Question

Identify research specifically for risk assessment, risk management and business continuity steps that support data security and confidentiality during a disaster. Identify resources to assist in developing a disaster recovery plan. Create a business continuity plan considering the following possible disasters as a basis for discussion:

natural disasters;

terrorist attacks;

infrastructure failures;

staff disruption due to illness or work stoppages, which are especially concerning to small and medium-sized businesses with small work forces and specialized workers;

unintentional or malicious data corruption;

theft; and

breaks in the supply chain.

Include an education outline for the public and consumers on privacy, security, access to and maintenance of personal health records (PHRs), requirements and legalities before, during, and a disaster.

The business continuity plan should be 5–7 pages in length and provide details on:

Introduction of the company with high level details

Business Continuity Strategy

Recovery Teams

Recovery Procedures

Answer 1

A disaster is any sudden, unplanned calamitous event that brings about great damage or loss. Entire communities have concerns following a disaster, however, the business faces special challenges because they have responsibilities to protect the lives and livelihoods of their employees and to guard company assets on behalf of shareholders.

In the business realm, a disaster can be seen as any event that prevents the continuance of critical business functions for a predetermined period of time

*A business continuity plan is a collection of procedures and information that is developed and maintained in readiness for use in the event of an emergency or disaster.

*Business continuity planning (BCP) are preparations made to keep a business running during and after a disaster, ensuring the availability of those resources required to maintain the ongoing viability of the organization.

*Business Impact Analysis (BIA) is a management level analysis which identifies the impact of losing company resources. The BIA measures the effect of resources loss and escalating losses over time in order to provide senior management with reliable data upon which to base decisions on risk mitigation and continuity planning

*Business Impact Assessment (BIA) includes the following questions:

-How bad things get?

-What are the most important resources, systems, outputs and dependencies by business function?

-What impact does unavailability have?

*Disaster Recovery Planning (DRP) is typically, the technology aspects of a business continuity plan, to recover information system resources to full or partial production processing levels in the event of an extended outage. Normally the information system resources will be restored according to a priority indicated by what is "mission critical to the organization.

*Disclosure of sensitive information is a serious information security incident, which can result in severe embarrassment, financial loss, and even litigation, where damage has been caused to someone's reputation or financial standing. Further types of serious disclosure involve secret patient information, plans and strategic directions, research, information disclosed to legal representatives etc. Deliberate unauthorized disclosure of sensitive information is called as espionage.

BCP/DRP process includes :

*Project Initiation

*Business impact assessment

*Recovery strategy

*Plan design and development

*Implementation

*Testing

*Monitoring and maintenance

An organizations core activities generally should not be outsourced because they are what the organization does best

Many countries have enacted regulations to protect the confidentiality of information maintained in their countries and or exchanged with other countries. When a service provider outsources part of its services to another service provider, there is a potential risk that the confidentiality of the information will be compromised.

It is critical that an independent security review of an outsourcing vendor be obtained because customer credit information will be kept there.

If in case the business case was not established, it is likely that the business rationale, risk and risk mitigation strategies for outsourcing the application development were not fully evaluated and the appropriate information was not provided to senior management for formal approval. The situation presents the biggest risk to the organization.

The risk management process is about making specific,security-related decisions such as the level of acceptable risk. Identification of the assets to be protected is the first step in the development of a risk management program.

To assess IT risk, threats and vulnerabilities need to be evaluated using qualitative or quantitative risk assessment approaches.