Revision from last week  Assumptions are potential failure points in a project. They need to be monitored and managed. At the start of the project they should be noted, and used as input for the risk assessment.  If new assumptions evolve, they should be treated in the same manner.  The priority of the Assumption and the priority of the risk should be the same.

Revision from last week  To carry out a risk analysis you must:  identify your assets  identify the threats to these assets  consider probability  estimate your losses  consider safeguards to put in place  do a cost benefit analysis  develop a plan,  and finally put this plan into action.

Evaluate the impact of critical systems on business continuity When creating a disaster recovery plan, business impact statement and business continuity plan, the first step is to understand which parts of a business are critical for operation

What is a critical business system? A system is critical for a commercial organisation if its failure results directly or indirectly in loss of life (for example, an air traffic control system) and/or major financial loss. When developing a disaster recovery plan (DRP) it is essential to identify critical systems and ensure they are restored as soon as possible.

Identifying critical systems and data You will need to collect information about how the system uses:  software  hardware  networks (voice and data)  data  facilities (chairs, tables projectors etc).

An example of critical assessment Consider the critical systems on your personal computer at home. Assess whether the following situations make your systems critical or not. 1. You are working late on a 50-page assignment that must be handed in by 9 30am the next day otherwise you will fail the course. 2. You are using the Internet to book a holiday you intend taking in three months time. 3. You have developed a spreadsheet to calculate your tax return. 4. You have created a database of CDs, records, tapes and videos which you will need to show your insurance company if the collection is destroyed or stolen. 5. You have saved several versions of your favourite computer game. Activity-1 Activity-1

Table 1: Levels of critical systems Item Critical assessment You are working late on a 50- page assignment that must be handed in by 9 30am the next day otherwise you will fail the course. 2. You are using the Internet to book a holiday you intend taking in three months time. 3. You have developed a spreadsheet to calculate your tax return. 4. You have created a database of CDs, records, tapes and videos which you will need to show your insurance company if the collection is destroyed or stolen. 5. You have saved several versions of your favourite computer game.

Table 1: Levels of critical systems Item Critical assessment 1 Critical until 9:30am and then not critical 2 Not critical 3 Critical when completing tax return 4 Critical if event occurs 5 Not critical 1. You are working late on a 50- page assignment that must be handed in by 9 30am the next day otherwise you will fail the course. 2. You are using the Internet to book a holiday you intend taking in three months time. 3. You have developed a spreadsheet to calculate your tax return. 4. You have created a database of CDs, records, tapes and videos which you will need to show your insurance company if the collection is destroyed or stolen. 5. You have saved several versions of your favourite computer game.  Activity-2

Critical systems/data assessment forms Before starting work on the DRP all critical systems must be identified and documented. Users and management complete critical systems/data assessment forms with the guidance of IT staff. Once completed, they form an integral part of the system documentation.

examples of software form Q.1 Which application software do you normally use and how often? Form 1: Reviewing software used SoftwareConstantlyFrequently A few times a day A few times a week Rarely

Example of data used or created by the system System Name:____________________________ Q.2 What types of data activity do you carry out with each system and where does the source data originate? Show as a percentage of total time. System Name: Update corporate data files Create own data files Create shared documents Create own temporary documents Create own longer-term documents From source documents From source documents From other data files From other data files From irrecoverable sources such as telephone calls From irrecoverable sources such as telephone calls Developed at the workstation such as report writing Developed at the workstation such as report writing Other – specify

Impact of system failure When undertaking risk analysis and disaster planning, it is usual to focus on critical systems, software and data. 1. When assessing the impact on a business it is usual to consider the financial impact. 2. There may also be an impact on cash flow 3. If systems are regularly down or slow then customers may eventually go elsewhere

Statutory and business requirements Statutory and commercial requirements must be considered when assessing the impact of a system failure. The Act governing the Australian financial industry promotes financial soundness, stability and appropriate risk management.

The End Activity-3