Drp

DRP

Disaster Recovery Planning

A

disaster recovery plan (DRP) — often referred to synonymously as a business continuity plan (BCP) — is a comprehensive set of measures and procedures put into place within an organization to ensure that essential, mission critical resources and infrastructures are maintained or backed up by alternatives during various stages of a disaster.

DRP must address three areas:  Prevention

(pre-disaster): The pre-planning required — using mirrored servers for mission critical systems, maintaining hot sites, training disaster recovery personnel — to minimize the overall impact of a disaster on systems and resources.  Continuity (during a disaster): The process of maintaining core, mission-critical systems and resource "skeletons" (the bare minimum assets required to keep an organization in operational status) and/or initiating secondary hot sites during a disaster..  Recovery (post-disaster): The steps required for the restoration of all systems and resources to full, normal operational status. Organizations can cut down on recovery time by subscribing to quick-ship programs (third-party service providers who can deliver preconfigured replacement systems to any location within a fixed timeframe).

 Provides a greater sense of security.  Ensures a certain level of system and

resource

stability during a disaster.  Minimizes system downtime and recovery time.  Minimizes the risk of permanent loss of core assets or the entire organization.  Minimizes confusion during a disaster.  Minimizes the amount of decision-making during a high-stress time when emotions will be running high.  Provides a platform in which to simulate various disaster recovery scenarios.  Ensures the reliability of secondary systems such as hot sites and server

So, why a DRP? They protect an organization in many ways

The

specialised nature of information systems (IS) auditing, and the skills necessary to perform such audits, require standards that apply specifically to IS auditing. One of the goals of the Information Systems Audit and Control Association (ISACA) is to advance globally applicable standards to meet this need

Auditing

The framework for the IS Auditing Standards provides multiple levels of guidance:  Standards define mandatory requirements for IS auditing and reporting.  Guidelines provide guidance in applying IS Auditing Standards. The IS auditor should consider them in determining how to achieve implementation of the standards, use professional judgment in their application and be prepared to justify any departure.  Procedures provide examples of procedures an IS auditor might follow in an audit engagement. Procedures should not be considered inclusive of any proper procedures and tests or exclusive of other procedures and tests that are reasonably directed to obtain the same results

Scope and Authority of IS Auditing Standards