IT Governance, Risk, and Compliance » Emergency

An Ounce of Disaster Prevention is Worth a Pound of Disaster Remediation – Part IV

Robert Davis — Thu, 17 Dec 2009 19:32:13 +0000

Business volatility includes unexpected IT demand, merger and acquisition activities, as well as economic or government events. Whereby, government volatility can reflect a political event. Theoretically, adequate Continuity Management ensures the capacity to operate when a disaster or unexpected event occurs. Therefore, an IT auditor should assess whether a process exists to ensure that the monitoring of, and planning for, future capacities are done with adequate dialog and participation within the entity well in advance, and whether plans are reviewed at periodic intervals. Good capacity management ensures that the entity’s quality of service is continued at all times — even after a disaster has occurred.

“View Part I of the An Ounce of Disaster Prevention is Worth a Pound of Disaster Remediation series here“

An Ounce of Disaster Prevention is Worth a Pound of Disaster Remediation – Part III

Robert Davis — Mon, 14 Dec 2009 19:29:50 +0000

Business continuity and disaster recovery plans should follow suggested best practices for development to ensure adequate incident handling. Commonly, the primary goals of the incident management process are to restore a normal service operation as quickly as possible and to minimize the impact on business operations; thus ensuring that the best possible levels of service quality and availability are maintained.

As a sub-category, business interruption prevention plans and processes allow an entity to avoid, preclude, or limit the impact of a crisis occurring. Tasks included in such a prevention system should enable compliance with applicable laws, regulations, policies, procedures, rules and standards supporting avoidance, deterrence, and detection of potential catastrophic incidents — where incidents may encompass: local events like building fires, regional events like earthquakes, or national events like pandemic illnesses.

“View Part I of the An Ounce of Disaster Prevention is Worth a Pound of Disaster Remediation series here“

An Ounce of Disaster Prevention is Worth a Pound of Disaster Remediation – Part II

Robert Davis — Thu, 10 Dec 2009 20:49:58 +0000

Organizational resilience imposes proactive preparation for potential incidents in order to avoid suspension of critical operations and services, or if operations and services are disrupted, resuming processing as rapidly as required for those who rely on them. Typically, an IT department’s success depends upon satisfying end user processing and service requirements. Hence, IT operational resiliency should be considered an overarching organizational priority that can be resolved through disaster recovery planning efforts assisting in ensuring an entity is better prepared for crisis situations. To enable continuity in delivery of IT services in accordance with the entity’s stated objectives and goals; management should develop strategies, tactics, policies, procedures, standards and rules designed to ensure continuity of operations.

Correspondingly, other aspects of continuity planning which should also be addressed during development are the means whereby business users can be re-located and connected to standby technologies; if necessary. In addition, adequate continuity planning normally requires considering needs for: alternative voice and data communications, storing copies of important paper documents off-site as well as procedures permitting clerical processing of data until the standby service is available.

“View Part I of the An Ounce of Disaster Prevention is Worth a Pound of Disaster Remediation series here“

An Ounce of Disaster Prevention is Worth a Pound of Disaster Remediation – Part I

Robert Davis — Mon, 07 Dec 2009 19:01:08 +0000

“Attention all personnel! Attention all personnel! We are now experiencing an emergency code red condition. This requires following current crisis management procedures. Please, immediately proceed to your designated evacuation area and await further instructions…”

As we all should be aware, this type of occupational notification can occur at anytime and anyplace in the world that employees perform their assigned duties. Compounding the aforementioned scenario is the fact that some entities now rely on IT services to the extent that if key services are unavailable for a matter of hours the entity’s business can be severely affected. Substantively, this situation can manifest because it is generally impossible to fallback on manual methods, either because it is not technically feasible to substitute current procedures, or there are insufficient personnel to process the volume of work associated with a function, or employees no longer have the necessary skills to perform a key task; or a combination of these factors.

Service Restoration Planning – Part IV

Robert Davis — Mon, 19 Oct 2009 19:12:07 +0000

Considering information systems are generally critical to enhancing productivity, it is imperative deployed IT provide availability with service responsiveness meeting user utilization demands, even during crisis situations. Entity susceptibility as well as IT operational resiliency impact speedy and systematic redress for fulfilling efficiency, effectiveness, availability, and compliance requirements. Furthermore, neither business nor IT resides within static environments. Thus, environmental dynamics can generate changes altering system activities that require timely response and restoration to ensure continuous service delivery.

Whenever a natural or unnatural disaster strikes, recovering data usually is the top managerial priority for entities. Given the common, advance state of transactional processing dependence on technology, most entities’ will immediately suffer a diminished capacity for achieving operational efficiency goals, if IT is not restored in a timely manner. How expeditiously an entity resumes business processing after a tragedy normally depends on well documented and tested alternative plans for emergencies, and the velocity with which a disaster recovery site can receive back-up media and restore user services.

“View Part I of the Service Restoration Planning series here“

Service Restoration Planning – Part III

Robert Davis — Thu, 15 Oct 2009 18:32:30 +0000

Cost effective strategies should be designed to prevent, detect and/or mitigate the impact of potential crises. Reducing system vulnerabilities is typically accomplished by delineating then remediating single as well as combined configuration failure points. Various resources that can contribute to the remediation process should be identified as continuity enablement factors. These resources — including essential personnel (and their roles and responsibilities), information, applications, and infrastructure — should be documented in a plan demonstrating commitment to continuity.

Disaster recovery systems and resources should be perpetually monitored as part of the entity’s operational plans. Beneficially, monitoring designated disaster recovery systems permits accountability for configuration items crucial to reinstating business processes. Resources that will support systems mitigating emergencies should also be monitored to ensure availability and expected performance during incident or event activation.

“View Part I of the Service Restoration Planning series here“

Service Restoration Planning – Part II

Robert Davis — Mon, 12 Oct 2009 18:44:03 +0000

Business continuity has been generally defined as a comprehensive managed effort to prioritize key business processes identifying significant threats to normal operations that permit planning strategies for ensuring effective and efficient organizational responses to challenges arising during and after a crisis. Consequently, business continuity planning encompasses processes for developing advance responses to service interruptions in such a manner that critical business functions continue at expected levels. Sub-categorically, disaster recovery planning is normally ranked as a key business continuity component referring to technological aspects of advance planning and organizing necessary to minimize potential losses and ensure critical business functionality if catastrophic circumstances materialize.

“View Part I of the Service Restoration Planning series here“

Service Restoration Planning – Part I

Robert Davis — Thu, 08 Oct 2009 19:50:33 +0000

Threats to an entity’s existence manifest in diverse forms, including disruptions, emergencies, crises or disasters. Any one of these incidents or events can jeopardize data processing services sustaining mission critical operations. When business integrated information systems are unavailable, efficiency is diminished, effectiveness is eroded, compliance is hindered, and employees are idled. As a result, entities should regularly examine their business continuity, disaster recovery, as well as back-up plans to ensure adequate operational requirements forecasting for service restoration.