Contingency Planning
Information Security contingency plans are very important for firms operating in today's world, where cyber security is a top issue a result of business's technological and digital dependence. This paper will discuss the planning steps, possible recovery options, and recommended testing requirements needed to support a successful business contingency/continuity of operations environment. Included will be recommendations for a proposed 24-month cycle business contingency testing plan, what should be tested and how the test should be conducted. Critical corporate assets will be ranked with the type of testing (i.e. plan reviews, tabletop exercises and backup recovery tests). Costs associated with the recommended testing process will also be taken into consideration, including personnel, equipment and production costs.
Planning Steps
Step 1 is to examine the organization of the IS department. An IS department should be organized in order to guard against an attack, blackout or any other natural or man-made disaster that can impact the integrity of information related to a business's procedures and processes. The purpose of a contingency plan/continuity of operations environment is to ensure that the hierarchy of structure (including hardware, software, work teams, management and crews involved in supervision) are able to conduct business fluidly and without interruption while maintaining safety of data through secure networks and storage devices. This requires a high degree of diligent oversight, supported by weekly assessments, made routine according to a standardized formula that incorporates analysis of the latest development in technology, threats, and safety issues related to cyber security. Advisory notices should be directed towards proper personnel within the IS department, so that individual staff members are alerted to any adjustments that require attention; and the department should organize itself into teams or squads consisting of a threat recognition team, a problem solving team, an info/data gathering team, a specs squad, a systems design unit, and a maintenance/review squad.
Once the IS department is organized, it can proceed to Step 2: risk assessment and business impact assessment. The purpose of each is to analyze the impact that a disruption can have on the organization and how to mitigate it (Vacca, 2009). Stakeholders in the organization (including but not limited to: directors, board members, employees, creditors, government advisors/agencies, owners, unions, and suppliers) must be called upon to assess the drivers that propel the firm forward and that are indispensible to the business's smooth operation. Drivers are the core components/strategies that offer real value to the organization, such as intellectual property or operations of data -- and once these are determined and rated, the organization can perceive how much time, energy, and available resources should be directed towards ensuring that the driver is supported and backed-up should a disaster strike. As Bahan (2003) indicates, it is the top priority of managers overseeing the business impact assessment to determine a top-down arrangement of drivers that require immediate support and are, therefore, first in line to be restored to working order in an infrastructure collapse event.
The risk assessment development can then proceed: it is accomplished by identifying risks to operational facilities based on precedent as well as potential threats that are currently at large (this is why a department team should be assigned to threat identification). Stemming the impact of potential disasters via risk management is a necessary step in any contingency/continuity of operations plan. The more potential disasters that can be averted ahead of time, the better (Haes, Grembergen, 2009).
Recovery Options
A recovery option is only as effective as the organization's ability to maintain communication lines in the event of a disaster. Therefore, a contingency plan as well as a continuity of operations plan must consider how a communications strategy that will enable the business to stay online in terms of connectivity between stakeholders (i.e., suppliers, supply chain managers, directors, consumers, clients, etc.). Recovery options are available for a range of scenarios for a range of business types. Selecting the right option will depend on the type of business being conducted and the type of disaster being prepared for. Strategic continuity software can be purchased by any business from a number of distributers/producers who specialize in supporting organizations in recovery type situations. Ponemon Institute and companies like Symantec are leaders in the industry of helping firms to identify their recovery needs (cyber security options include utilizing a data breach risk calculator, which helps in the risk management stage identified above, and which can be used to help the firm develop its recovery plan). Other recovery...
The management at Stickley Furniture revealed that the demand for their products tends to increase during the first and third quarters, whereas it reveals descendant trends throughout the second and fourth quarters. Given these fluctuations then, the organizational leaders have striven to develop a level production plan that ensures steady output and steady labor force. The plan sees that "during the second and fourth quarters, excess output goes into
Change Management Audit While technology and information systems are there in order to make management much more efficient, these systems may also expose an organizations to various risks which might often be serious in nature. These risks increase when changes are brought about in an existing system. In order to minimize such risks it is important that organizations have a change management plan, which is duly audited and tested for compliance
Scale Emergency Exercise Full Scale Emerency Exercise The objective of this study is evaluate the requirements in a full scale emergency. Emergency response has been at issue for many years. Formerly the agency known as civil defense is now known as the Emergency Management Agency or EMA in local counties of each state. On the federal level the agency appointed to respond to full scale emergencies is known as FEMA. Response Doctrine According to
Protection for employees If employees adhere to the rules of the acceptable use policy, there are less liable to questionable issues. This also prevents them from engaging in hazardous internet issues, for instance, they are less likely to disclose their contacts to crackers using social engineering approaches. Moreover, ABBA should settle on using universal guidelines and principles with respect to network security, it risk assessment, risk analysis, and risk management. In
Protections for hardware, software, and data resources. (American Health Information Management Association, 2011, paraphrased) V. Legal and Ethical Issues Security professionals are held responsible for understanding the legal and ethical aspects of information security including crimes, investigation of computer crimes and specifically it is stated that certified security professionals "…are morally and legally held to a higher standard of ethical conduct." (U.S. Department of Health and Human Services, 2011) There are four
Threats due to weather include floods, earthquakes, hurricanes, tornadoes and blizzards. Planning for weather events should be very realistic in nature. Major weather events usually occur in 25, 50 and 100-year cycles. Disease outbreaks are also a big threat. A potential flu pandemic could be detrimental to many businesses. For example, the bird flu pandemic scenarios that are floating around are being modeled on the Spanish flu pandemic of
Our semester plans gives you unlimited, unrestricted access to our entire library of resources —writing tools, guides, example essays, tutorials, class notes, and more.
Get Started Now