Session 18 Question Answers

Seth Spencer

Oct. 30, 2015

Session 18 Questions

1. Who is accountable for:

1. Managing Service Agreements (APO09)? Service Manager
2. Managing Availability and Capacity (BAI04)? Head of IT operations
3. Managing Continuity (DSS04)? COO,Head of IT operations, Business continuity manager

1. In your own words, explain the COBIT 5 management practices related to a, b and c above?

1. The service Manager would need to understand what services the organization is providing and document it via catalog. This would allow the service manager to know what is expected of each of the organizations services. It also would allow the manager a reference to see if the services are doing what they are suppose to.

1. Internal Services-between IT department and other departments within the organization
2. External Services-between internet service provider and the organization

1. Managing the availability and capacity of IT is crucial because if a system gets to overloaded it could crash or operate too slow. To prevent this the Head of IT Operations would need to collect availability data and adjust the performance and capacity based on the data findings.
2. Every business needs a continuity plan. This plan lays out specifically what the organization is going to do in a worst-case scenario. For example, what the org is going to do if a natural disaster struck. This plan can include cold and hot sites for continuing operations as fast as possible.

1. Give an example of an activity for each COBIT 5 process above.

1. Internal service level agreements- between IT and other departments ex: helpdesk
2. Collection of availability data
3. Plan for dealing with a natural disaster. Possible movement to Hot/Cold site

1. What are the basic backup controls?

1. Hot/Cold Site

1. Hot Site-already have servers running and ready to go
2. Cold Site-environment is right to house servers but would still need to move servers to that location

1. Grandparent, Parent, Child for transaction data backups.
2. Offsite location that did not experience same natural disaster or is unaffected by original problem.

1. What are the basic facility controls?

1. Dual Source power- ex: battery power source, Generator Power, buried cable lines
2. Fire Protection-when to use water based (not near servers) and when to use non water based (when near servers)
3. Heat and Humidity protection and monitoring-if too hot, servers will shut down
4. Dust regulation-dust can destroy servers.

Video Notes

Service Level Agreement

Need to get an understanding of the services that we are facilitating

Build catalog and publish it

Internal service level agreements-In

External service level agreements-Internet service provider to the organization

Going to spell out what services are to be expected

Periodic reviews

Ex: look at level of satisfaction and then follow up

Managing availability and Capacity

• Need to have a managing practice
• Managing the availability and capacity of IT is crucial
• Follow up on an incidences of failed performance
• Collect availability data
• Adjust performance and capacity

Managing Continuity

• Why? Every business need to have a business continuity plan ex: companies in the midst of disaster are unaffected.
• What would we do if we were to experience natural disaster
• Need formal plan

• Scenario analysis likelihood and impact.
• Ex: hurricane Floyd
• Ex: ice storms
• How this would affect business and what procedures are we going to follow
• People need to be safe first and ability to communicate is key

• Very important if plan is tested and clear like a fire drill

Cold site

The facility has been set up to take on servers incase original location goes down