Business continuity and disaster recovery planning (DR/BC) is something Strategic Directions have been helping clients with for over 14 years.

The importance for organisations to ensure they have appropriate recovery provisions for not only natural disasters but Power Failures, IT Software Failure, Human Error and Hardware Failure is critical – you need to have a plan to deal with all levels of disruption.

In such an event, companies need to not just look at the loss of data, revenue, IT services but reputation with employees, suppliers and customers.

All organisations have experienced some form of disaster, but it is those organisations that have a current DR/BC plan in place that deal with these effectively, reducing the impact to business operations, staff and customers.

The cost to business caused by potential disasters can be devastating, but worse is having to explain how this has happened to people affected, your staff, business partners and most importantly customers.

Five Questions to Ask Yourself?

Can you locate your DR/BC Plan?
What are your aspects of critical service and how quickly must they be recovered
Customer Services (Phone, Email)
Employee Services (Distribution, File Access)
Team Responsibilities (Who is in your DR Team)
Communication Assets (What is your plan dealing with media?)
Are you certain your data is protected, recoverable, assessable and what is your data recovery time?

Vendor Independent with local skills and global knowledge Strategic Directions are happy to discuss your DR/BC plan to see if it will ensure the impact on your business is acceptable in the event of a disaster.

Cloud Computing Challenges – the experts all agree – plan carefully and avoid unnecessary pain!

A recent look at Cloud commentators around the world – confirmed what we at Strategic Directions already knew. (Eureka!!)

3 Internationally respected (but totally unrelated) Cloud Forum Organisations all agreed that one of the major concerns to customers when moving to the cloud was:-

Lack of resources and expertise                          (Open Cirrus :-  www.opencirrus.org )

Lack of resources and expertise                         (Cloud Tweaks :- www.cloudtweaks.com )

People and Processes                                           (Forbes Technology Council :- www.forbes.com )

The internationally regarded Forbes Technology Council comments “it’s critical not to get caught up in the hype….do proper planning.” Forbes offers firsthand insights on technology and business from elite CIOs, CTOs and other executives. They asked some of their senior members to identify challenges they thought a business might have to overcome when moving its operations to the cloud. This is what the executives (all from different organisations) had to say:-

• Getting the solution right from a myriad of options
• People and processes
• Having a defined Strategy and associated Business Objectives
• Getting over the psychological barriers (trusting your decision)
• Time, cost and security challenges
• Not getting caught up in the hype
• Change Management issues (as with any major IT Project)
• Dependable technological infrastructure
• Accurately estimating the true costs of service
• Avoid too much modification or customisation
• One of the biggest challenges is translating your security posture to the cloud environment
• The financial model – plan wisely!
• Connecting legacy systems – they are most often not “cloud ready”

We note a very interesting point here !  The vast majority of the concerns identified have nothing to do with the actual technology!

This is not to demean Cloud solutions – the benefits are well known – merely to emphasise the “associated” issues that any organisation needs to be aware of, but which are often “lost in the translation.”

Other challenges identified by Open Cirrus included the lack of standards, different terminologies between vendors, lack of clear guidelines regarding the operations of cloud providers. Also, they note, bringing hybrid cloud infrastructure into the mix has made it even harder for organisations to determine the best choice.

The bottom line is – get objective advice and guidance before “setting sail” upon uncharted waters!

Mandatory Disclosure and Statutory Notification a wakeup call for Business – November 2017

Recent news articles have highlighted the seriousness with which the Federal Government is treating Data Breaches affecting Australian organisations.

This follows hot on the heels of the recent announcement that the Federal Government is planning to invest up to $140 m into an “industry led” cooperative research centre focussing on cybersecurity.  https://www.itnews.com.au/news/govt-industry-invest-140m-for-cybersecurity-crc-473948

The government has just released a draft of the statement it expects organisations to file if they suffer a data breach after February 2018. Under laws passed last year, organisations will have to report a data breach as soon as practicable, including its severity, the type of breach (financials, government and tax details and other “sensitive” information), and the estimated harm to those impacted.  The OAIC (Office of the Australian Information Commissioner) will collect and publish statistics in connection with the scheme, with a view to reviewing this approach 12 months after the scheme’s commencement. Comment on the draft statement is accepted until 23^rd October this year. https://www.itnews.com.au/news/govt-reveals-data-breach-notification-format-474360?utm_source=mobile&utm_medium=linkedin&utm_campaign=share

AGC Networks Australia recently hosted a group of C-Level executives to discuss the upcoming requirements. Concerns that were identified relating to this new Legislation included:-

1. What to do to comply with the new requirements
2. The extent of the data they are expected to collect
3. Defining “breach vs compromise” and what exactly constitutes “serious harm”
4. Agreement that Cyber Security is not just an IT risk – it is a Business risk and a Board risk

In the end, the discussion group agreed that the following actions needed attention in the future:-

1. While focus on the notification process is important, organisations need to focus on prevention in the first place….
2. Contracts and Service Agreements need review in consideration of the legislation….
3. Incident management plans are vital, but this is part of the cyber security strategy and prevention is still the first step…..

https://www.linkedin.com/pulse/data-breach-mandatory-disclosure-your-organisation-ready-heywood/?trackingId=xCohzCdujy2Fo7rBjwZaag%3D%3D

These recent initiatives underline the fact that cyber security is no longer associated only with military, government or large corporate targets. All organisations are at risk, and must proactively consider the security and privacy of their ICT services and the customer / supplier information they manage.

A crucial part of any organisation’s strategic plan MUST recognise the very real threat of cyber-attack, including prevention in the first instance, ongoing management and monitoring, and recovery once a legitimate breach has been identified.