager, Internal Audit & Assurance: ext. 6567 Engagement
Department of Finance ICVerify System
REPORT # 2011-13 AUDIT Of the Department of Finance ICVerify System TABLE OF CONTENTS Executive Summary..... i Comprehensive List of Recommendations ii Introduction........... 1 Background 1 Overall Conclusion..
Cumbria Constabulary. Audit of Budget Management (Payroll)
Cumbria Constabulary Audit of Budget Management (Payroll) 0 Cumbria Shared Internal Audit Service Images courtesy of Carlisle City Council except: Parks (Chinese Gardens), www.sjstudios.co.uk, Monument
INTERNAL AUDIT 2008/09 INFORMATION TECHNOLOGY (BUSINESS CONTINUITY)
2008/09 SUMMARY Location Subject Business Sponsor Staff engaged Coleg Gwent Information Technology (Business Continuity) Lynda Roberts Sue Harris Head of Internal Audit Gaynor Rains Manager David Bratt
Judiciary Judicial Information Systems
Audit Report Judiciary Judicial Information Systems November 2008 OFFICE OF LEGISLATIVE AUDITS DEPARTMENT OF LEGISLATIVE SERVICES MARYLAND GENERAL ASSEMBLY This report and any related follow-up correspondence
GUIDELINES FOR THE MANAGEMENT OF OPERATIONAL RISK FOR CREDIT UNIONS
SUPERVISORY AND REGULATORY GUIDELINES Guidelines Issued: 22 December 2015 GUIDELINES FOR THE MANAGEMENT OF OPERATIONAL RISK FOR CREDIT UNIONS 1. INTRODUCTION 1.1 The Central Bank of The Bahamas ( the Central
IT REVIEW OF THE DISASTER RECOVERY ARRANGEMENTS
NOTTINGHAM CITY HOMES IT REVIEW OF THE DISASTER RECOVERY ARRANGEMENTS Report issued: February 2011 Audit Plan: The matters raised in this report are only those that came to the attention of the auditor
Hartford Investment Management Company ( HIMCO ) April 2015
_ Hartford Investment Management Company ( HIMCO ) Business Resiliency Policy and Procedures April 2015 1 POLICY REVISION AND APPROVAL HISTORY Effective Date Description of Action Approved by Name and
Comhairle nan Eilean Siar Internal Audit Review DISASTER RECOVERY ARRANGEMENTS Information Technology. Final Report 2014/15-06
Comhairle nan Eilean Siar Internal Audit Review Information Technology Final Report 2014/15-06 3 rd November 2014 CONTENTS Page SECTION 1 - EXECUTIVE SUMMARY 1-6 SECTION 2 - DETAILED FINDINGS AND RECOMMENDATIONS
Information Security Policies. Version 6.1
Information Security Policies Version 6.1 Information Security Policies Contents: 1. Information Security page 3 2. Business Continuity page 5 3. Compliance page 6 4. Outsourcing and Third Party Access
Appendix 6c. Final Internal Audit Report Disaster Recovery Planning. June 2007. Report 6c Page 1 of 15
Appendix 6c Final Internal Audit Report Disaster Recovery Planning June 2007 Report 6c Page 1 of 15 Contents Page Executive Summary 3 Observations and Recommendations 8 Appendix 1 - Audit Framework 13
BARRAMUNDI L IMITED RISK MANAGEMENT POLICY
BARRAMUNDI L IMITED RISK MANAGEMENT POLICY Last updated: 25 August 2014 THE OBJECTIVES OF RISK MANAGEMENT Risk management is the systematic process of managing an organisation's risk exposures to achieve
A Review of the Disaster Recovery Testing Process
To: LASERS Audit Committee; Cindy Rougeou, Executive Director Cc: Maris LeBlanc, Deputy Director; Lance Armstrong, IT Director; Dan Bowden, IT Deputy Director From: Ryan Babin, Audit Director; Blake Lee,
Information Security Policy
Information Security Policy Author: Responsible Lead Executive Director: Endorsing Body: Governance or Assurance Committee Alan Ashforth Alan Lawrie ehealth Strategy Group Implementation Date: September
Glasgow Life Risk Management & Business Continuity Planning. Final Report
Glasgow Life Risk Management & Business Continuity Planning Final Report INTERNAL AUDIT October 2014 Glasgow City Council Internal Audit 1 Glasgow Life Risk Management & Business Continuity Planning Table
SOUTH LAKELAND DISTRICT COUNCIL INTERNAL AUDIT FINAL REPORT ACCOUNTING SYSTEM AND GENERAL LEDGER
SOUTH LAKELAND DISTRICT COUNCIL 12-08 INTERNAL AUDIT FINAL REPORT ACCOUNTING SYSTEM AND GENERAL LEDGER Executive Summary Introduction The Council s Integra financial information and accounting system is
REQUEST FOR MAYORAL DECISION MD405. Title: Disaster Recovery Services
REQUEST FOR MAYORAL DECISION MD405 Title: Disaster Recovery Services Executive Summary: In May 2006, the GLA entered into an agreement with a recovery partner to offer immediate replacement IT equipment
DERBYSHIRE COUNTY COUNCIL BUSINESS CONTINUITY POLICY
DERBYSHIRE COUNTY COUNCIL BUSINESS CONTINUITY POLICY VERSION 1.0 ISSUED JULY 2015 CONTENTS Page CONTENTS VERSION CONTROL FOREWORD i ii iii POLICY 1 Scope 1 Aim and Objectives 1 Methods and Standards 1
Internal Audit Progress Report Performance and Overview Committee (19 th August 2015) Cheshire Fire Authority
Internal Audit Progress Report (19 th August 2015) Contents 1. Introduction 2. Key Messages for Committee Attention 3. Work in progress Appendix A: Risk Classification and Assurance Levels Appendix B:
Audit and Risk Committee Charter. 1. Membership of the Committee. 2. Administrative matters
Audit and Risk Committee Charter The Audit and Risk Committee (the Committee ) is a Committee of the Board established with the specific powers delegated to it under Clause 8.15 of the Company s Constitution
University of Liverpool
University of Liverpool Information Security Policy Reference Number Title CSD-003 Information Security Policy Version Number 3.0 Document Status Document Classification Active Open Effective Date 01 October
Comhairle nan Eilean Siar Internal Audit Review Project Management and Project Delivery Technical Services department. Final Report 2014/15-21
Comhairle nan Eilean Siar Internal Audit Review Project Management and Project Delivery Technical Services department Final Report 2014/15-21 4 th November 2014 PROJECT MANAGEMENT & PROJECT DELIVERY CONTENTS
Understanding SOC Reports for Effective Vendor Management. Jason T. Clinton January 26, 2016
Understanding SOC Reports for Effective Vendor Management Jason T. Clinton January 26, 2016 MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2012 Wolf & Company, P.C. Before we
Authorisation Requirements and Standards for Debt Management Firms
2013 Authorisation Requirements and Standards for Debt Management Firms 2 Contents Authorisation Requirements and Standards for Debt Management Firms Contents Chapter Part A: Authorisation Requirements
Comhairle nan Eilean Siar Internal Audit Review DISASTER RECOVERY. Final Report 12/13-20
Comhairle nan Eilean Siar Internal Audit Review Final Report 12/13-20 8 th January 2013 CONTENTS Page SECTION 1 - EXECUTIVE SUMMARY 1-3 SECTION 2 - DETAILED FINDINGS AND RECOMMENDATIONS 4-9 SECTION 3 -
North West Core Skills Programme. Information Governance Implications
North West Core Skills Programme Information Governance Implications Version number: 0.3 Author: Mike Farrell, North West Core Skills Programme Effective from: October 2012 Due for review on: October 2013
Operational Risk Publication Date: May 2015. 1. Operational Risk... 3
OPERATIONAL RISK Contents 1. Operational Risk... 3 1.1 Legislation... 3 1.2 Guidance... 3 1.3 Risk management process... 4 1.4 Risk register... 7 1.5 EBA Guidelines on the Security of Internet Payments...
IT Risk Assessment Action Plan. South Staffordshire District Council Audit 2010/11
IT Risk Assessment Action Plan South Staffordshire District Council Audit 2010/11 The Audit Commission is a public corporation set up in 1983 to protect the public purse. The Commission appoints auditors
Network Security Policy
IGMT/15/036 Network Security Policy Date Approved: 24/02/15 Approved by: HSB Date of review: 20/02/16 Policy Ref: TSM.POL-07-12-0100 Issue: 2 Division/Department: Nottinghamshire Health Informatics Service
Comhairle nan Eilean Siar Internal Audit Follow Up Review Disaster Recovery. Final Report FU18 14/15
Comhairle nan Eilean Siar Internal Audit Follow Up Review Disaster Recovery Final Report FU18 14/15 27 th May 2015 CONTENTS Page SECTION 1 - EXECUTIVE SUMMARY 1 3 SECTION 2 - DETAILED FINDINGS AND RECOMMENDATIONS
Information Technology Internal Audit Report
Information Technology Internal Audit Report Report #2014-05 July 25, 2014 Table of Contents Page Executive Summary... 3 Background Information... 4 Background... 4 Audit Objectives... 4 Scope and Testing
CyberEdge. Desired Coverages. Application Form. Covers Required. Financial Information. Company or Trading Name: Address: Post Code: Telephone:
Company or Trading Name: Address: Post Code: Telephone: E-mail: Website: Date Business Established Number of Employees Do you have a Chief Privacy Officer (or Chief Information Officer) who is assigned
Aberdeen City Council IT Security (Network and perimeter)
Aberdeen City Council IT Security (Network and perimeter) Internal Audit Report 2014/2015 for Aberdeen City Council August 2014 Internal Audit KPIs Target Dates Actual Dates Red/Amber/Green Commentary
SUMMARY OF AUDIT FINDINGS
SUMMARY OF AUDIT FINDINGS EXECUTIVE SUMMARY Citizens' Office of Internal Infrastructure - July 2010 The audit determined the overall effectiveness of the controls over the processes for the acquisition,
FINAL May 2005. Guideline on Security Systems for Safeguarding Customer Information
FINAL May 2005 Guideline on Security Systems for Safeguarding Customer Information Table of Contents 1 Introduction 1 1.1 Purpose of Guideline 1 2 Definitions 2 3 Internal Controls and Procedures 2 3.1
Publish Date: 19/06/14 Version: 1.2. Call Recording/Logging Service Level Agreement. Page: 1. Call Recording/Logging Service Level
Publish Date: 19/06/14 Version: 1.2 Page: 1 Contents 1. Scope 3 2. Service Definitions 3 3. Service Provision 3 4. Optional Service Provision Features 3 5. Hardware RMA Process 4 6. Supported Coverage
RISK MANAGEMENT AND COMPLIANCE
RISK MANAGEMENT AND COMPLIANCE Contents 1. Risk management system... 2 1.1 Legislation... 2 1.2 Guidance... 3 1.3 Risk management policy... 4 1.4 Risk management process... 4 1.5 Risk register... 8 1.6
APPENDIX C. Internal Audit Report South Holland District Council Project Management
APPENDIX C Internal Audit Report South Holland District Council Project Management Date: 20th December 2012 Contents Introduction and Scope 1 Executive Summary Assurance Opinion Key Messages 2 3 Management
Vendor Management. Outsourcing Technology Services
Vendor Management Outsourcing Technology Services Objectives Board and Senior Management Responsibilities Risk Management Program Risk Assessment Service Provider Selection Contracts Ongoing Monitoring
Strategic Alliance. Business Continuity Policy
Version 1.1 April 2016 Contents Contents Version control Foreword Policy Scope Aim and objectives Methods and standards Responsibilities Governance Training and exercises Page i ii 1 2 2 2 Version 1.1
EVALUATION REPORT. Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review. March 13, 2015 REPORT NUMBER 15-07
EVALUATION REPORT Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review March 13, 2015 REPORT NUMBER 15-07 EXECUTIVE SUMMARY Weaknesses Identified During the FY 2014
General IT Controls Audit Program
Contributed February 5, 2002 by Paul P Shotter General IT Controls Audit Program Purpose / Scope Perform a General Controls review of Information Technology (IT). The reviews
Business Continuity Management. Policy Statement and Strategy
Business Continuity Management Policy Statement and Strategy November 2011 Title Business Continuity Management Policy & Strategy Date of Publication: Cabinet Council Published by Borough Council of King
Disaster Recovery Plan
Disaster Recovery Plan This guide sets forth items to consider in the review of the firm s disaster recovery plan. You should form a committee to assess the plan and should assign activities under the
APB ETHICAL STANDARD 5 (REVISED) NON-AUDIT SERVICES PROVIDED TO AUDITED ENTITIES
APB ETHICAL STANDARD 5 (REVISED) NON-AUDIT SERVICES PROVIDED TO AUDITED ENTITIES (Revised December 2010, updated December 2011) Contents paragraph Introduction 1 4 General approach to non-audit services
Internal Audit Report Disaster Recovery / Business Continuity Planning
Audit Committee, 28 November 2013 Internal Audit Report Disaster Recovery / Business Continuity Planning Executive summary and recommendations Introduction As part of the Internal Audit Plan for 2013-14,
(NOTE: ALL BS7799 REFERENCES IN THIS DOCUMENT ARE FROM BS7799-2:1999 and SHOULD BE AMENDED TO REFLECT BS7799-2:2002)
(NOTE: ALL BS7799 REFERENCES IN THIS DOCUMENT ARE FROM BS7799-2:1999 and SHOULD BE AMENDED TO REFLECT BS7799-2:2002) 1. Approval and Authorisation Completion of the following signature blocks signifies
Disaster Recovery Checklist Disaster Recovery Plan for <System One>
Disaster Recovery Plan for SYSTEM OVERVIEW PRODUCTION SERVER HOT SITE SERVER APPLICATIONS (Use bold for Hot Site) ASSOCIATED SERVERS KEY CONTACTS Hardware Vendor System Owners Database Owner
Cloud Services Service Level Agreement. Publish Date: 30/06/14 Version: 1.2. Cloud Services Service Level Agreement Page: 1
Cloud Services Service Level Agreement Publish Date: 30/06/14 Version: 1.2 Cloud Services Service Level Agreement Page: 1 Contents 1. Scope 3 2. Service Definitions 3 3. Service Provision 3 4. Supported
This is the third and final presentation on HIPAA Security Administrative Safeguards. This presentation focuses on the last 2 standards under the
This is the third and final presentation on HIPAA Security Administrative Safeguards. This presentation focuses on the last 2 standards under the HIPAA Security rule: Contingency planning and evaluation.
ULH-IM&T-ISP06. Information Governance Board
Network Security Policy Policy number: Version: 2.0 New or Replacement: Approved by: ULH-IM&T-ISP06 Replacement Date approved: 30 th April 2007 Name of author: Name of Executive Sponsor: Name of responsible
Monitoring requirements and global quality assurance
Monitoring requirements and global quality assurance In applying for or renewing any ACCA certificate or licence, practitioners undertake to supply all information necessary to enable ACCA to carry out
Office of Inspector General
DEPARTMENT OF HOMELAND SECURITY Office of Inspector General Security Weaknesses Increase Risks to Critical United States Secret Service Database (Redacted) Notice: The Department of Homeland Security,
Information Governance Policy (incorporating IM&T Security)
(incorporating IM&T Security) ONCE PRINTED OFF, THIS IS AN UNCONTROLLED DOCUMENT. PLEASE CHECK THE INTRANET FOR THE MOST UP TO DATE COPY Target Audience: All staff employed or working on behalf of the
Version: 3.0. Effective From: 19/06/2014
Policy No: RM66 Version: 3.0 Name of Policy: Business Continuity Planning Policy Effective From: 19/06/2014 Date Ratified 05/06/2014 Ratified Business Service Development Committee Review Date 01/06/2016
How To Protect Decd Information From Harm
Policy ICT Security Please note this policy is mandatory and staff are required to adhere to the content Summary DECD is committed to ensuring its information is appropriately managed according to the
Ms. Debbie Davenport Auditor General Office of the Auditor General 2910 North 44 th Street, Suite 410 Phoenix, Arizona 85018. Dear Ms.
Janet Napolitano Governor ARIZONA DEPARTMENT OF ECONOMIC SECURITY 1717 W. Jefferson P.O. Box 6123 Phoenix, AZ 85005 David A. Berns Director Ms. Debbie Davenport Auditor General Office of the Auditor General
Business Continuity Plan
Business Continuity Plan 1 Business Continuity Plan Index 2 Introduction Emergency Contact Persons Emergency Contact Persons 7 Firm Policy Significant Business Disruptions 8 Approval and Execution Authority..8
INTERNATIONAL STANDARDS FOR THE PROFESSIONAL PRACTICE OF INTERNAL AUDITING (STANDARDS)
INTERNATIONAL STANDARDS FOR THE PROFESSIONAL PRACTICE OF INTERNAL AUDITING (STANDARDS) Introduction to the International Standards Internal auditing is conducted in diverse legal and cultural environments;
KPMG LLP Suite 12000 1801 K Street, NW Washington, DC 20006 Independent Auditors Report on Internal Control Over Financial Reporting and on Compliance and Other Matters Based on an Audit of Financial Statements
Significant Revisions to OMB Circular A-127. Section Revision to A-127 Purpose of Revision Section 1. Purpose
Significant Revisions to OMB Circular A-127 Section Revision to A-127 Purpose of Revision Section 1. Purpose Section 5. Definitions Section 6. Policy Section 7. Service Provider Requirements Section 8.
Publish Date: 30/06/14 Version: 1.2
Publish Date: 30/06/14 Version: 1.2 Page: 1 Contents 1. Scope 3 2. Service Definitions 3 3. Service Provision 3 4. Optional Service Provision Features 4 5. Hardware RMA Process 4 6. Supported Coverage
IT Assurance - Business Continuity and Disaster Recovery
Audit Summary Report October 2006 PAPER D IT Assurance - Business Continuity and Disaster Recovery Audit 2006/2007 Paper D - 1 External audit is an essential element in the process of accountability for
Harbinger Escrow Services Backup and Archiving Policy. Document version: 2.8. Harbinger Group Pty Limited Delivered on: 18 March 2008
Document version: 2.8 Issued to: Harbinger Escrow Services Issued by: Harbinger Group Pty Limited Delivered on: 18 March 2008 Harbinger Group Pty Limited, Commercial in Confidence Table of Contents 1 Introduction...
Internal Audit Standards
Internal Audit Standards Department of Public Expenditure & Reform November 2012 Copyright in material supplied by third parties remains with the authors. This includes: - the Definition of Internal Auditing
Committees Date: Subject: Public Report of: For Information Summary
Committees Audit & Risk Management Committee Finance Committee Subject: Cyber Security Risks Report of: Chamberlain Date: 17 September 2015 22 September 2015 Public For Information Summary Cyber security
ICT Policy. Executive Summary. Date of ratification Executive Team Committee 22nd October 2013. Document Author(s) Collette McQueen
ICT Policy THCCGIT20 Version: 01 Executive Summary This document defines the Network Infrastructure and File Server Security Policy for Tower Hamlets Clinical Commissioning Group (CCG). The Network Infrastructure
Head of Information & Communications Technology Responsible work team: ICT Security. Key point summary... 2
Policy Procedure Information security policy Policy number: 442 Old instruction number: MAN:F005:a1 Issue date: 24 August 2006 Reviewed as current: 11 July 2014 Owner: Head of Information & Communications
JOB DESCRIPTION CONTRACTUAL POSITION
Ref #: IT/P /01 JOB DESCRIPTION CONTRACTUAL POSITION JOB TITLE: INFORMATION AND COMMUNICATIONS TECHNOLOGY (ICT) SECURITY SPECIALIST JOB SUMMARY: The incumbent is required to provide specialized technical
AUDITING A BCP PLAN. Thomas Bronack Auditing a BCP Plan presentation Page: 1
AUDITING A BCP PLAN Thomas Bronack Auditing a BCP Plan presentation Page: 1 What are the Objectives of a Good BCP Plan Protect employees Restore critical business processes or functions to minimize the
Information security controls. Briefing for clients on Experian information security controls
Information security controls Briefing for clients on Experian information security controls Introduction Security sits at the core of Experian s operations. The vast majority of modern organisations face
B U S I N E S S C O N T I N U I T Y P L A N
B U S I N E S S C O N T I N U I T Y P L A N 1 Last Review / Update: December 9, 2015 Table of Contents Purpose...3 Background...3 Books and Records Back-up and Recovery...4 Mission Critical Systems...
INTERNATIONAL STANDARDS FOR THE PROFESSIONAL PRACTICE OF INTERNAL AUDITING (STANDARDS)
INTERNATIONAL STANDARDS FOR THE PROFESSIONAL PRACTICE OF INTERNAL AUDITING (STANDARDS) Revised: October 2012 i Table of contents Attribute Standards... 3 1000 Purpose, Authority, and Responsibility...
F I N A N C I A L R E G U L A T I O N S
F I N A N C I A L R E G U L A T I O N S South Downs National Park Authority March 2014 Page 0 of 17 F I N A N C I A L R E G U L A T I O N S Contents Page 1 INTRODUCTION Purpose of Financial Regulations
Summary of Information Technology General Control Environment Findings for the year ended 30 June 2015
Summary of Inmation Technology General Control Environment Findings the year ended 30 June 2015 1 Change management Complete Revisiting the Change Management control process documentation and updating
VENDOR MANAGEMENT. General Overview
VENDOR MANAGEMENT General Overview With many organizations outsourcing services to other third-party entities, the issue of vendor management has become a noted topic in today s business world. Vendor
Miami University. Payment Card Data Security Policy
Miami University Payment Card Data Security Policy IT Policy IT Standard IT Guideline IT Procedure IT Informative Issued by: IT Services SCOPE: This policy covers all units within Miami University that
Joint ICT Service ICT Strategy 2014-17
Document History Document Location This document is only valid on the day it was printed. The source of the document will be found in (see footer) Revision History Date of this revision: 19 th May 2014
a) To achieve an effective Quality Assurance System complying with International Standard ISO9001 (Quality Systems).
FAT MEDIA QUALITY ASSURANCE STATEMENT NOTE 1: This is a CONTROLLED Document as are all quality system files on this server. Any documents appearing in paper form are not controlled and should be checked
IT Service Management
IT Service Management Service Continuity Methods (Disaster Recovery Planning) White Paper Prepared by: Rick Leopoldi May 25, 2002 Copyright 2001. All rights reserved. Duplication of this document or extraction
Audit, Finance and Legislative Committee Mayor Craig Lowe, Chair Mayor-Commissioner Pro Tem Thomas Hawkins, Member
City of Gainesville Inter-Office Communication April 3, 2012 TO: FROM: SUBJECT: Audit, Finance and Legislative Committee Mayor Craig Lowe, Chair Mayor-Commissioner Pro Tem Thomas Hawkins, Member Brent
Mapping of outsourcing requirements
Mapping of outsourcing requirements Following comments received during the first round of consultation, CEBS and the Committee of European Securities Regulators (CESR) have worked closely together to ensure
Business Continuity (Policy & Procedure)
Business Continuity (Policy & Procedure) Publication Scheme Y/N Can be published on Force Website Department of Origin Force Operations Policy Holder Ch Supt Head of Force Ops Author Business Continuity
Outsourcing and third party access
Outsourcing and third party access This document is part of the UCISA Information Security Toolkit providing guidance on the policies and processes needed to implement an organisational information security
Colchester Institute. Supply Chain Management. Fees and Charges Policy
Colchester Institute Supply Chain Management Fees and Charges Policy Author: Director of Community Engagement and Funding Development Date of Issue: March 2015 Date of Review: March 2016 1 SUPPLY CHAIN
Huntingdonshire District Council Data Quality Audit Report 2006/07. March 2008
Huntingdonshire District Council Data Quality Audit Report 2006/07 March 2008 Corporate Governance Panel Huntingdonshire District Council Pathfinder House St Mary's Street Huntingdon Cambridgeshire PE29
Part A OVERVIEW...1. 1. Introduction...1. 2. Applicability...2. 3. Legal Provision...2. Part B SOUND DATA MANAGEMENT AND MIS PRACTICES...
Part A OVERVIEW...1 1. Introduction...1 2. Applicability...2 3. Legal Provision...2 Part B SOUND DATA MANAGEMENT AND MIS PRACTICES...3 4. Guiding Principles...3 Part C IMPLEMENTATION...13 5. Implementation
LafargeHolcim Ltd. Finance & Audit Committee Charter Review date: July 28, 2015
LafargeHolcim Ltd Finance & Audit Committee Charter Review date: July 28, 2015 1. Purpose 1.1 Mission The Finance & Audit Committee ( FAC ) is an expert committee formally appointed by the Board of Directors
LONDON BOROUGH OF HARROW. Overview & Scrutiny Committee
LONDON BOROUGH OF HARROW Meeting: Overview & Scrutiny Committee Date: 27 April 2004 Subject: Internal Audit Plan 2004/05 Key Decision: Responsible Chief Officer: No Executive Director, Business Connections
AUDIT REPORT INTERNAL AUDIT DIVISION. Audit of business continuity and disaster recovery planning at UNON
INTERNAL AUDIT DIVISION AUDIT REPORT Audit of business continuity and disaster recovery planning at UNON Overall results relating to business continuity and disaster recovery planning at UNON were initially
Caedmon College Whitby
Caedmon College Whitby Data Protection and Information Security Policy College Governance Status This policy was re-issued in June 2014 and was adopted by the Governing Body on 26 June 2014. It will be
IT SERVICE CONTINUITY AS RELATED TO THE MANAGEMENT OF ELECTRONIC RECORDS POLICY
Department of Health Government of Western Australia IT SERVICE CONTINUITY AS RELATED TO THE MANAGEMENT OF ELECTRONIC RECORDS POLICY 2004 Document Control Date Version Notes Author 10/11/2003 0.1 Initial
ADDITIONAL CONTRACTUAL TERMS RELATING TO THE PROVISION OF MANAGED SERVICES
ADDITIONAL CONTRACTUAL TERMS RELATING TO THE PROVISION OF MANAGED SERVICES ACT Document Version: 3.0 Customer Document Version: 1.0 Issue Date: XXXXXX COMMERCIAL IN CONFIDENCE Please replace this image
Information governance strategy 2014-16
Information Commissioner s Office Information governance strategy 2014-16 Page 1 of 16 Contents 1.0 Executive summary 2.0 Introduction 3.0 ICO s corporate plan 2014-17 4.0 Regulatory environment 5.0 Scope