PART 4 – CISA Domain 2 – Governance and Management of IT

PART 4 – CISA Domain 2 – Governance and Management of IT

• What are the various Information Security roles and their Responsibilities?
• What is Business Continuity Planning (BCP)?
• What is Business Impact Analysis (BIA)?

• The purpose of business continuity/disaster recovery is to enable a business to continue offering critical services in the event of a disruption and to survive a disastrous interruption to activities.
• The first step in preparing a BCP is to identify the business processes of strategic importance—those key processes that are responsible for both the permanent growth of the business and for the fulfillment of the business goals
• Based on the key processes, the risk management process should begin with a risk assessment
• The result of the risk assessment should be the identification of the following:
  • • The human resources, data, infrastructure elements and other resources (including those provided by third parties) that support the key processes
    • A list of potential vulnerabilities—the dangers or threats to the organization
    • The estimated probability of the occurrence of these threats
    • The efficiency and effectiveness of existing risk mitigation controls (risk countermeasures)
• BCP is primarily the responsibility of senior management
• ISO for BCP – ISO 22301
• The IT business continuity plan should be aligned with the strategy of the organization. If the IT plan is a separate plan, it must be consistent with and support the corporate BCP.

Business Continuity policy:

• • Is a document approved by top management that defines the extent and scope of the business continuity effort (a project or an ongoing program) within the organization
  • Should be pro-active
  • Is a most critical corrective control
  • The business continuity policy serves several other purposes:
    • Its internal portion is a message to internal stakeholders (i.e., employees, management, board of directors) that the company is undertaking the effort, committing its resources and expecting the rest of the organization to do the same.
    • Its public portion is a message to external stakeholders (shareholders, regulators, authorities, etc.) that the organization is treating its obligations (e.g., service delivery, compliance) seriously. 

• Business Continuity Planning (BCP) Incident Management:
• An incident is
  • • any unexpected event, even if it causes no significant damage
    • Dynamic in nature
• Depending on an estimation of the level of damage to the organization, all types of incidents should be categorized. A classification system could include the following categories:
  • • Negligible – incidents are those causing no perceptible or significant damage
    • Minor – events are those that, while not negligible, produce no negative material (of relative importance) or financial impact
    • Major – incidents cause a negative material impact on business processes and may affect other systems, departments or even outside clients
    • Crisis – major incident that can have serious material (of relative importance) impact on the continued functioning of the business and may also adversely impact other systems or third parties.

• critical step in developing the business continuity strategy and the subsequent implementation of the risk countermeasures and BCP in particular.
• used to evaluate the critical processes (and IT components supporting them) and to determine time frames, priorities, resources and interdependencies
• Different approaches for performing BIA:
  • • Detailed questionnaire
    • Interview groups of key users
    • Bring relevant IT personnel and end users (i.e., those owning the critical processes) together in a room to come to a conclusion regarding the potential business impact of various levels of disruptions.

Part 1, Part 2, Part 3, Part 4, Part 5

AUTHOR
Aswini Srinath ( )
Writer And Editor

“ I am a qualified Chartered Accountant based out of Chennai, with 8+ years of experience in various roles in finance domain including CA Practice, financial reporting and auditing. I have always been keen to challenge myself by exploring potential capabilities outside of my core competency. Picked up Information Security as one such thing. Cleared CISA with 2nd Rank in ISACA Chennai Chapter in 2019. Since then, i have been sharing my learning and experience to a small group of avid followers, helping them prepare for their CISA exams. This article is also one such attempt, where I summarize the key areas in each domain based on the importance and weightage from an exam point of view. “