Assignment Prompt & Instructions
Please see attachment for instructions
– a year ago
**files (3)**
– ## WK5Assignment.doc
– ## Information_Security_Fundamentals_—-_7_Disaster_Recovery_and_Business_Continuity_Planning.pdf
– Information_Security_Fundamentals_—-_8_Continuity_of_Operations_Planning.pdf
**## WK5Assignment.doc**
[removed]
**## Information_Security_Fundamentals_—-_7_Disaster_Recovery_and_Business_Continuity_Planning.pdf**
Chapter 7
Disaster Recovery and Business
Continuity Planning
Kevin McLaughlin
Contents
Introduction
Background
Developing the Contingency Policy
Business Impact Analysis
Controls and Mitigation
Government Involvement in Business Continuity and Disaster Recovery
Facilitated Business Continuity and Disaster Recovery Theory
Conclusion
References
There must be a self-regulatory process…with internal rules, as that is efficient. However,
self-regulation is not enough—you need both legislation and self-regulation.
—Bernhard Otupal
Interpol
Introduction
Organizations continue to take large-scale losses and even go out of business by not adequately
planning for large-scale disasters that affect their ability to conduct business. When a disaster hits
an area, its socioeconomic effects are compounded when the citizens of that area also end up out of
work and not receiving a paycheck. These citizens often file civil lawsuits for damages. These
lawsuits frequently cite management neglect and lack of disaster recovery (DR) planning as one of
the reasons for seeking damages. Lawsuits like this often add to the postdisaster economic distress
suffered by communities and businesses. Picou et al. (2004) stress that the negative effects of a
disaster can damage communities and their citizens for a long time after the event. These
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 1 of 7
communities struggle through postdisaster recovery and have a hard time being successful with
their postdisaster recovery efforts. One of the most negatively impactful activities that slow down
the recovery process is excessive postdisaster litigation. Although many items contribute to this
slow recovery, Picou et al. (2004) contend that “none are as debilitating as the litigation processes
that… ensue to redress” (p. 1494) the negative socioeconomic effect experienced by the members of
the community.
Due to the heinous socioeconomic effect a disaster can bring to both an organization and the
community within a geographical region when its businesses are unprepared to recover from such
an event, it is important to have necessary business continuity and DR plans in place.
Background
Many organizations voluntarily spend money and time attempting to design DR systems, processes,
and methodologies that will enable them to continue business operations in the event of a disaster.
To bring the appropriate systems up, it is important that organizations are able to contact the
resources needed and that they have methods in place to ensure that resources can actually make it
to the recovery area. Adding strong leadership roles for the responding resources is also of critical
importance for successful DR postevent recovery (Biddinger 2007). Another necessary component
of successful recovery is ensuring that information technology professionals spend time testing the
hardware and equipment needed to make sure the organization can recover business critical systems
in the time required as cited by the senior management. Before an event, organizations need to
complete a business impact analysis (BIA) so that they clearly understand which systems need to be
restored to maintain adequate enough business operations.
There is currently a dearth of government regulation that requires business entities to have robust
business continuity and DR plans, strategies, and infrastructure in place. Lacking this regulation,
organizations need to look elsewhere to determine how to plan, implement, test, and assess business
continuity and DR plans. Thankfully, there are, however, many standards in place that assist
organizations in designing effective business continuity and DR plans. The National Institute of
Standards in Technology (NIST) Special Publication (SP) 800-34 is one such standard and its book
on contingency planning outlines methodologies for organizations to follow and strongly suggest
that each organization have such plans in place so that they do not suffer unrecoverable postdisaster
loss.
In order to have an effective DR program an effective DR process framework needs to be
developed within the organization. This process framework allows an organization to put a
sustainable, repeatable and easy to follow step by step process in place for handling the
management of their DR solution. While at the University we used the following: Design and
approve the DR Policy, Conduct and Complete an organizational BIA, Develop and get buy in for
the recovery strategy as focused on the BIA results, Design the organizationally approved DR plan,
Plan and Complete training and testing, and lastly make sure that the plan is a living document that
is maintained ongoing throughout the year.
Tulane University, like many organizations in New Orleans, was prepared for an event like
Katrina but it did not have plans on how to recover from such an event and ended up missing its
August payroll run, an event that compounded the trauma that many families were already going
through (Anthes 2008). John Lawson, Vice President and Chief Information Officer (CIO) for
Tulane, stated that
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 2 of 7
We did have to face the music. We stopped paying adjuncts on August 29. We stopped
paying part-time faculty and staff members on September 30. Beginning November 1, we
began using vacation and sick leave to help pay full-time faculty and staff members (The
Chronicle of Higher Education 2005, p. B.203).
The aftermath of the Katrina disaster was tough on the communities affected and better business
continuity and DR planning would have gone a long way toward minimizing the socioeconomic
downfall that the event brought to New Orleans and its surrounding communities. It took so long
for universities in Louisiana and Missouri to recover from the aftermath of Katrina that 26,000
students in the state of Louisiana and 9,000 students in the state of Mississippi failed to return to
their schools (Marcus 2007). Two years after the event, the University of New Orleans was still
6,000 students under its pre-Katrina enrollment numbers and Loyola University was still 1,000
students under its pre-Katrina enrollment numbers. A secondary effect of this decrease in
enrollment is that 217 faculty members who lived and worked in the New Orleans community were
fired from their University positions (Marcus 2007). This means that postdisaster within their local
institutions of higher education, the community of New Orleans had 7,217 fewer consumers’
spending money and helping their community rebuild and recover its economy. In a separate
disaster event, the United States 9/11 Twin Towers attack, it was noted that for a number of months
after the event, workers in New York City experienced a decrease in the number of hours at work.
This decrease rebounded within a 6-month period, but it does confirm that a community does suffer
negative postevent economic effects (Hotchkiss and Pavlova 2004).
One of the major issues faced by organizations when they are considering business continuity
and DR strategies such as integrated automation to facilitate business continuity process
management (BCPM) and DR high availability (Lumpp et al. 2008) is the large budget that is
necessary to implement a successful business continuity and DR program. These monies are often
needed on an annual basis and they are to be spent on contingency items that might never be used.
In 2009, a lot of IT shops were facing budget shortfalls, with capital budgets being nonexistent in
many organizations. With the current economic woes, it is not uncommon for senior executives to
view redundant infrastructures as cost-doubling effort wastebaskets that they are dropping money
into but that has zero practical and likely no future use or benefit (Rice 2009). It is very difficult for
managers within an organization to spend scarce dollars for an event that might never occur.
Tulane did not have a formal DR plan for replacement of machines with any outside vendor
or institution. That was a cabinet-level decision, made during times of fiscal stress. We had
just shifted to a decentralized system for fiscal management, so IT was a shared resource.
When I presented the plan for off-site DR, it was for $300,000 a year or so. We decided that
we could not ask the deans to pay for that as they were already upset about recent budget
cuts and increased IT recharge rates. (The Chronicle of Higher Education 2005, p. B.201)
Of interest to note is that John Lawson, the CIO of Tulane, has related publicly that after Katrina,
his off-site DR plan was approved at a cost of approximately $600,000 per year, double the amount
Tulane management turned down before Katrina.
Senior managers for organizations need to understand that the infusion of technology across their
business processes makes ignoring business continuity and DR planning borderline gross neglect
(McKinney 2009). In many cases, the failure to follow all of the seven NIST SP 800-34
contingency planning steps to fully prepare for a disaster can be seen as a failure of the
organization’s senior management and lead to a civil lawsuit for damages. In some cases, this lack
of prudence by organizational management can compound events subsequent to a disaster to such
an extent that the organization is incapable of postevent recovery. In some postevent cases, we can
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 3 of 7
even go as far as to say that “managerial errors are the root causes of the technological disasters”
(Shaluf 2007, p. 387).
Developing the Contingency Policy
One of first items that information assurance/security professionals need to do to ensure that their
organization is going to take the necessary precautions to make sure that if a disaster occurs they
will be ready and prepared to recover is to develop a Business Continuity Contingency Policy. As is
true with any policy, vetting and alignment with organizational senior management is the first thing
that needs to take place. Once this approval of the policy takes place, it then needs to proceed
through an organizational governance process to ensure that proper buy-in from the affected
community members’ takes place. The activities during this time will be ongoing review, edit,
review, and finally acceptance and alignment. The vetting of organizational policies should also
make sure to include review by the organization’s general counsel. When finalizing the policy, keep
in mind that 100% alignment is not usually possible and the organizational governance process
should take that into account.
Business Impact Analysis
A discussion on BIA and a sample procedure are included in Appendix B.
Controls and Mitigation
Bergland and Pedersen (1997), in a report on the effects of safety regulation on the safety and well-
being of Norwegian fisherman, found that costly regulation induced “the individual rational
fisherman to behave in a way which increases their risks” of injury (p. 291). This behavior is caused
by a fundamental risk analysis being conducted on the part of the regulated entity. Will it cost me
more to follow the regulation than it will to suffer the accident or loss caused by a negative event?
Extrapolating that risk analysis to the area of business continuity and DR planning, it is feasible to
believe that senior business managers in other industries will conduct similar analyses. Will it cost
me more to implement the required business continuity and DR infrastructure than it would for me
to recover from a catastrophic event that may or may not occur sometime in the future? This is an
impactful question that needs to be fully considered in our current economy downtrend that is
causing organizations to pull back from IT spending and is in line with the currenteconomic trends,
which depict IT budgets trending downward instead of upward (IndustryWeek 2008).
Government Involvement in Business Continuity and Disaster
Recovery
The goal is not to eliminate the risk but to design business continuity and DR strategies that
generate more benefits to the community than the negative effect of the costs incurred (Viscusi and
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 4 of 7
Gayer 2002). This type of cost—benefit analysis and risk- versus cost-based thinking is a critical
component to consider when deciding if business continuity and DR strategies should be
implemented.
Facilitated Business Continuity and Disaster Recovery Theory
One scalable and relatively easy way to make sure that all of your business IT departments have a
successful DR plan is to leverage the understanding and capabilities of the Facilitated Risk Analysis
and Assessment Process (FRAAP) and create your DR teams and methodologies in the same
manner as the FRAAP. This includes splitting the workup among the teams, making sure each team
has one trained DR specialist/trainer who is responsible for instructing department DR personnel on
how to make use of the templates and tools associated with the organization’s DR efforts.
Conclusion
My children will live with the mistakes I make.
—Representative Zoe Lofgren
in a speech on government regulation of DR methods for the Internet
Lawsuits are also not the answer to resolving the issue of successful postdisaster recovery, and are
actually counterproductive to the goal of maintaining a stable socioeconomic climate that is ripe for
successful recovery (Picou et al. 2004). Many of the businesses that suffer a disaster do not have
the financial means to recover and continue their operations in the community, and having to pay
postdisaster settlement costs will drive them closer toward bankruptcy and not being able to
reestablish normal business operations.
Because the CIO of an organization has a fiduciary responsibility to protect corporate assets in
good times and bad times (Lumpp et al. 2008), business continuity and DR planning is the
component that has to be put in place if organizations are to remain open and viable after a disaster
strikes their geographical region. “Data recovery is now a $20 billion per year sector of IT”
(Preimesberger 2008, p. 31), which is a strong indicator that the increasing number of natural and
man-made disasters that have hit communities and the publicity generated over those events, which
discuss how many businesses failed to recover, is finally causing organizations to start
implementation of recovery plans, tools, and strategies. A lot of organizations have changed their
posture and thought process in regards to BCP and DR planning and have decided to make efforts
in this space a part of Organizational strategic planning instead of just nice to haves (Payne 2010).
A plethora of DR software and hardware are available to IT managers; tools like Ecora, Orange
Parachute, Compellent, NetApp, Xiotech, SunGuard, open source DR software from Berkeley, etc.
(Preimesberger 2008), allow organizational IT shops to create recovery plans and methodologies.
Organizations are starting to understand that developing and maintaining a comprehensive business
continuity and DR plan and supporting infrastructure is of critical importance (McKinney 2009).
The Loews Corporation, a New York–based holding company, in part because of the 9/11 disaster,
has developed multiple points of redundancy and recovery plans just in case they are affected by
future events (Mearian 2003). Similarly, the ninth item on the list of the top 10 trends in higher
education is to increase focus on planning for catastrophe and DR (Martin and Samels 2007).
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 5 of 7
There are many areas that the government can be involved in when it comes to protecting the
United States’ infrastructure and improving DR among government and private organizations. One
of these items is to assist in the development of standards, best practices, and training (Anonymous
2009). Good examples of the type of standards and best practices that governments can develop and
promote are the US Government’s NIST 800-34 Contingency Planning and the UK Government’s
ITIL Continuity Planning.
A combination of government regulation, self-regulation, government and private training of
business continuity/DR professionals, and government and private sector partnerships and
associations is necessary to minimize the negative socioeconomic effect caused by a large-scale
disaster. The partnership programs should be modeled after the Federal Emergency Management
Agency’s (FEMA) free post-9/11 integrated government and private sector training for emergency
responders across the United States (Whitworth 2006). The business continuity/DR integrated
training courses should consist of free nationwide awareness classes on why businesses need to be
worried about and prepared for a disaster affecting their ability to conduct business and the
economic effect suffered by their community when they fail to go back into business after a
disaster. Additional courses should be offered to business and IT management on the seven NIST
800-34 contingency and ITIL continuity planning steps.
References
Anonymous. (2009). Self-regulation plans polarise industry. 27The Safety and Health Practioner
(12), 8.
Anthes, G. (2008). Tulane University; following Katrina, the university’s top priority was getting
its people paid. Now its payroll system is safer than ever. 1–ComputerWorld, Special Edition
2.
Bergland, H., and Pedersen, P.A. (1997). Catch regulation and accident risk: The moral hazard of
fisheries’ management. 12, 281–291.Marine Resource Economics
Biddinger, N. (2007). The information technology role in DR and business continuity.Government
23(6), 54–56.Finance Review
The Chronicle of Higher Education. (2005). A look back at a disaster plan: What went wrong and
right. 52(16), B200–B203.The Chronicle of Higher Education
Hotchkiss, J.L., and Pavlova, O. (2004). The impact of 9/11 on hours of work in the United States.
16.Working Paper Federal Reserve Bank of Atlanta
IndustryWeek (2008, November). Capital budgets for IT hit the wall. 68.Information Technology
Lumpp, T., Schneider, J., Holtz, J., Mueller, M., Lenz, N., Biazetti, A. et al. (2008). From high
availability and DR to business continuity solutions. 47(4), 605-619.Systems Journal
Marcus, J. (2007, October 5). Katrina-hit campuses try to return to normal. Times Higher
1–2.Education
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 6 of 7
Martin, J., and Samels, J. (2007). 10 trends to watch in campus technology. The Chronicle of
53(18), B.7.Higher Education
McKinney, M. (2009). Plan before panic. 83(11), 35–38.Hospitals and Health Networks
Mearian, L. (2003). Global firms confident about DR. 37(12), 6.Computerworld
Payne, L. (2010, January). Changing security theory to security practice. 60–63.Security Magazine
Picou, J.S., Marshall, B.K., and Gill, D.A. (2004). Disaster, litigation and the corrosive
community. 82(4), 1493–1522.The University of North Carolina Press: Social Forces
Preimesberger, C. (2008, July 21). On the brink of disaster. 31–38.eWeek
Rice, J. (2009). Budget ax falls on DR. 43(2), 28.Computerworld
Shaluf, I.M. (2007). An overview on the technological disasters. 16(3), 380–390.DPM
Viscusi, W., and Gayer, T. (2002). Safety at any price? 25(3), 54–63.Regulation
Whitworth, P.M. (2006). Continuity of operation plans: Maintaining essential agency functions
when disaster strikes. 24(4), 40–63.Journal of Park and Recreation Administration
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 7 of 7
**Information_Security_Fundamentals_—-_8_Continuity_of_Operations_Planning.pdf**
This file is too large to display. [View in new window](https://www.sweetstudy.com/files/information-security-fundamentals-8-continuity-of-operations-planning-pdf-10285913)
**Information_Security_Fundamentals_—-_8_Continuity_of_Operations_Planning.pdf**
This file is too large to display. [View in new window](https://www.sweetstudy.com/files/information-security-fundamentals-8-continuity-of-operations-planning-pdf-10285913)
**## WK5Assignment.doc**
[removed]
**## Information_Security_Fundamentals_—-_7_Disaster_Recovery_and_Business_Continuity_Planning.pdf**
Chapter 7
Disaster Recovery and Business
Continuity Planning
Kevin McLaughlin
Contents
Introduction
Background
Developing the Contingency Policy
Business Impact Analysis
Controls and Mitigation
Government Involvement in Business Continuity and Disaster Recovery
Facilitated Business Continuity and Disaster Recovery Theory
Conclusion
References
There must be a self-regulatory process…with internal rules, as that is efficient. However,
self-regulation is not enough—you need both legislation and self-regulation.
—Bernhard Otupal
Interpol
Introduction
Organizations continue to take large-scale losses and even go out of business by not adequately
planning for large-scale disasters that affect their ability to conduct business. When a disaster hits
an area, its socioeconomic effects are compounded when the citizens of that area also end up out of
work and not receiving a paycheck. These citizens often file civil lawsuits for damages. These
lawsuits frequently cite management neglect and lack of disaster recovery (DR) planning as one of
the reasons for seeking damages. Lawsuits like this often add to the postdisaster economic distress
suffered by communities and businesses. Picou et al. (2004) stress that the negative effects of a
disaster can damage communities and their citizens for a long time after the event. These
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 1 of 7
communities struggle through postdisaster recovery and have a hard time being successful with
their postdisaster recovery efforts. One of the most negatively impactful activities that slow down
the recovery process is excessive postdisaster litigation. Although many items contribute to this
slow recovery, Picou et al. (2004) contend that “none are as debilitating as the litigation processes
that… ensue to redress” (p. 1494) the negative socioeconomic effect experienced by the members of
the community.
Due to the heinous socioeconomic effect a disaster can bring to both an organization and the
community within a geographical region when its businesses are unprepared to recover from such
an event, it is important to have necessary business continuity and DR plans in place.
Background
Many organizations voluntarily spend money and time attempting to design DR systems, processes,
and methodologies that will enable them to continue business operations in the event of a disaster.
To bring the appropriate systems up, it is important that organizations are able to contact the
resources needed and that they have methods in place to ensure that resources can actually make it
to the recovery area. Adding strong leadership roles for the responding resources is also of critical
importance for successful DR postevent recovery (Biddinger 2007). Another necessary component
of successful recovery is ensuring that information technology professionals spend time testing the
hardware and equipment needed to make sure the organization can recover business critical systems
in the time required as cited by the senior management. Before an event, organizations need to
complete a business impact analysis (BIA) so that they clearly understand which systems need to be
restored to maintain adequate enough business operations.
There is currently a dearth of government regulation that requires business entities to have robust
business continuity and DR plans, strategies, and infrastructure in place. Lacking this regulation,
organizations need to look elsewhere to determine how to plan, implement, test, and assess business
continuity and DR plans. Thankfully, there are, however, many standards in place that assist
organizations in designing effective business continuity and DR plans. The National Institute of
Standards in Technology (NIST) Special Publication (SP) 800-34 is one such standard and its book
on contingency planning outlines methodologies for organizations to follow and strongly suggest
that each organization have such plans in place so that they do not suffer unrecoverable postdisaster
loss.
In order to have an effective DR program an effective DR process framework needs to be
developed within the organization. This process framework allows an organization to put a
sustainable, repeatable and easy to follow step by step process in place for handling the
management of their DR solution. While at the University we used the following: Design and
approve the DR Policy, Conduct and Complete an organizational BIA, Develop and get buy in for
the recovery strategy as focused on the BIA results, Design the organizationally approved DR plan,
Plan and Complete training and testing, and lastly make sure that the plan is a living document that
is maintained ongoing throughout the year.
Tulane University, like many organizations in New Orleans, was prepared for an event like
Katrina but it did not have plans on how to recover from such an event and ended up missing its
August payroll run, an event that compounded the trauma that many families were already going
through (Anthes 2008). John Lawson, Vice President and Chief Information Officer (CIO) for
Tulane, stated that
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 2 of 7
We did have to face the music. We stopped paying adjuncts on August 29. We stopped
paying part-time faculty and staff members on September 30. Beginning November 1, we
began using vacation and sick leave to help pay full-time faculty and staff members (The
Chronicle of Higher Education 2005, p. B.203).
The aftermath of the Katrina disaster was tough on the communities affected and better business
continuity and DR planning would have gone a long way toward minimizing the socioeconomic
downfall that the event brought to New Orleans and its surrounding communities. It took so long
for universities in Louisiana and Missouri to recover from the aftermath of Katrina that 26,000
students in the state of Louisiana and 9,000 students in the state of Mississippi failed to return to
their schools (Marcus 2007). Two years after the event, the University of New Orleans was still
6,000 students under its pre-Katrina enrollment numbers and Loyola University was still 1,000
students under its pre-Katrina enrollment numbers. A secondary effect of this decrease in
enrollment is that 217 faculty members who lived and worked in the New Orleans community were
fired from their University positions (Marcus 2007). This means that postdisaster within their local
institutions of higher education, the community of New Orleans had 7,217 fewer consumers’
spending money and helping their community rebuild and recover its economy. In a separate
disaster event, the United States 9/11 Twin Towers attack, it was noted that for a number of months
after the event, workers in New York City experienced a decrease in the number of hours at work.
This decrease rebounded within a 6-month period, but it does confirm that a community does suffer
negative postevent economic effects (Hotchkiss and Pavlova 2004).
One of the major issues faced by organizations when they are considering business continuity
and DR strategies such as integrated automation to facilitate business continuity process
management (BCPM) and DR high availability (Lumpp et al. 2008) is the large budget that is
necessary to implement a successful business continuity and DR program. These monies are often
needed on an annual basis and they are to be spent on contingency items that might never be used.
In 2009, a lot of IT shops were facing budget shortfalls, with capital budgets being nonexistent in
many organizations. With the current economic woes, it is not uncommon for senior executives to
view redundant infrastructures as cost-doubling effort wastebaskets that they are dropping money
into but that has zero practical and likely no future use or benefit (Rice 2009). It is very difficult for
managers within an organization to spend scarce dollars for an event that might never occur.
Tulane did not have a formal DR plan for replacement of machines with any outside vendor
or institution. That was a cabinet-level decision, made during times of fiscal stress. We had
just shifted to a decentralized system for fiscal management, so IT was a shared resource.
When I presented the plan for off-site DR, it was for $300,000 a year or so. We decided that
we could not ask the deans to pay for that as they were already upset about recent budget
cuts and increased IT recharge rates. (The Chronicle of Higher Education 2005, p. B.201)
Of interest to note is that John Lawson, the CIO of Tulane, has related publicly that after Katrina,
his off-site DR plan was approved at a cost of approximately $600,000 per year, double the amount
Tulane management turned down before Katrina.
Senior managers for organizations need to understand that the infusion of technology across their
business processes makes ignoring business continuity and DR planning borderline gross neglect
(McKinney 2009). In many cases, the failure to follow all of the seven NIST SP 800-34
contingency planning steps to fully prepare for a disaster can be seen as a failure of the
organization’s senior management and lead to a civil lawsuit for damages. In some cases, this lack
of prudence by organizational management can compound events subsequent to a disaster to such
an extent that the organization is incapable of postevent recovery. In some postevent cases, we can
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 3 of 7
even go as far as to say that “managerial errors are the root causes of the technological disasters”
(Shaluf 2007, p. 387).
Developing the Contingency Policy
One of first items that information assurance/security professionals need to do to ensure that their
organization is going to take the necessary precautions to make sure that if a disaster occurs they
will be ready and prepared to recover is to develop a Business Continuity Contingency Policy. As is
true with any policy, vetting and alignment with organizational senior management is the first thing
that needs to take place. Once this approval of the policy takes place, it then needs to proceed
through an organizational governance process to ensure that proper buy-in from the affected
community members’ takes place. The activities during this time will be ongoing review, edit,
review, and finally acceptance and alignment. The vetting of organizational policies should also
make sure to include review by the organization’s general counsel. When finalizing the policy, keep
in mind that 100% alignment is not usually possible and the organizational governance process
should take that into account.
Business Impact Analysis
A discussion on BIA and a sample procedure are included in Appendix B.
Controls and Mitigation
Bergland and Pedersen (1997), in a report on the effects of safety regulation on the safety and well-
being of Norwegian fisherman, found that costly regulation induced “the individual rational
fisherman to behave in a way which increases their risks” of injury (p. 291). This behavior is caused
by a fundamental risk analysis being conducted on the part of the regulated entity. Will it cost me
more to follow the regulation than it will to suffer the accident or loss caused by a negative event?
Extrapolating that risk analysis to the area of business continuity and DR planning, it is feasible to
believe that senior business managers in other industries will conduct similar analyses. Will it cost
me more to implement the required business continuity and DR infrastructure than it would for me
to recover from a catastrophic event that may or may not occur sometime in the future? This is an
impactful question that needs to be fully considered in our current economy downtrend that is
causing organizations to pull back from IT spending and is in line with the currenteconomic trends,
which depict IT budgets trending downward instead of upward (IndustryWeek 2008).
Government Involvement in Business Continuity and Disaster
Recovery
The goal is not to eliminate the risk but to design business continuity and DR strategies that
generate more benefits to the community than the negative effect of the costs incurred (Viscusi and
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 4 of 7
Gayer 2002). This type of cost—benefit analysis and risk- versus cost-based thinking is a critical
component to consider when deciding if business continuity and DR strategies should be
implemented.
Facilitated Business Continuity and Disaster Recovery Theory
One scalable and relatively easy way to make sure that all of your business IT departments have a
successful DR plan is to leverage the understanding and capabilities of the Facilitated Risk Analysis
and Assessment Process (FRAAP) and create your DR teams and methodologies in the same
manner as the FRAAP. This includes splitting the workup among the teams, making sure each team
has one trained DR specialist/trainer who is responsible for instructing department DR personnel on
how to make use of the templates and tools associated with the organization’s DR efforts.
Conclusion
My children will live with the mistakes I make.
—Representative Zoe Lofgren
in a speech on government regulation of DR methods for the Internet
Lawsuits are also not the answer to resolving the issue of successful postdisaster recovery, and are
actually counterproductive to the goal of maintaining a stable socioeconomic climate that is ripe for
successful recovery (Picou et al. 2004). Many of the businesses that suffer a disaster do not have
the financial means to recover and continue their operations in the community, and having to pay
postdisaster settlement costs will drive them closer toward bankruptcy and not being able to
reestablish normal business operations.
Because the CIO of an organization has a fiduciary responsibility to protect corporate assets in
good times and bad times (Lumpp et al. 2008), business continuity and DR planning is the
component that has to be put in place if organizations are to remain open and viable after a disaster
strikes their geographical region. “Data recovery is now a $20 billion per year sector of IT”
(Preimesberger 2008, p. 31), which is a strong indicator that the increasing number of natural and
man-made disasters that have hit communities and the publicity generated over those events, which
discuss how many businesses failed to recover, is finally causing organizations to start
implementation of recovery plans, tools, and strategies. A lot of organizations have changed their
posture and thought process in regards to BCP and DR planning and have decided to make efforts
in this space a part of Organizational strategic planning instead of just nice to haves (Payne 2010).
A plethora of DR software and hardware are available to IT managers; tools like Ecora, Orange
Parachute, Compellent, NetApp, Xiotech, SunGuard, open source DR software from Berkeley, etc.
(Preimesberger 2008), allow organizational IT shops to create recovery plans and methodologies.
Organizations are starting to understand that developing and maintaining a comprehensive business
continuity and DR plan and supporting infrastructure is of critical importance (McKinney 2009).
The Loews Corporation, a New York–based holding company, in part because of the 9/11 disaster,
has developed multiple points of redundancy and recovery plans just in case they are affected by
future events (Mearian 2003). Similarly, the ninth item on the list of the top 10 trends in higher
education is to increase focus on planning for catastrophe and DR (Martin and Samels 2007).
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 5 of 7
There are many areas that the government can be involved in when it comes to protecting the
United States’ infrastructure and improving DR among government and private organizations. One
of these items is to assist in the development of standards, best practices, and training (Anonymous
2009). Good examples of the type of standards and best practices that governments can develop and
promote are the US Government’s NIST 800-34 Contingency Planning and the UK Government’s
ITIL Continuity Planning.
A combination of government regulation, self-regulation, government and private training of
business continuity/DR professionals, and government and private sector partnerships and
associations is necessary to minimize the negative socioeconomic effect caused by a large-scale
disaster. The partnership programs should be modeled after the Federal Emergency Management
Agency’s (FEMA) free post-9/11 integrated government and private sector training for emergency
responders across the United States (Whitworth 2006). The business continuity/DR integrated
training courses should consist of free nationwide awareness classes on why businesses need to be
worried about and prepared for a disaster affecting their ability to conduct business and the
economic effect suffered by their community when they fail to go back into business after a
disaster. Additional courses should be offered to business and IT management on the seven NIST
800-34 contingency and ITIL continuity planning steps.
References
Anonymous. (2009). Self-regulation plans polarise industry. 27The Safety and Health Practioner
(12), 8.
Anthes, G. (2008). Tulane University; following Katrina, the university’s top priority was getting
its people paid. Now its payroll system is safer than ever. 1–ComputerWorld, Special Edition
2.
Bergland, H., and Pedersen, P.A. (1997). Catch regulation and accident risk: The moral hazard of
fisheries’ management. 12, 281–291.Marine Resource Economics
Biddinger, N. (2007). The information technology role in DR and business continuity.Government
23(6), 54–56.Finance Review
The Chronicle of Higher Education. (2005). A look back at a disaster plan: What went wrong and
right. 52(16), B200–B203.The Chronicle of Higher Education
Hotchkiss, J.L., and Pavlova, O. (2004). The impact of 9/11 on hours of work in the United States.
16.Working Paper Federal Reserve Bank of Atlanta
IndustryWeek (2008, November). Capital budgets for IT hit the wall. 68.Information Technology
Lumpp, T., Schneider, J., Holtz, J., Mueller, M., Lenz, N., Biazetti, A. et al. (2008). From high
availability and DR to business continuity solutions. 47(4), 605-619.Systems Journal
Marcus, J. (2007, October 5). Katrina-hit campuses try to return to normal. Times Higher
1–2.Education
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 6 of 7
Martin, J., and Samels, J. (2007). 10 trends to watch in campus technology. The Chronicle of
53(18), B.7.Higher Education
McKinney, M. (2009). Plan before panic. 83(11), 35–38.Hospitals and Health Networks
Mearian, L. (2003). Global firms confident about DR. 37(12), 6.Computerworld
Payne, L. (2010, January). Changing security theory to security practice. 60–63.Security Magazine
Picou, J.S., Marshall, B.K., and Gill, D.A. (2004). Disaster, litigation and the corrosive
community. 82(4), 1493–1522.The University of North Carolina Press: Social Forces
Preimesberger, C. (2008, July 21). On the brink of disaster. 31–38.eWeek
Rice, J. (2009). Budget ax falls on DR. 43(2), 28.Computerworld
Shaluf, I.M. (2007). An overview on the technological disasters. 16(3), 380–390.DPM
Viscusi, W., and Gayer, T. (2002). Safety at any price? 25(3), 54–63.Regulation
Whitworth, P.M. (2006). Continuity of operation plans: Maintaining essential agency functions
when disaster strikes. 24(4), 40–63.Journal of Park and Recreation Administration
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 7 of 7
**Information_Security_Fundamentals_—-_8_Continuity_of_Operations_Planning.pdf**
This file is too large to display. [View in new window](https://www.sweetstudy.com/files/information-security-fundamentals-8-continuity-of-operations-planning-pdf-10285913)
**## WK5Assignment.doc**
[removed]
**## Information_Security_Fundamentals_—-_7_Disaster_Recovery_and_Business_Continuity_Planning.pdf**
Chapter 7
Disaster Recovery and Business
Continuity Planning
Kevin McLaughlin
Contents
Introduction
Background
Developing the Contingency Policy
Business Impact Analysis
Controls and Mitigation
Government Involvement in Business Continuity and Disaster Recovery
Facilitated Business Continuity and Disaster Recovery Theory
Conclusion
References
There must be a self-regulatory process…with internal rules, as that is efficient. However,
self-regulation is not enough—you need both legislation and self-regulation.
—Bernhard Otupal
Interpol
Introduction
Organizations continue to take large-scale losses and even go out of business by not adequately
planning for large-scale disasters that affect their ability to conduct business. When a disaster hits
an area, its socioeconomic effects are compounded when the citizens of that area also end up out of
work and not receiving a paycheck. These citizens often file civil lawsuits for damages. These
lawsuits frequently cite management neglect and lack of disaster recovery (DR) planning as one of
the reasons for seeking damages. Lawsuits like this often add to the postdisaster economic distress
suffered by communities and businesses. Picou et al. (2004) stress that the negative effects of a
disaster can damage communities and their citizens for a long time after the event. These
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 1 of 7
communities struggle through postdisaster recovery and have a hard time being successful with
their postdisaster recovery efforts. One of the most negatively impactful activities that slow down
the recovery process is excessive postdisaster litigation. Although many items contribute to this
slow recovery, Picou et al. (2004) contend that “none are as debilitating as the litigation processes
that… ensue to redress” (p. 1494) the negative socioeconomic effect experienced by the members of
the community.
Due to the heinous socioeconomic effect a disaster can bring to both an organization and the
community within a geographical region when its businesses are unprepared to recover from such
an event, it is important to have necessary business continuity and DR plans in place.
Background
Many organizations voluntarily spend money and time attempting to design DR systems, processes,
and methodologies that will enable them to continue business operations in the event of a disaster.
To bring the appropriate systems up, it is important that organizations are able to contact the
resources needed and that they have methods in place to ensure that resources can actually make it
to the recovery area. Adding strong leadership roles for the responding resources is also of critical
importance for successful DR postevent recovery (Biddinger 2007). Another necessary component
of successful recovery is ensuring that information technology professionals spend time testing the
hardware and equipment needed to make sure the organization can recover business critical systems
in the time required as cited by the senior management. Before an event, organizations need to
complete a business impact analysis (BIA) so that they clearly understand which systems need to be
restored to maintain adequate enough business operations.
There is currently a dearth of government regulation that requires business entities to have robust
business continuity and DR plans, strategies, and infrastructure in place. Lacking this regulation,
organizations need to look elsewhere to determine how to plan, implement, test, and assess business
continuity and DR plans. Thankfully, there are, however, many standards in place that assist
organizations in designing effective business continuity and DR plans. The National Institute of
Standards in Technology (NIST) Special Publication (SP) 800-34 is one such standard and its book
on contingency planning outlines methodologies for organizations to follow and strongly suggest
that each organization have such plans in place so that they do not suffer unrecoverable postdisaster
loss.
In order to have an effective DR program an effective DR process framework needs to be
developed within the organization. This process framework allows an organization to put a
sustainable, repeatable and easy to follow step by step process in place for handling the
management of their DR solution. While at the University we used the following: Design and
approve the DR Policy, Conduct and Complete an organizational BIA, Develop and get buy in for
the recovery strategy as focused on the BIA results, Design the organizationally approved DR plan,
Plan and Complete training and testing, and lastly make sure that the plan is a living document that
is maintained ongoing throughout the year.
Tulane University, like many organizations in New Orleans, was prepared for an event like
Katrina but it did not have plans on how to recover from such an event and ended up missing its
August payroll run, an event that compounded the trauma that many families were already going
through (Anthes 2008). John Lawson, Vice President and Chief Information Officer (CIO) for
Tulane, stated that
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 2 of 7
We did have to face the music. We stopped paying adjuncts on August 29. We stopped
paying part-time faculty and staff members on September 30. Beginning November 1, we
began using vacation and sick leave to help pay full-time faculty and staff members (The
Chronicle of Higher Education 2005, p. B.203).
The aftermath of the Katrina disaster was tough on the communities affected and better business
continuity and DR planning would have gone a long way toward minimizing the socioeconomic
downfall that the event brought to New Orleans and its surrounding communities. It took so long
for universities in Louisiana and Missouri to recover from the aftermath of Katrina that 26,000
students in the state of Louisiana and 9,000 students in the state of Mississippi failed to return to
their schools (Marcus 2007). Two years after the event, the University of New Orleans was still
6,000 students under its pre-Katrina enrollment numbers and Loyola University was still 1,000
students under its pre-Katrina enrollment numbers. A secondary effect of this decrease in
enrollment is that 217 faculty members who lived and worked in the New Orleans community were
fired from their University positions (Marcus 2007). This means that postdisaster within their local
institutions of higher education, the community of New Orleans had 7,217 fewer consumers’
spending money and helping their community rebuild and recover its economy. In a separate
disaster event, the United States 9/11 Twin Towers attack, it was noted that for a number of months
after the event, workers in New York City experienced a decrease in the number of hours at work.
This decrease rebounded within a 6-month period, but it does confirm that a community does suffer
negative postevent economic effects (Hotchkiss and Pavlova 2004).
One of the major issues faced by organizations when they are considering business continuity
and DR strategies such as integrated automation to facilitate business continuity process
management (BCPM) and DR high availability (Lumpp et al. 2008) is the large budget that is
necessary to implement a successful business continuity and DR program. These monies are often
needed on an annual basis and they are to be spent on contingency items that might never be used.
In 2009, a lot of IT shops were facing budget shortfalls, with capital budgets being nonexistent in
many organizations. With the current economic woes, it is not uncommon for senior executives to
view redundant infrastructures as cost-doubling effort wastebaskets that they are dropping money
into but that has zero practical and likely no future use or benefit (Rice 2009). It is very difficult for
managers within an organization to spend scarce dollars for an event that might never occur.
Tulane did not have a formal DR plan for replacement of machines with any outside vendor
or institution. That was a cabinet-level decision, made during times of fiscal stress. We had
just shifted to a decentralized system for fiscal management, so IT was a shared resource.
When I presented the plan for off-site DR, it was for $300,000 a year or so. We decided that
we could not ask the deans to pay for that as they were already upset about recent budget
cuts and increased IT recharge rates. (The Chronicle of Higher Education 2005, p. B.201)
Of interest to note is that John Lawson, the CIO of Tulane, has related publicly that after Katrina,
his off-site DR plan was approved at a cost of approximately $600,000 per year, double the amount
Tulane management turned down before Katrina.
Senior managers for organizations need to understand that the infusion of technology across their
business processes makes ignoring business continuity and DR planning borderline gross neglect
(McKinney 2009). In many cases, the failure to follow all of the seven NIST SP 800-34
contingency planning steps to fully prepare for a disaster can be seen as a failure of the
organization’s senior management and lead to a civil lawsuit for damages. In some cases, this lack
of prudence by organizational management can compound events subsequent to a disaster to such
an extent that the organization is incapable of postevent recovery. In some postevent cases, we can
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 3 of 7
even go as far as to say that “managerial errors are the root causes of the technological disasters”
(Shaluf 2007, p. 387).
Developing the Contingency Policy
One of first items that information assurance/security professionals need to do to ensure that their
organization is going to take the necessary precautions to make sure that if a disaster occurs they
will be ready and prepared to recover is to develop a Business Continuity Contingency Policy. As is
true with any policy, vetting and alignment with organizational senior management is the first thing
that needs to take place. Once this approval of the policy takes place, it then needs to proceed
through an organizational governance process to ensure that proper buy-in from the affected
community members’ takes place. The activities during this time will be ongoing review, edit,
review, and finally acceptance and alignment. The vetting of organizational policies should also
make sure to include review by the organization’s general counsel. When finalizing the policy, keep
in mind that 100% alignment is not usually possible and the organizational governance process
should take that into account.
Business Impact Analysis
A discussion on BIA and a sample procedure are included in Appendix B.
Controls and Mitigation
Bergland and Pedersen (1997), in a report on the effects of safety regulation on the safety and well-
being of Norwegian fisherman, found that costly regulation induced “the individual rational
fisherman to behave in a way which increases their risks” of injury (p. 291). This behavior is caused
by a fundamental risk analysis being conducted on the part of the regulated entity. Will it cost me
more to follow the regulation than it will to suffer the accident or loss caused by a negative event?
Extrapolating that risk analysis to the area of business continuity and DR planning, it is feasible to
believe that senior business managers in other industries will conduct similar analyses. Will it cost
me more to implement the required business continuity and DR infrastructure than it would for me
to recover from a catastrophic event that may or may not occur sometime in the future? This is an
impactful question that needs to be fully considered in our current economy downtrend that is
causing organizations to pull back from IT spending and is in line with the currenteconomic trends,
which depict IT budgets trending downward instead of upward (IndustryWeek 2008).
Government Involvement in Business Continuity and Disaster
Recovery
The goal is not to eliminate the risk but to design business continuity and DR strategies that
generate more benefits to the community than the negative effect of the costs incurred (Viscusi and
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 4 of 7
Gayer 2002). This type of cost—benefit analysis and risk- versus cost-based thinking is a critical
component to consider when deciding if business continuity and DR strategies should be
implemented.
Facilitated Business Continuity and Disaster Recovery Theory
One scalable and relatively easy way to make sure that all of your business IT departments have a
successful DR plan is to leverage the understanding and capabilities of the Facilitated Risk Analysis
and Assessment Process (FRAAP) and create your DR teams and methodologies in the same
manner as the FRAAP. This includes splitting the workup among the teams, making sure each team
has one trained DR specialist/trainer who is responsible for instructing department DR personnel on
how to make use of the templates and tools associated with the organization’s DR efforts.
Conclusion
My children will live with the mistakes I make.
—Representative Zoe Lofgren
in a speech on government regulation of DR methods for the Internet
Lawsuits are also not the answer to resolving the issue of successful postdisaster recovery, and are
actually counterproductive to the goal of maintaining a stable socioeconomic climate that is ripe for
successful recovery (Picou et al. 2004). Many of the businesses that suffer a disaster do not have
the financial means to recover and continue their operations in the community, and having to pay
postdisaster settlement costs will drive them closer toward bankruptcy and not being able to
reestablish normal business operations.
Because the CIO of an organization has a fiduciary responsibility to protect corporate assets in
good times and bad times (Lumpp et al. 2008), business continuity and DR planning is the
component that has to be put in place if organizations are to remain open and viable after a disaster
strikes their geographical region. “Data recovery is now a $20 billion per year sector of IT”
(Preimesberger 2008, p. 31), which is a strong indicator that the increasing number of natural and
man-made disasters that have hit communities and the publicity generated over those events, which
discuss how many businesses failed to recover, is finally causing organizations to start
implementation of recovery plans, tools, and strategies. A lot of organizations have changed their
posture and thought process in regards to BCP and DR planning and have decided to make efforts
in this space a part of Organizational strategic planning instead of just nice to haves (Payne 2010).
A plethora of DR software and hardware are available to IT managers; tools like Ecora, Orange
Parachute, Compellent, NetApp, Xiotech, SunGuard, open source DR software from Berkeley, etc.
(Preimesberger 2008), allow organizational IT shops to create recovery plans and methodologies.
Organizations are starting to understand that developing and maintaining a comprehensive business
continuity and DR plan and supporting infrastructure is of critical importance (McKinney 2009).
The Loews Corporation, a New York–based holding company, in part because of the 9/11 disaster,
has developed multiple points of redundancy and recovery plans just in case they are affected by
future events (Mearian 2003). Similarly, the ninth item on the list of the top 10 trends in higher
education is to increase focus on planning for catastrophe and DR (Martin and Samels 2007).
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 5 of 7
There are many areas that the government can be involved in when it comes to protecting the
United States’ infrastructure and improving DR among government and private organizations. One
of these items is to assist in the development of standards, best practices, and training (Anonymous
2009). Good examples of the type of standards and best practices that governments can develop and
promote are the US Government’s NIST 800-34 Contingency Planning and the UK Government’s
ITIL Continuity Planning.
A combination of government regulation, self-regulation, government and private training of
business continuity/DR professionals, and government and private sector partnerships and
associations is necessary to minimize the negative socioeconomic effect caused by a large-scale
disaster. The partnership programs should be modeled after the Federal Emergency Management
Agency’s (FEMA) free post-9/11 integrated government and private sector training for emergency
responders across the United States (Whitworth 2006). The business continuity/DR integrated
training courses should consist of free nationwide awareness classes on why businesses need to be
worried about and prepared for a disaster affecting their ability to conduct business and the
economic effect suffered by their community when they fail to go back into business after a
disaster. Additional courses should be offered to business and IT management on the seven NIST
800-34 contingency and ITIL continuity planning steps.
References
Anonymous. (2009). Self-regulation plans polarise industry. 27The Safety and Health Practioner
(12), 8.
Anthes, G. (2008). Tulane University; following Katrina, the university’s top priority was getting
its people paid. Now its payroll system is safer than ever. 1–ComputerWorld, Special Edition
2.
Bergland, H., and Pedersen, P.A. (1997). Catch regulation and accident risk: The moral hazard of
fisheries’ management. 12, 281–291.Marine Resource Economics
Biddinger, N. (2007). The information technology role in DR and business continuity.Government
23(6), 54–56.Finance Review
The Chronicle of Higher Education. (2005). A look back at a disaster plan: What went wrong and
right. 52(16), B200–B203.The Chronicle of Higher Education
Hotchkiss, J.L., and Pavlova, O. (2004). The impact of 9/11 on hours of work in the United States.
16.Working Paper Federal Reserve Bank of Atlanta
IndustryWeek (2008, November). Capital budgets for IT hit the wall. 68.Information Technology
Lumpp, T., Schneider, J., Holtz, J., Mueller, M., Lenz, N., Biazetti, A. et al. (2008). From high
availability and DR to business continuity solutions. 47(4), 605-619.Systems Journal
Marcus, J. (2007, October 5). Katrina-hit campuses try to return to normal. Times Higher
1–2.Education
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 6 of 7
Martin, J., and Samels, J. (2007). 10 trends to watch in campus technology. The Chronicle of
53(18), B.7.Higher Education
McKinney, M. (2009). Plan before panic. 83(11), 35–38.Hospitals and Health Networks
Mearian, L. (2003). Global firms confident about DR. 37(12), 6.Computerworld
Payne, L. (2010, January). Changing security theory to security practice. 60–63.Security Magazine
Picou, J.S., Marshall, B.K., and Gill, D.A. (2004). Disaster, litigation and the corrosive
community. 82(4), 1493–1522.The University of North Carolina Press: Social Forces
Preimesberger, C. (2008, July 21). On the brink of disaster. 31–38.eWeek
Rice, J. (2009). Budget ax falls on DR. 43(2), 28.Computerworld
Shaluf, I.M. (2007). An overview on the technological disasters. 16(3), 380–390.DPM
Viscusi, W., and Gayer, T. (2002). Safety at any price? 25(3), 54–63.Regulation
Whitworth, P.M. (2006). Continuity of operation plans: Maintaining essential agency functions
when disaster strikes. 24(4), 40–63.Journal of Park and Recreation Administration
Peltier, Thomas R.. Information Security Fundamentals, Auerbach Publishers, Incorporated, 2013. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1375200.
Created from apus on 2025-05-08 02:22:41.
Copyright © 2013. Auerbach Publishers, Incorporated. All rights reserved. Ebook pages 144-152 | Printed page 7 of 7
**Information_Security_Fundamentals_—-_8_Continuity_of_Operations_Planning.pdf**
This file is too large to display. [View in new window](https://www.sweetstudy.com/files/information-security-fundamentals-8-continuity-of-operations-planning-pdf-10285913)