IT infrastructure

�        The issue of resilience

�        ISO 27031 Relationship with Information Security Management System (ISMS)

�        Datacenter and IT infrastructure

�        Operational sustainability

o   Datacenter site infrastructure tier standard

o   Elements of operational sustainability

�        Infrastructure strategy and policy

o   The strategy – how and depth

o   The policy requirements

o   Site and building protection

o   Network and information systems protection

Risk evaluation and Business Impact Analysis(BIA)

�        Site and building risk assessment

�        PESTEL analysis (Political, Economic, Sociological, Technological, Legal,Environmental)

�        Types of BIA; strategic, tactical and operational

�        Implementation methods for technology BIA

Managing recovery plans

�        Processes and procedures for supply chain management using a 3PQ (Third Party Questionnaire) approach, aligned with BSI PAS 7000

�        On and off-site data and information storage, including emergency response arrangements

�        Change management processes and procedures for day-to-day requirements

�        Risk control measures for critical supporting equipment and systems

Understanding IT disaster recovery (DR) and reviewing the main activities

�        DR lifecycle, including resources and training

�        ITDR as part of the ISMS

�        Scope of IT elements and requirements

IT disaster recovery plans

�        Building technology recovery plans

o   Plan ownership and structure, and roles and responsibilities of IT DR Team

o   Data and information sources, and internal and external dependencies

o   Best practice considerations using ISO 27301, as well as ISO 20000 and ITIL

o   Managing and recovering end-user computing and communications technology and infrastructure

o   Recovery options

�        Developing,implementing and testing

o   Ownership and plan structure

o   Roles and responsibilities of BC Champion and Team Leaders

o   Command,Coordination, Communications and Intelligence (C3i)

o   Role of the command center and essentials

o   Equipment and supporting information

o   Producing Situation Reports (SITREPS)

o   Types of testing/exercising

�        Major incident response

o   Defining an “incident” and the escalation process

o   Establishing Command, Coordination and Communications (3C)

o   Clarifying the role of the Network Operations Centre (NOC)

o   Emergency response and plan invocation

o   Consideration of the supporting information, equipment and systems required

o   Production of Situation Reports (SITREPS), activity logging and tools

�        Post incident review

o   Learning from incidents

o   The value of post-incident review

o   Post-incident process

Audit and maintenance

�        What is the function of an IT audit?

�        Steering Committee and Terms of Reference (ToR’s)

�        Overriding management review and continuous improvement

�        Incorporating DR into the organization life cycle processes and establishing virtual teams

�        DR documentation and working with internal and external audit functions