In last week’s board meeting, GSC management formally praised the ongoing efforts in IT governance. During the discussion, however, the following statement was made: “With our increasing strategic dependence on IT and the new resources we are using on the IT governance effort, has anyone considered what happens if IT was to go down? Do we have a back-up plan?” Judy Harmon, CIO, assured the board that a disaster recovery and continuity plan did exist, but that she was not prepared to give any details. She promised to give a full update at the next board meeting.
Assignment
Computer systems and the data they use are highly valuable resources for a business. Although insurance may cover the loss of these assets, recovery of the systems and data may have a long-term or even fatal effect on the business. To avoid a nonrecoverable situation, an organization must have a plan in place for disaster recovery and a solid plan to ensure the business can continue to operate in the event of a disaster. These plans are contained in the Disaster Recovery and Business Continuity Policies section of the IT Governance Policies and Procedures Manual.
The following tasks are to be completed before adding the new content for Week 4:
• Update the IT Governance Policies and Procedures Manual title page with a new date and project name.
• Update the previously completed sections based on your instructor’s feedback.
For this assignment, you will complete the Disaster Recovery and Business Continuity Policies section of your manual for your selected organization. The Disaster Recovery and Business Continuity Policies section should address how your organization will analyze the risks of disaster and how it will protect its valuable IT assets. The policies will also define how the organization will recover from a disaster, should one occur.
The project deliverables are as follows:
• Disaster Recovery and Business Continuity Policies
o Identify the primary disaster risks that could damage or destroy IT assets, including computer systems, software, and data.
o Develop a set of policies that will ensure the safety of the IT assets in the event of the identified disaster risks occurring.
o Establish procedures that will allow the business to continue operation in the event of any of the identified disaster risks.
o Perform a risk analysis to justify the cost of protection and disaster recovery measures versus potential financial damage to the business.
