Table of Contents 1. What s New... 1

Transcription

1

2 Table of Contents Business and IT Impact Analysis Questionnaire... Impact - Risk... Scoring... 2 Facility / Business Function / Application... 3 Mandated Requirement Compliance... 4 Compliance - System of Internal Controls... 5 User Environment... 6 Operating Environment... 8 Criticality of Application...0 Processing Information...2 Application / File Servers...3 Historical Information...5 Database / File Names...6 Documentation...7 Security Refer to Security Policies and Procedures...8 Application Support and Maintenance...9 Resource Usage...20 Equipment Requirements by Department...2 Backups...22 What s New... Sections of this document were extracted from Disaster Recovery Template, Client Server Management HandiGuide, PC Policies and Procedures HandiGuide, Metric for the Internet and IT Management HandiGuide, and the IT Position Description HandiGuide which are copyrighted by M. V. Janulaitis and published by Janco Associates, Inc. These copyrighted materials remain the property of the copyright owners and the licensed user of this document is only granted a limited use license of this material. For more information, see

3 Business and IT Impact Analysis Questionnaire Impact - Risk This questionnaire 2 is the basis for documentation necessary to understand the business impact and risks associated with each physical location, business function, and IT application. A BEST PRACTICE is to complete this questionnaire for each physical location, application, business function, department, and organizational entity annually. In addition as conditions change (i.e. event like 9/) to alter the operating environment, at least the risk component should be reviewed and actions taken to mitigate unacceptable levels of risk. Once these forms are completed, a summary of the major functions with the Impact to ENTERPRISE should be prepared 3. Function Application Sales Status Inventory Metric Key User(s) Risk Score Units and Dollar Volumes On Hand Balances Executive Management Sales Distribution Sales Customer Service Corporate Offices Head Count CEO 2 Manufacturing Plant % of Finished Goods VP Manufacturing Produced Customer Data A/R Balances Credit Sales 3 Liquid Assets Treasury Balances CFO 2 Supplier A/P Balances CFO The boxes on the questionnaire that follows can be checked (or unchecked) by double clicking on the box. 3 Impact is defined as the risk the ENTERPRISE if that function or application became unavailable. Preparer: Date:

4 The purpose of this questionnaire is to determine the criticality of the applications used at ENTERPRISE. The information provided will be used to develop a Application Inventory that can be used in the Disaster Recovery Plan that minimizes the impact of the loss of this application in the event of a disaster. (PLEASE USE ADDITIONAL BLANK PAPER OR ATTACHMENTS WHEREVER NECESSARY) Facility / Business Function / Application Name: Provide a brief description/purpose mission: What are the main functions? Was this developed in-house or purchased from a vendor? If purchased from a vendor, do you hold the plans, source code etc: If the application is a purchased package, are there extensive modifications to this application (briefly describe modifications): What programming language was used to create the application? How old is this application (maturity)? Who is the owner of this application (i.e. Joe Smith of Accounting)? Preparer: Date: 3

5 Criticality of Application Continued Could you accept input without processing (i.e. data input is stored in a holding file and processed at night): N/A If so, how long can data be stored without processing before having a significant business impact? Provide the following information for each department that uses the application: Department name If down-time procedures exist for manual processing If a training program for down-time procedures exist Number of days the department can function without this application Additional resources required for manual processing (i.e. personnel, equipment, etc.) Department Name Down-time Procedures (Y/N) Training Program (Y/N) Number of Days Additional Resources Preparer: Date:

6 Application / File Servers Provide the following information for each application and file server: Host name IP address and mask for the server Administrative contact for the server and security contact (i.e. primary user or department head name and phone number) User Types Operating system including version number Application Software including version number Review status (Yes/No, Date. Reviewer) Connectivity (Internet, Intranet, modem In, modem out, other Physical location (Address / phone number for contact Host Name: Reviewer Name: Date: IP Address / Mask User Types Administrative Contact Connectivity Physical Location (mask) Public Customers Employees Groups Employees Specific Employees Name: Phone: Internet Intranet Modem In Bound Modem Out Bound Other: Address: Contact:: Phone: IP Address Range Operating System OS Version / Reviewed Application App Version / Reviewed... to... Windows WS Windows Server Unix Lynx. Other Comments: Preparer: Date: 3

7 Security Refer to Security Policies and Procedures Is there application level security? Who administers this security? Is there system-wide security software? Who administers system-wide security? Does the application meet security and sensitive information requirements? N/A Does the application meet ISO security and sensitive information requirements? N/A Does the application meet COBIT security and sensitive information requirements? N/A Does the application meet PCI-DSS security and sensitive information requirements? N/A Is this information available to social networks and BYOD? N/A Are audits done in a timely manner on social networks and BYOD? N/A Does the application meet all mandated security and sensitive information requirements (New York, Massachusetts, California and others? N/A Comments: Preparer: Date: 8

8 What s New Version 4.3 Version 4.2 Version 4. Version 4.0 Version 3.3 Version 3.2 Updated for BYOD Updated for social networks Updated to meet ISO compliance requirements Updated for mobile devices Updated for cloud Updated for outside users Updated mandated compliance requirements Updated for COBIT compliance Updated for PCI-DSS compliance Updated for US state level compliance (New York, Massachusetts, and California)\ Update for ISO security requirements Updated to be ISO Series compliance Correct minor errata Updated formatting Updated to meet ISO 7799 compliance standard Application / File Servers form was added Operating Environment was moved forward in the forms Critically of Application was moved forward in the forms