Disaster Recovery Homework

Front 1

Developing a solid disaster recovery plan require the support and participation of which of the following?

Back 1

upper-level managers, directors of all functional departments, corporate security, managers of all business units

Front 2

All policies and procedures in the disaster recovery plan must be designed to do which of the following?

Back 2

Support critical needs of business operations, comply with all relevant laws and regulations, and be understood by parties responsible for implementing them

Front 3

The disaster recovery function is comprised of which of the following?

Back 3

The people, departments, and support organizations that implement the disaster recovery plan and facilitate disaster recovery

Front 4

During a business impact analysis, business processes are ranked as

Back 4

critical, essential, necessary, and desirable

Front 5

How many basic steps are in the disaster recovery plan?

Back 5

8

Front 6

When an organization's products are diverse or widely distributed geographically, _____________

Back 6

more business unit or product managers are require to oversee business operations

Front 7

Assessing an organization's risks requires time-consuming, detailed analysis that is based on a realistic understanding of all the environmental, economic, social, and political conditions in which the organizaiton, its suppliers, and its customers operate

Back 7

True

Front 8

The chain of command and managers responsible for declaring, responding to, and recovering from a disaster must be clearly delineated and documented in the disaster recovery plan

Back 8

True

Front 9

The steps involved in developing a disaster recovery plan are not interrelated and do not build upon each other

Back 9

false

Front 10

The role of each department and outside support organization does not need to be delineated or documented in the disaster recovery plan

Back 10

False

Front 11

The disaster recovery system must facilitiate and allow control of communications among decision-makers, managers, and staff, as well as with external support organizations, law enforcement, emergency services, and media

Back 11

True

Front 12

Disaster recovery policies and procedures do not need to be available to department managers, and staff at all times during disaster response and recovery

Back 12

false

Front 13

Two people should act as co-leaders for the disaster planning team to maintain momentum and continuity if one of the leaders is unavailable

Back 13

true

Front 14

Not all employees involved in disaster response and recovery need training to implement documented procedures or address unanticipated problems

Back 14

false

Front 15

Disaster recovery procedures must be tested and rehearsed to determine their weaknesses, and the results of these evaluations should be used to modify the procedures

Back 15

true

Front 16

During disaster response and recovery, the mental health of employees is not an important consideration

Back 16

false

Front 17

Building a solid disaster recovery plan takes less than a month

Back 17

false

Front 18

When an organization has multiple locations, it must identify local departments and employees who will participate in disaster recovery planning

Back 18

true

Front 19

Why is it helpful for management and all members of the DRP team to understand the steps for developing a plan, including how the steps build upon each other and fit together as a whole?

Back 19

When team members understand where they are in the process they will be less frustrated by what many people consider being a very long and tedious process

Front 20

Why should the disaster recovery team establish a schedule of activities?

Back 20

When teams work without schedules or deadlines projects tend to flounder and may not get the attention that they need

Front 21

23. What is the difference between disaster recovery policies and disaster recovery procedures?

Back 21

: Disaster recovery policies are the guidelines that govern the development of disaster recovery procedures. Specific disaster recovery procedures are step-by-step methods designed to restore an organizational function or business process

Front 22

24. What is the purpose of a disaster recovery rehearsal?

Back 22

The full-scale rehearsal is the best way to determine weaknesses and make adjustments in procedures and the roles and responsibilities of departments, support organizations, and individuals.

Front 23

25. Why does the IT and network management department play a key role in disaster recovery planning?

Back 23

Most organizations are highly dependent on their computer systems and communications networks.

Front 24

1. What steps make it easier to successfully change an organization or implement an enterprise-wide initiative

Back 24

: It is easier when the top managers support the effort

Front 25

2. Who should brief executives on the disaster recovery planning effort

Back 25

The coordinator of the disaster recovery planning team should be responsible for briefing executives on the planning effort.

Front 26

3. How will executive support for disaster recovery planning affect the planning effort?

Back 26

: It will help to illustrate their importance to the organization.

Front 27

4. Every department in the enterprise needs to be represented on the disaster recovery planning team

Back 27

true

Front 28

5. Departmental disaster recovery planners should not work with their corporate planning team, but carry out an independent effort

Back 28

false

Front 29

6. Disaster recovery planners should determine if their team is missing any important skills, and then fill the gaps as necessary

Back 29

true

Front 30

7. All members of the disaster recovery planning team should take responsibility for researching planning issues that directly affect their own departments

Back 30

True

Front 31

8. Very few organizations need outside help at any stage of their disaster recovery planning

Back 31

false

Front 32

9. An organization does not need to build awareness of its disaster recovery planning efforts early in the process, because it can always be done later

Back 32

false

Front 33

10. How can an organization’s size, geographic distribution, and business processes affect the disaster recovery planning effort?

Back 33

it can increase the complexity of the process as well as how much time it takes to develop the plan

Front 34

11. Any statement that an executive makes regarding an organization’s disaster recovery planning should be ___________.

Back 34

short and to the point

Front 35

12. Within an organization, who is responsible for briefing the board of directors about disaster recovery planning?

Back 35

executives are responsible for briefing the board of directors on their organization's disaster recovery planning efforts

Front 36

13. Explain why disaster recovery planners must work within the structure of the organization for which the plan is being developed

Back 36

because orgnaizations can have very different management structures, philosophies, and organization cultures.

Front 37

14. What role should the Public Relations Department have during the early stages of disaster recovery planning?

Back 37

The PR department should work to develop and launch an awareness campaign

Front 38

15. Why should key public relations personnel and legal counsel work with executives before the executives make statements about disaster recovery planning?

Back 38

so the executives will know what type of issues they should address as well as how to respond to questions.

Front 39

16. Explain how to keep executive champions interested in disaster recovery planning

Back 39

provide them with positive things to say about the process

Front 40

17. Organizations need which of the following to successfully implement a disaster recovery plan

Back 40

the support of all employees in an organization

Front 41

The major obstacle to training a disaster recovery planning team is

Back 41

getting all members together at one time, getting them to focus, and finding a secluded place to hold training so team members are not distracted by day-to-day tasks

Front 42

19. Explain two important skills that a disaster recovery planning coordinator should have. Explain how these skills will help the coordinator and the team accomplish their goals

Back 42

project management skills, and experience

Front 43

Purpose of an activity log

Back 43

reference tool to track events and provide incumbent as well new disaster recovery planning staff, departmental representatives, and departmental disaster recovery planning groups with an overview of events

Front 44

Explain the benefits of forming interdepartmental subcommittees for disaster recovery planning

Back 44

Interdepartmental disaster recovery planning subcommittee typically address problems that don't need full attention of the disaster recovery planning team.

Front 45

explain the benefits of forming interdepartmental subcommittees for disaster recovery planning

Back 45

interdepartmental disaster recovery planning subcommittee typically address problems that do not need the full attention of the disaster recovery planning team and require expertise that disaster recovery planning team members may not possess

Front 46

Explain how the central IT and network management functions can help departmental planning groups achieve their goals for disaster recovery planning

Back 46

advise cost of potential recovery alternatives, help the departmental disaster recovery planning groups better understand the technology challenges that must be overcome to operate in temporary quarters and to later completely recover their operations, provide specific technical support or documentation

Front 47

What factors influence salaries of full-time disaster recovery planners?

Back 47

Location, years of experience, and related certifications

Front 48

24. Explain why the budget structure for centralized offices of disaster recovery planning differs from that of part-time coordinators

Back 48

there are usually fewer staff and less overhead associated with part time disaster recovery coordinator. Part time coordinators have other repsonsibilities and already have office, computer, and telephone already in place

Front 49

What major activities should the planning team accomplish during step one of disaster recoveyr planning?

Back 49

Executive level champion identified, disaster recovery planning coordinator should be appointed to manage the day-to-day efforts of the disaster recovery planning team and coordinator should be provided resources to accomplish the development of the plan, the disaster recovery planning team should be in place and funcioning4) Departments should have identified and staffed their disaster recovery planning groups. 5) The skill base of the enterprise disaster recovery planning team and department groups should be assessed. 6) Training to round out the skills or the staff working on the disaster recovery plan should have been conducted. 7) If outside help is necessary a consultant should be identified and selected. 8) A schedule for the work of the disaster recovery planning team should be developed. 9) An internal awareness should have been kicked off.

Front 50

The key to successfully measuring the likelihood of threats being realized is

Back 50

obtain data from as many sources as possible

Front 51

WHat types of systems are installed systems

Back 51

computer networks, telephone systems, fire prevention systems, and premise security systems

Front 52

What information does the light equipment exposure inventory sheet provide?

Back 52

: A list all of the light equipment in each building, the number of units, the purpose of the equipment, and the facility or building where the equipment is duplicated and includes tools, cleaning and maintenance equipment, and emergency equipment.

Front 53

4. Explain why risk assessment is the fundamental building block of disaster recovery planning, and why future steps in the planning process and successful disaster recovery depend on it

Back 53

Accurate data about assets, business process, and potential risks is necessary to develop a solid disaster recovery plan

Front 54

5. Explain why financial requirements may affect the necessity to quickly recover a specific business process

Back 54

Many organizations do not have sufficient cash reserves to absorb the cost or the potential loss caused by disruptions in operations.

Front 55

6. Explain what an exposure inventory is

Back 55

An annotated list of all facilities, processes, systems, and resources that an organization depends on to maintain operations and sustain revenue.

Front 56

7. What is the purpose of the facility exposure inventory overview sheet?

Back 56

It is designed to keep track of the detailed exposure inventories needed for each facility.

Front 57

8. What is the purpose of the heavy equipment exposure inventory sheet?

Back 57

: It lists all of the heavy equipment in each building, the number of units, the purpose of the equipment, and the facility or building where the equipment is duplicated.

Front 58

9. What are the five key goals of a typical product-focused organization?

Back 58

Revenue collection, product sales, product distribution, product manufacturing, and the procurement of materials, parts, and supplies necessary to support the processes.

Front 59

10. What are the five key goals of a typical service-focused organization

Back 59

Revenue collection, service sales, service delivery, maintaining the service platform, and the procurement of materials, parts, and supplies necessary to support the processes.

Front 60

11. What information does a business process inventory illustrate?

Back 60

1.) How a process works. 2.) The facilities/buildings in which the process occurs in. 3.) The department(s), which perform the process. 4.) The personnel that work in the department(s). 5.) The equipment used by the department(s). 6.) The installed systems that the department(s) rely upon. 7.) The information technology that the department(s) have in place. 8.) The parts and supplies that the department(s) need to accomplish their work.

Front 61

12. The scope of exposure inventory has nothing to do with the size of the organization, the number of employees, or the number of locations

Back 61

: False

Front 62

13. The physical facilities exposure inventory sheet should be filled out only for very large buildings.

Back 62

false

Front 63

14. The personnel exposure inventory sheet should only cover employees who have worked for the organization for more than five years, because they are the most critical employees

Back 63

false

Front 64

15. The information technology exposure inventory sheet only lists mainframes and servers.

Back 64

false

Front 65

16. Legal requirements or government regulations do not affect a disaster recovery plan

Back 65

false

Front 66

17. When a business process spans more than one department, how can the disaster recovery planning team determine how the business process actually works?

Back 66

Representatives from each department need to collaborate to create the business process map. Staff from the facilities management, information technology, telecommunications, and security departments can also assist the department representatives in developing a business process inventory.

Front 67

18. Why should business process inventory sheets be maintained for each facility or each group of related facilities in the business process?

Back 67

: To provide details on the process and which faculties, buildings, and departments support the process as well as the resources required to accomplish the process.

Front 68

19. Why is it necessary to know which resources are required to support each business process?

Back 68

These requirements show the resources necessary to support a business process and what type of physical facilities, personnel, heavy equipment, light equipment, installed systems, information technology, and office equipment required will be needed to recover operations.

Front 69

20. What information does the business process threat mitigation sheet provide?

Back 69

Details of the actions that have been take or the systems that are in place to reduce the impact of potential threats to an business process as well as specific potential threats to personnel, heavy equipment, light equipment, installed systems, information technology, office equipment, and products or parts necessary to support the business process.

Front 70

21. What is the purpose of a risk assessment report?

Back 70

A risk assessment report describes an asset that is exposed to risk, the risk that threaten that asset, and the effectiveness of systems in place that are designed to mitigate that risk. The report ends with a recommendation of what type of procedures should be included in the disaster recovery plan.

Front 71

22. What factors influence the format and length of a risk assessment report?

Back 71

The complexity of the assets or business process for which the assessment is being performed, the type of mitigation steps that have been taken to reduce impact of events, and the nature and variety of risks involved

Front 72

23. When compiling a risk assessment report, what should the authors do to make it a more valuable tool?

Back 72

1.) The report should be written in manner that makes it easy to read by a variety of people with different knowledge and skill levels. 2.) The executive summary should be brief and to the point. 3.) The table of contents should be complete and list all sections and exhibits in the report. 4.) The narrative sections should clearly identify which supporting sheets, forms, or reports were used to support the narrative. 5.) If photocopies are used in the exhibits the copies should clear and readable.

Front 73

24. Why should risk assessment reports be treated as confidential material?

Back 73

The report may include proprietary information on business process, market conditions and positions, manufacturing procedures, and IT security.

Front 74

25. Under what conditions should people outside an organization have access to a risk assessment report

Back 74

The reports should not be circulated outside the organization unless there are nondisclosure documents signed by the parties that receive the copies of the reports.

Front 75

1. What types of requirements or pressures can organizations face when deciding how to prioritize business processes and facilities for disaster recovery?

Back 75

: Legal/regulatory requirements, contractual requirements, labor union contract requirements, competitive pressures, financial pressures, humanitarian or social expectations, and management mandates.

Front 76

2. What potential consequences do organizations face if they fail to comply with disaster recovery requirements or expectations?

Back 76

: Legal/regulatory requirements: Loss of license or permits, government investigations, fines, criminal charges, or other penalties as prescribed by law. Contractual requirements: Loss of business, penalties for late delivery, or civil litigation. Labor union contract requirements: Labor disputes, walkouts, strikes, or civil litigation. Competitive pressures: Loss of business, loss of major customers, or loss of market share. Financial pressures: Prolonged loss of revenue, shift in cash positions, or required borrowing of funds. Humanitarian or social expectations: Damaged reputation, class action lawsuits, or civil litigation. Management mandates: Board or stockholder actions against management, termination of managers.

Front 77

3. When the disaster recovery planning team is ranking business processes and requires consensus building to agree on the rankings, what should the planning coordinator do

Back 77

The disaster recovery coordinator should make a comprehensive list of all of the business process and facilities that are described in the inventories risk assessment reports. The department representatives should be provided with sufficient time to take the list back to their department and rank all of the processes or facilities from their perspective. The list should be returned to the disaster recovery coordinator prior to the disaster recovery team meeting so the coordinator can compile the results and write a brief report for the team to review.

Front 78

4. When departments present opposing views about prioritizing business recovery processes, what should their presentations cover?

Back 78

: Introduction and definition of business process, Existing requirements that impact recovery needs (if applicable), Department position on recovery priority, Supporting data or material for department position, Summary or department position, Final recommendation on all business process rankings.

Front 79

5. What are critical systems and functions?

Back 79

Those that absolutely must be in place for any business process to continue at all.

Front 80

6. What are essential systems and functions?

Back 80

: Those that must be in place to support day-to-day operations.

Front 81

7. What are necessary systems and functions?

Back 81

Those that contribute to smooth operations and comfortable working conditions for employees.

Front 82

8. What are desirable systems and functions?

Back 82

Those that improve working conditions and help to optimize organization performance.

Front 83

9. What information does the IT system and support analysis sheet provide?

Back 83

Details on specific IT systems and the business processes that they support. There are spaces to list systems and functions that are required to support the business processes that the disaster recovery planning team has ranked as having the highest priority for recovery.

Front 84

10. Which support departments need to participate in classifying systems and functions as critical, essential, necessary, or desirable?

Back 84

IT and network management, telecommunications, human resources, facilities management, security, and shipping and receiving, and others as necessary.

Front 85

11. What information does the business process disaster recovery chart of responsibilities provide?

Back 85

: A record of the primary and alternate disaster recovery responders for a specific business process. The specific individuals listed on the form will be responsible for designated tasks or functions that support the business process

Front 86

12. What information does the facility disaster recovery chart of responsibilities provide?

Back 86

A record of the primary and alternate disaster recovery responders for a specific facility. The specific individuals listed on the form will be responsible for designated tasks or functions at a facility.

Front 87

13. What information does the department disaster recovery chart of responsibilities provide?

Back 87

A record of the primary and alternate disaster recovery responders for a specific department. The specific individuals listed on the form will be responsible for designated tasks or functions within each department

Front 88

14. During the last decade, how has the nature of business continuity insurance changed?

Back 88

Most insurance companies are imposing additional charges for natural disasters such as earthquakes and hail or wind damage. The United States Federal government is now playing a stronger role funding and regulating insurance coverage for terrorist attacks and floods.

Front 89

15. Among events not caused by weather, what was the most costly natural disaster in the 1990s?

Back 89

: The 1994 Northridge earthquake in southern California stands out as the period's most dramatic and costly single disaster recovery, requiring nearly $7 billion in FEMA funding.

Front 90

16. What was the most costly weather-related natural disaster in the 1990s?

Back 90

Hurricane George in 1998, requiring $2.333 billion in FEMA funding.

Front 91

17. In which areas should the insurance review subcommittee evaluate insurance coverage and needs?

Back 91

: 1. Physical assets including buildings, light and heavy equipment, computers and networking technology, installed systems, and automobiles and trucks. 2. Stock, parts, supplies, raw material, and works in progress. 3. Assets that are in transit, at a subcontractor’s location, in storage, or at exhibitions. 4. Financial assets, revenue, profits, temporary operating expenses. 5. Impact of supplier or customer downtime. 6. Intellectual proprieties, designs in process, patterns, proprietary processes. 7. Records, stored files, electronic files, databases, proprietary computer programs. 8. Employee injury or death, key person loss, salary continuation, crisis counseling, care packages. 9. Indemnity, director and officer protection.

Front 92

18. What terms and conditions of an insurance policy should the insurance review subcommittee evaluate?

Back 92

1. What perils or causes of loss are included and excluded? 2. How is property valued? 3. Will the policy cover the cost of required upgrades during renovation or reconstruction? 4. What are the deductibles? 5. What steps must be taken in the event of a loss? 6. What types of records must the organization have support claims? 7. Can the disaster recovery plan help reduce insurance costs?

Front 93

19. Why is it important to understand how an insurance policy values assets?

Back 93

Understanding how an insurance policy values physical property will help to guide the disaster recovery planning team in deciding what kind of modifications to make in the coverage and what kind of expenses to expect during disaster recovery.

Front 94

20. Why is it important to understand what an organization must do to collect insurance coverage if a disaster strikes

Back 94

: This is important because recovering from disasters can consume large amounts of cash very quickly. An organization needs to be able to adequately respond to the insurance company and provide all of the necessary documentation in order to obtain funds as quickly as possible.

Front 95

21. Why should the insurance subcommittee review a policy’s terms and conditions related to having a disaster recovery plan in place?

Back 95

Having a well designed and tested disaster recovery plan in place may reduce the cost of insurance coverage and may help to get funds from the insurance company more quickly.

Front 96

22. What research activities should be completed before the planning team starts to develop disaster recovery procedures

Back 96

Facility exposure inventories, Business process inventories, Business process support requirements analysis, Evaluation of existing threat mitigation practices, Risk assessment reports, Recovery requirements analysis, Business processes and facilities prioritized for disaster recovery, Systems and functions prioritized for disaster recovery, Chart of responsibilities completed, Terms and conditions of insurance coverage evaluated, and Insurance coverage for assets evaluated.

Front 97

23. Why is it important to ensure that the files of the disaster recovery planning coordinator are well organized?

Back 97

The filing system should be created in a manner that a new disaster recovery planning coordinator can take over the work in the event that the present disaster recovery coordinator is no longer available.)

Front 98

24. Who should be on the insurance review subcommittee?

Back 98

Disaster recovery planning team members along staff from appropriate departments including financial management department, facilities management department, legal counsel, and others departments as necessary.

Front 99

1. Explain the types of disaster recovery procedures that relate to direction, control, and administration

Back 99

: Establishing the level of disaster and type of response, controlling response activities, and executing necessary administrative procedures for rescue and insurance claims

Front 100

2. Explain the types of disaster recovery procedures that relate to internal and external communications

Back 100

Initiating and managing communications activities necessary to respond to the disaster.

Front 101

3. Explain the types of disaster recovery procedures that relate to safety and health

Back 101

Assuring that the safety and health of employees and disaster recovery workers.

Front 102

4. Explain the types of disaster recovery procedures that relate to containment and property protection

Back 102

Assuring that property is properly secured and when possible containing the impact of the disaster to local areas or sections of facilities.

Front 103

5. Explain the types of disaster recovery procedures that relate to resuming and recovering operations

Back 103

Relocating staff and resources in order to resume some level of business operation

Front 104

6. Explain the types of disaster recovery procedures that relate to restoring facilities and normalizing operations

Back 104

The rebuilding, restoration, or acquisition of adequate facilities to support business operations in the same manner in which they functioned prior to the disaster

Front 105

7. Define a catastrophic disaster

Back 105

A disaster in which a disruption of operations will probably last more than seven days unless disaster recovery procedures are implemented. Damage from catastrophic disaster is very severe and can involve total destruction of a facility or require replacement of equipment or renovation of a facility

Front 106

8. Define a major disaster.

Back 106

Answer: A disaster in which a disruption of operations will probably last from two to seven days unless disaster recovery procedures are implemented. Damage from a major disaster can involve key business units being without computer services, telecommunications capability, production resources, or personnel.

Front 107

9. Define a minor disaster.

Back 107

Answer: A disaster in which a disruption of operations will probably last longer than one shift, but less than two days. Damage from a minor disaster is relatively light and can consist of minor damage to computer systems, office or manufacturing equipment, or a facility

Front 108

10. Explain the purpose of a disaster recovery procedure sheet.

Back 108

Answer: The sheet provides details about a procedure and has space for the facility number, building number, number of buildings and employees, the facility name, location, and contact information, and the name and contact information for the primary disaster recovery contact. There is also space to indicate who is responsible for implementing the procedure and space to document the procedure.

Front 109

11. List examples of the types of tasks the disaster response team performs.

Back 109

Answer: 1.) Overall direction of activities performed by Middle to upper managers, disaster recovery coordinator, facilities manager. 2.) Internal and external communications performed by Public relations manager, human resources manager, communications specialist. 3.) Life safety and health performed by Corporate security staff, on-site nurse or medical specialist 4.) Containment and property protection performed by Corporate security staff, facilities managers or staff, building maintenance staff, property management staff, manufacturing engineers. 5.) Resumption and recovery of operations performed by Specialists in support functions including IT, network management, operations directors, department managers. 6.) Restoration of facilities and normalization of operations performed by Facilities managers or staff, building maintenance staff, property management staff, operations directors, department managers.

Front 110

12. What is the purpose of the emergency operations center?

Back 110

It is a facility from which the leaders of the response team can direct activities and staff with specific response activities can work and rest. There should be predetermined primary and alternate locations for an emergency operations center. These locations should be documented along with any necessary information to notify facility managers and relocate staff.

Front 111

13. What is the purpose of first alert procedures?

Back 111

They are designed to provide a methodical and structured process to notify managers, employees, and emergency service organizations that an event has occurred. The procedure should designate who is responsible for first alert, who can authorize a first alert, and the names and contact information of the individuals that must be contacted.

Front 112

14. What is the purpose of the disaster confirmation procedure?

Back 112

: It is designed to validate the impact of an event and to initially determine the scope of damage and disruption. The disaster confirmation procedure is important because disaster response will consume considerable resources and in many cases normal operations will cease. Confirmation of a disaster should be accomplished by the response team and may include site visits, interviews, and fact collecting.

Front 113

15. What is the purpose of the disaster response activity log

Back 113

: The log is designed for the response team to track all of the activities related to response and recovery and provides detail on each activity that occurs, the date and time it occurs, and the organization and contact name of the person responsible for the activity.

Front 114

16. What kind of staff should be on the evacuation and rescue team?

Back 114

The evacuation and rescue team should be comprised of individuals that have been trained and have the necessary skills to supervise evacuation procedures and initiate rescue efforts at specific facilities

Front 115

17. What is the role of the security team?

Back 115

To assure that facilities and valuable property are secured during the evacuation process and after the facility has been evacuation and recover processes are underway.

Front 116

18. What is the role of the communications team?

Back 116

Answer: The team will be responsible for making necessary contacts with law enforcement agencies, government agencies that regular the industry in which the organization is involved, and with the media and general public

Front 117

19. What is the role of the insurance and damage assessment team?

Back 117

The team will be responsible initial as well as detailed damage assessments, filing reports with insurance companies, and working with demolition crews or constructions companies to start clean up or repairs.

Front 118

20. What is the role of the business continuation team?

Back 118

The team will be responsible for moving employees into temporary quarters, providing telecommunications, computer network, and computing support, managing shipping and receiving.

Front 119

21. What is the purpose of the restoration team

Back 119

The team will be responsible for obtaining restoration estimates, managing temporary repairs, and preparing facilities for reoccupation.

Front 120

22. How can risk assessment reports help the disaster response team?

Back 120

They can provide information that will help the recovery team understand the operations that have been impacted

Front 121

23. How do the rescue team and security team benefit from having access to building plans?

Back 121

These plans will help the teams navigate the facility and locate personnel, utility systems, and valuable assets

Front 122

24. Why should the people who train employees on the disaster recovery plan have access to electronic documents used to publish the plan?

Back 122

: The trainers can use the electronic versions to create slides, handouts, and other instructional material.

Front 123

25. Why should paper copies of the plan be available for distribution to team members?

Back 123

In the event that the computer networks or servers are not available it is still absolutely necessary to maintain high availability of disaster plans and procedures documents.

Front 124

1. What is the purpose of the disaster response contact sheet?

Back 124

It describes contacts made during a disaster, including information about the contacting facility, the organization contacted, the name of the staff person making the contact, and the results of the contact.

Front 125

2. List five examples of emergency response organizations that may need to be contacted after a disaster

Back 125

Ambulance and emergency medical services, fire departments, police departments, hazardous material response teams, regional and local disaster services agencies, vehicle removal services, debris removal services, building maintenance and construction contractors.

Front 126

3. What information should be included in the emergency service contact procedures?

Back 126

Names and titles of people who are authorized to contact emergency services, contact information and locations of emergency service organizations, conditions that require emergency services to be contacted, how events should be described to emergency services dispatchers, how facilities and locations should be identified for emergency service responders, instructions that should be given to emergency service responders about entering the facility, items that should be available to emergency service responders upon arrival, such as copies of buildings plans, and the names and titles of people who should assist emergency service responders upon arrival, such as security or building maintenance staff.

Front 127

4. List five examples of public utilities, departments, or agencies that may need to be contacted after a disaste

Back 127

Electric power, water service, sewer service, telephone line companies, steam service, waste removal, road maintenance and repair, highway maintenance and repair, forestry services, recycling services, environmental protection services, flood control services, animal control and protection, building inspection services, occupancy and use permits.

Front 128

5. What information should be included in the insurance company contact procedures?

Back 128

Names and titles of people who are authorized to contact insurance providers, contact information and locations of insurance providers, how to describe the impact of an event to report damages to an insurance provider, current insurance policy numbers and information about insurance coverage, how facilities and locations should be identified for insurance claims, how to develop initial and comprehensive insurance claims, how to photograph, videotape, or otherwise record information that can support the extent of damage and the potential cost of recovery.

Front 129

6. List five types of disaster recovery service providers that an organization may need to work with during recovery

Back 129

Plumbing contractors, heating and air conditioning contractors, roofing contractors, electrical contractors, general construction contractors, water removal specialists, hazardous material specialists, tree removal contractors, waste removal services, records restoration specialists.

Front 130

7. What types of telecommunications could be affected during a disaster?

Back 130

: Voice services, call center services, fax lines, data communications lines, EDI systems, Internet connections, Web-based services, Web sites, toll-free customer service lines, voice mail, e-mail services, access for remote workers, access for field staff, access for regional offices.

Front 131

8. What information should an organization include in its procedures for working with telecommunications service providers?

Back 131

Names and titles of people who are authorized to work with telecommunications service providers, contact information and locations of telecommunications service help desks and customer service representatives, how facilities and locations should be identified for telecommunications service providers, a list of all telephone numbers, telephone lines and services, data communications lines and services contracted for with each telecommunications service provider, information on existing contracts with each telecommunications service provider, information on how telecommunications service providers will be paid if there are no existing contracts for needed emergency services, how to access emergency funds to pay telecommunications service providers for emergency services

Front 132

11. What types of organizations can be considered business partners?

Back 132

Value-added resellers (VARs), original equipment manufacturers (OEMs), distributors, licensed resellers, or franchised operations.

Front 133

12. What information should be included in procedures for working with business partners?

Back 133

Names and titles of people who are authorized to work with business partners, contact information and locations of business partners, how product lines or services should be identified when contacting business partners, what business partners should be told about disasters, what business partners should be told about recovery of operations, what business partners should be told to do during the disaster if they need to contact the organization.

Front 134

13. Why should organizations communicate with their customers during a disaster?

Back 134

To ensure that transactions, deliveries, and relationships continue to run smoothly.

Front 135

14. What is the role of the official media spokesperson during a disaster?

Back 135

The spokesperson provides management-approved information to the media. All media inquiries should be referred to the official spokesperson.

Front 136

15. Why is it important to make consistent statements to the media about disaster recovery efforts?

Back 136

Shareholders, investors, employees, and the families of employees will see television and newspaper reports about the disaster. All will have their own concerns. Consistent statements help to ease these concerns. If executives, media spokespersons, or employees provide inconsistent information, concerns and uncertainty will be intensified.

Front 137

16. What is the primary goal when working with stockholders and investors during a disaster?

Back 137

To ensure that their confidence is not eroded. Angry stockholders and investors can do considerable damage to an organization’s reputation if they publicly question or criticize the disaster response team.

Front 138

17. Why is it important to have procedures for communicating with employees during disaster response and recovery efforts?

Back 138

: If a facility must be evacuated, employees need to know what to do next. This could include reporting to an alternate facility, or not reporting to work for a period of time. If employees are not on the disaster response team, then conditions may require them to not report to work. Communicating such information to employees makes disaster recovery run more smoothly.

Front 139

What information should be included in procedures for working with the local community during a disaster?

Back 139

Names and titles of people who are authorized to provide official statements to be distributed to local populations, a process for local organizations to check the status of operations, a process for department heads and supervisors to deal with inquiries from the local community during disaster recovery efforts, and a process to inform local media of messages for the local community.

Front 140

19. Who should be available to work with emergency responders upon their arrival at a facility

Back 140

Security or building maintenance staff, who can provide building plans and other information to the emergency workers

Front 141

20. Why is it important to communicate with suppliers and service providers during a disaster

Back 141

A disaster can affect supplier operations and result in oversupplies of materials arriving at an unusable facility. It is important to develop recovery procedures that help to reduce problems caused by suppliers who keep shipping material or service providers who continue showing up to do work.

Front 142

1. Which of the following should be considered threats to computer security?

Back 142

a. organized criminals, who are economically motivated and seek information they can use to extort money from victims.
b. terrorists, who are politically motivated and often religiously motivated.
c. industrial spies, who seek competitive information.

Front 143

2. IT professionals must always successfully protect their systems, while hackers can attack at their leisure or move on to easier targets

Back 143

True

Front 144

3. Which groups of people respond to computer hacking incidents?

Back 144

in-house information systems security staff, it staff responsible for system operation and maintenance, law enforcement officers

Front 145

Define terrorist incident

Back 145

A violenct act that endangers human life, viloates U.S. or state criminal law, etc.

Front 146

What is a cyber attack?

Back 146

The use of computer technology, software, and networks to attack systems

Front 147

What is cyberterrorism

Back 147

The use of cybertools to shut down critical national infrastructures such as energy, transportation, or government operations for the purpose of intimidating a government or its citizens.

Front 148

What is HIPAA

Back 148

Health insurance portability and accountability act

Front 149

What is the ping of death

Back 149

Computer attacks that occur when hackers modify the PING command to send Internet Control Message Protocol (ICMP) packets that exceed their maximum size. The extra bytes in the packet can cause unprotected TCP/IP software to overflow the buffer space, resulting in computer crashes, freezing, and rebooting

Front 150

Explain the principles of safe harbor

Back 150

These principles are listed in Table 7-6 in the text

Front 151

Explain how application-layer attacks are implemented

Back 151

These attacks exploit well-known weaknesses in commonly used server software such as sendmail, HTTP, and FTP. Hackers use these weaknesses to access computers with permissions of the account that runs the application, usually a privileged system-level account. Application-layer attacks often use ports that are allowed through a firewall. For example, a hacker often exploits Web server weaknesses by using TCP port 80 in an attack. Because the Web server makes pages available to users, a firewall needs to allow access on the port. From a firewall's perspective, the attack is standard port 80 traffic.

Front 152

What is an autorooter?

Back 152

Programs that automate the entire hacking process. Computers are sequentially scanned, probed, and captured. The capture includes installing a “rootkit” on the computer and using the newly captured system to automate the intrusion. This automation allows an intruder to scan hundreds of thousands of systems in a short period of time.

Front 153

How does network reconnaissance help hackers

Back 153

Network reconnaissance is the gathering of information about a target network using publicly available data and applications. Before hackers attempt to penetrate a network, they often learn as much about it as they can, using DNS queries, ping sweeps, and port scans. DNS queries can reveal who owns a domain and the addresses assigned to it. Ping sweeps of these addresses can present a picture of the live hosts in a particular environment. After a list is generated, port-scanning tools can cycle through all well-known ports to provide a complete list of services running on the hosts discovered by the ping sweep. Hackers can also examine the characteristics of applications running on the hosts, which can provide information that helps them compromise the service.

Front 154

When responding to a hacking incident, why should you use the telephone to communicate?

Back 154

Because attackers may able to monitor e-mail traffic

Front 155

What steps should IT staff take after a computer attack has been investigated?

Back 155

After inspecting systems, applications, and files to determine damage, IT staff should remove any malicious code, reload operating system software and other software as needed, install patches, and restore configurations and other system operations. IT staff should also restore files from backup as needed and replicate damaged files when backups are not available. If the investigations take several days, IT personnel must install and configure a replacement machine. Finally, IT staff should test the repaired system and have users confirm that the restored data is usable.

Front 156

When first reporting a computer crime to law enforcement agencies, what information must you have?

Back 156

The law enforcement contact name, title, telephone and fax number, and e-mail address, as well as your organization’s full address.

Front 157

What type of immediate impact can hacking attacks have on an organization?

Back 157

Damage to systems that require human intervention to repair or replace, disruption of business operations, and delays in transactions and cash flow.

Front 158

What is loss of system or data integrity?

Back 158

: System and data integrity refers to the requirement that information be protected from improper modification. Integrity is lost if unauthorized changes are made to the data or IT system, either intentionally or accidentally. If the loss of system or data integrity is not corrected, continued use of the contaminated system or corrupted data could result in inaccuracy, fraud, or erroneous decisions. Also, violation of integrity may be the first step in a successful attack against system availability or confidentiality

Front 159

18. What general procedures does NIST recommend to ease the recovery of damaged computer systems?

Back 159

1.) Frequent backups and offsite storage of data, applications, and the operating system. 2.) Redundant system components or capabilities. 3.) Documented system configurations and requirements. 4.) Power management systems and environmental controls

Front 160

19. Because so many users in an organization rely on large systems, what should an organization do to ensure their maximum availability?

Back 160

? Answer: 1) use uninterruptible power supplies. 2.) Use redundant critical system components. 3.) Use fault-tolerant computers and networking systems. 4.) Replicate databases.

Front 161

What types of practices can help to reduce network downtime?

Back 161

1.) Redundant communications links. 2). Multiple network service providers. 3.) Duplicate network-connecting devices. 4.) Deployment of segmented networks. 5.) The use of off-the-shelf network technology. 6.) Network security systems. 7.) Intrusion detection and prevention systems.

Front 162

1. List several types of hazardous materials

Back 162

Hazardous materials come in the form of explosives, flammable and combustible substances, poisons, and radioactive materials.

Front 163

2. Why are procedures necessary to deal with hazardous materials in a disaster?

Back 163

The danger from these materials can intensify fires, release toxic fumes when burning, explode, or contaminate or otherwise injury employees as well as emergency responders.

Front 164

3. Why shouldn’t the disaster recovery planning team try to interpret scientific data or government regulations for hazardous materials?

Back 164

Because it is an area that requires extensive knowledge and training.

Front 165

4. What types of items can be classified as art, antiques, and collectibles?

Back 165

: Rare and expensive items that in many cases may not replaceable.

Front 166

5. If art, antiques, and collectibles are destroyed or damaged beyond repair, what information might insurance companies require to settle a claim?

Back 166

Complete documentation as to the purchase, condition, and appraised value of the items. This documentation should be kept off-site and include receipts, appraisal reports, and photographs.

Front 167

6. When art, antiques, and collectibles have not been appraised, what steps may be necessary to complete an insurance claim?

Back 167

There are several guidebooks available that provide basic pricing information for a wide range of art, antiques, and collectables. These guidebooks may be helpful to further identify or value the items and support an insurance claim. In many cases an appraiser that specializes in art, antiques, and collectables may need to be consulted when filing insurance claims.

Front 168

7. What should an organization do to support the value of historic documents?

Back 168

Have extensive records as to the items in any historic document collection and to have periodic appraisal performed by a certified specialists.

Front 169

8. What are perishable foods and materials?

Back 169

Items that need to be stored at certain temperatures to prevent spoilage and are subject to handling and storage regulations by national, state, and local governments.

Front 170

9. When developing procedures to deal with perishable foods and materials during a disaster, what issues should the disaster recovery planning team consider?

Back 170

: Procedures must be developed in accordance to a variety of food and health laws. The U.S. Food and Drug Administration as well as state and local health agencies have a wide range of complex laws that govern the handling of perishable foods and materials.

Front 171

10. Why should the disaster recovery planning team seek expert help when developing procedures for dealing with controlled substances?

Back 171

The U.S. Food and Drug Administration as well as state and local regulatory agencies have a wide range of complex laws that govern the controlled substances.

Front 172

11. Why is it important to have procedures to protect trade secrets and proprietary processes in a disaster?

Back 172

Trade secrets and proprietary processes are some of the most valuable assets that an organization owns. When disaster strikes there must be procedures in place to assure that trade secrets and proprietary processes are both preserved and kept confidential.

Front 173

12. Procedures for dealing with life forms often require what types of actions in a disaster?

Back 173

In many cases life forms will need to be moved to another part a facility or completely removed from a facility to assure their safety and preservation during disaster response and recovery.

Front 174

13. Why is it important to secure precision equipment, electronics, and optics

Back 174

They are often very expensive items and it is not unusual for expensive equipment to be stolen during chaotic times. If these items are quickly secured or removed from a disaster are to a safe location it will be easier to recovery from the disaster and resume normal operations.

Front 175

14. Why are procedures necessary for handling rare materials in a disaster

Back 175

Such items can be stolen during a chaotic situation, lost during clean up procedures, or misplaced during remolding or renovation. If these items are quickly secured or removed from a disaster are to a safe location it will be easier to recovery from the disaster and resume normal operations.

Front 176

15. Which issues often dictate the need for special procedures during disaster recovery?

Back 176

The nature of an organization as well as the location of facilities.

Front 177

16. List unusual circumstances that might require special procedures in a disaster

Back 177

Circumstances where high-value assets are maintained, stored, displayed, or used. In addition, special attention needs to be given to facilities that have materials and supplies that can cause death, injury, or greater damage.

Front 178

17. Describe trade secrets and proprietary processes

Back 178

: Ideas, patents, plans, manufacturing processes on which an organization is economically dependent.

Front 179

18. What issues should an organization address in procedures for dealing with hazardous materials during a disaster?

Back 179

1. Names and titles of people that are knowledgeable of and responsible for hazardous materials. 2.) Applicable laws and regulations that must be adhered to when handling hazardous materials during a disaster. 3.) The proper contact telephone numbers and locations of emergency service organizations that specialize in hazardous materials. 4.) Conditions that require emergency service organizations that specialize in hazardous materials be contacted. 5.) How events should be described to the dispatchers service organizations that specialize in hazardous materials. 6.) How facilities and locations should be identified for emergency service organizations that specialize in hazardous materials. 7.) Instructions that should be given to responders from emergency service organizations that specialize in hazardous materials about entering the facility. 8.) Items that should be available to responders from emergency service organizations that specialize in hazardous materials upon arrival such as copies of buildings plans and locations and types of hazardous materials. 9.) The names and titles of individuals that should assist responders from emergency service organizations that specialize in hazardous materials upon arrival such as security or building maintenance staff. 10.) How to secure areas where hazardous materials are stored or used.

Front 180

19. What issues should an organization cover in procedures to protect trade secrets in a disaster?

Back 180

1.) Names and titles of people that are knowledgeable of and responsible for the confidentiality of trade secrets and proprietary processes. 2.) Conditions that require a lock down of confidential materials. 3.) A confidential building plan that indicates which rooms confidential materials are kept. 4.) Procedures for locking down confidential materials. 5.) Procedures for relocating confidential materials during disaster response and recovery. 6.) An off-site secure location where confidential materials can be stored. 7.) Procedures for returning confidential materials after disaster response and recovery have been concluded.

Front 181

20. Why shouldn’t the disaster recovery planning team stop developing procedures once a basic recovery plan is in place?

Back 181

Answer: The more an organization plans for contingencies and the better managers and employees understand the needs of an organization, the more likely it is that disaster recovery can go smoothly

Front 182

1. What activities occur when an organization implements its disaster recovery plan?

Back 182

: 1.) Responsibilities for implementation will be assigned to disaster recovery planning team members as well as departmental groups. 2.) An implementation schedule will be developed with time lines and preplanned progress evaluations. 3.) The disaster recovery documentation will be distributed to all of the individuals in the organization that need copies or online access will be made possible. 4.) The value and effectiveness of mitigation steps will be assessed and new mitigation steps will be put into place while existing mitigation steps may be modified. 5.) An internal and external awareness campaign will be planned and launched. 6.) A program to train employees on disaster recovery procedures will be developed and launched.

Front 183

2. Disaster recovery training and awareness raising occur at what level of an organization?

Back 183

a. organization-wide

Front 184

3. Modified and new procedures might be required to implement a disaster recovery plan. At what level of an organization are these procedures written? (Choose all that apply.)

Back 184

c. department level
d. work group level

Front 185

4. Equipment might have to be purchased and deployed to implement the disaster recovery plan. At what level of an organization is this equipment purchased?

Back 185

b. facility level

Front 186

5. Who directs the activities required to implement the disaster recovery plan?

Back 186

a. the disaster recovery coordinator, functional department managers, and business unit managers

Front 187

6. Who is responsible for managing documentation for the disaster recovery plan?

Back 187

b. the disaster recovery coordinator

Front 188

7. What are the advantages and disadvantages of distributing the disaster recovery plan on an intranet?

Back 188

Advantages: ease of deployment, low costs, accessible by all employees and business partners. Disadvantages: not available if the Intranet is down, remote connectivity is lost, or the specific server is down.

Front 189

8. What are the advantages and disadvantages of distributing the disaster recovery plan on a hosted Web server?

Back 189

Advantages: broader possible access than an Intranet, server is maintained off-site. Disadvantages: not available if web server or hosting company is down, requires remote connectivity.

Front 190

9. What are the advantages and disadvantages of distributing the disaster recovery plan on a CD-ROM?

Back 190

Advantages: Does not rely upon network connectivity, can be deployed on a laptop or notebook. Disadvantages: CD-ROMs must be continuously replaced with updated versions.

Front 191

10. What questions should an organization ask before selecting a backup system?

Back 191

a. How resilient to failure is the backup system?
b. Can the backup system be used for more than one system or application, thus improving ROI?
c. What level of disaster does the backup system help mitigate (e.g., catastrophic, major, or minor)?
d. all of the above

Front 192

11. What is the advantage of using an ROI analysis to evaluate mitigation steps?

Back 192

Using the ROI analysis approach the disaster recovery planning team can evaluate the types of mitigation steps that make economic sense for an organization.

Front 193

12. What types of communications are economic ways to increase awareness of the importance of the disaster recovery plan? (Choose all that apply.)

Back 193

a. employee newsletters
b. bulletin boards
c. Intranets with employee information sections

Front 194

13. When managers and supervisors make announcements in their meetings about implementing the disaster recovery plan, what information should the announcements include? (Choose all that apply.)

Back 194

a. a basic description of disaster recovery planning
b. the status of disaster recovery planning
c. the status of plan implementation

Front 195

14. What are the five target audiences for disaster recovery training in an organization?

Back 195

Executives, Middle managers, Supervisors, All employees, selected response teams

Front 196

15. Which of the following groups should receive training on safety and health procedures? (Choose all that apply.)

Back 196

b. middle managers
c. supervisors
d. selected response teams

Front 197

16. Which of the following groups should receive training in procedures for working with insurance companies?

Back 197

d. insurance and damage assessment team

Front 198

17. Why should disaster recovery training for middle managers cover topics in greater depth than the training for executives?

Back 198

Middle managers generally have a far more extensive role in the disaster response and recovery process than executives.

Front 199

18. Training specific response teams is the least complicated aspect of disaster response and recovery training

Back 199

false

Front 200

19. Training for supervisors is designed so that sessions can be held independently, grouped for the convenience of supervisors, or delivered in a three-day training session

Back 200

false

Front 201

20. The disaster recovery coordinator should work with the Human Resources or Training Department to ensure that trainers receive a list of all employees who are scheduled to attend specific training modules.

Back 201

true

Front 202

1. What is the purpose of a procedure audit?

Back 202

Procedure audits show if information is current, resources are in the correct location, designated equipment is installed, if necessary staff is available, and if employees understand the procedures.

Front 203

2. How does an organization perform a live walk-through of procedures?

Back 203

Live walk through of procedures are accomplished by actually implementing procedures to determine their effectiveness.

Front 204

3. What is the purpose of a live walk-through of related procedures?

Back 204

Live walk through of related procedures show if procedures are properly coordinated and if systems interact as designed

Front 205

4. How does an organization perform scenario testing?

Back 205

Scenario testing is accomplished by creating a mock disaster such as severe weather or fires to determine how well procedures designed for those events work.

Front 206

5. How does an organization perform facility-level tests?

Back 206

Facility level tests are accomplished by creating a mock disaster that an entire facility must respond to.

Front 207

6. When auditing disaster recovery procedures, what questions must the auditors address?

Back 207

1.) Is the procedure written in a manner that it can be executed? Review the clarity of language, use of terms, descriptions of locations, and descriptions of actions steps. 2.) Has anything occurred that makes the procedure out dated or inadequate? Review physical changes in building layout, location of equipment, and names of equipment. 3.) Have the personnel involved in executing the procedure changed? Review names and contact of staff or organizations that must be contacted to assure that they are current. 4.) Have other procedures changed that will impact the execution of this procedure?

Front 208

7. When conducting walk-through tests for disaster recovery procedures, what questions must the testers address?

Back 208

1.) Are the steps included in the procedure adequate to execute the procedure? 2.) Were there specific instructions that when executed that did not work? 3.) Did all of the appropriate personnel respond when executing the procedure? 4.) Have other procedures changed that will impact the execution of this procedure?

Front 209

8. How does an organization generally conduct audits of computer system and network vulnerability

Back 209

By using automated procedures that profile devices hooked to a computer network and compare those profiles against configurations and software settings that are more secure. Reports are generated for each device along with changes that should be made to improve security

Front 210

9. How does an organization conduct intrusion tests of computer systems and networks?

Back 210

By using a combination of automated and hands-on methods to test how easy it is to break into computer systems or networks. The results of the intrusion test are compiled along with recommendations on how to improve security.

Front 211

10. Why is there resistance to large-scale scenario tests of disaster recovery plans and procedures?

Back 211

: Because of the impact on productivity. The resources of entire work groups, departments, facilities, or organizations can be consumed for hours or days to test complex scenarios. Such resource consumption makes many managers skeptical of the value of the scenario testing method because of an unproven ROI.

Front 212

11. When staging a test of evacuation procedures, which of the following points should an organization note and consider? (Choose all that apply.)

Back 212

a. descriptions of activities in the facility at the time of the test
b. how the evacuation test is monitored, and who the monitors are
c. the methods used by the monitors to record their observations

Front 213

12. When staging a test of shutdown procedures, which of the following questions should an organization note and consider?

Back 213

a. How quickly do supervisors and employees respond to the shutdown alarm?
b. Were the shutdowns implemented according to procedures?
c. If the shutdowns were not implemented according to procedures, where and when did the human error occur?
d. all of the above

Front 214

13. When staging a test of lockdown procedures, what should an organization test for?

Back 214

1.) How fast do supervisors and employees respond to the lock down alarm. 2.) Were the lock downs implemented according to procedures. 3.) If the lock down procedures were not implemented according to procedures where and when did the human error occur. 4.) If the lock down procedures failed for other than a human error what was wrong about the shut down procedure. 5.) Was the lock down procedure fast enough for employees to lock down equipment and evacuate their work area or their building.

Front 215

14. What issues should organizations evaluate when testing their procedures for dealing with hazardous materials in a disaster?

Back 215

: 1.) Were the names, titles, and contact information of people that are knowledgeable of and responsible for hazardous materials correct in the disaster recovery procedures. 2.) Were the contact telephone numbers and locations of emergency service organizations that specialize in hazardous materials correct in the disaster recovery procedures. 3.) Were the conditions that require emergency service organizations that specialize in hazardous materials be contacted correct in the procedures. 4.) Were events and circumstances appropriately described to the dispatchers of service organizations. 5.) Were the facilities and locations appropriately identified for emergency service organizations. 6.) Instructions that should be given to responders from emergency service organizations about entering the facility. 7.) Were the correct items available to responders upon their arrival such as copies of buildings plans and locations and types of hazardous materials. 8.) Were the proper individuals present to assist responders from emergency service organizations upon arrival.)

Front 216

15. What issues should organizations evaluate when testing their procedures for protecting art, antiques, and collectibles in a disaster?

Back 216

1.) Aspects of procedure tests for dealing Antiques, art, and collectable. 2.) Were the names, titles, and contact information of people that are knowledgeable of and responsible for art, antiques, and collectables correct in the procedures. 3.) Were the contact telephone numbers and locations of emergency service organizations that specialize in removal and restoration of art, antiques, and collectables correct in the disaster recovery procedures. 4.) Were the conditions that require contractors that specialize in removal and restoration of art, antiques, and collectables be contacted correct in the procedures. 5.) Were events and circumstances appropriately described to the dispatchers for the contractors that specialize in removal and restoration of art, antiques, and collectables. 6.) Were facilities and locations properly identified for responders. 7.) Were instructions about entering the facility properly given to responders. 8.) Were the proper items available to responders upon arrival such as copies of buildings plans and locations and types of art, antiques, and collectables. 9.) Were the proper individuals available to assist responders upon their arrival. 10.) Was the proper documentation on the acquisition and the value of art, antiques, and collectables stored in the place that the procedure indicated that it was stored.

Front 217

16. What issues should organizations evaluate when testing their procedures for protecting trade secrets in a disaster?

Back 217

: 1.) Were the names, titles, and contact information for people that are knowledgeable of and responsible for the confidentiality of trade secrets and proprietary processes correct in the procedures. 2.) Were the conditions that require a lock down of confidential materials clear in the procedures. 3.) Is there a confidential building plan that indicates which rooms confidential materials are kept. 4.) Are the procedures for locking down confidential materials clear and executable. 5.) Are the procedures for relocating confidential materials during disaster response and recovery clear and executable. 6.) Was there an off-site secure location where confidential materials can be stored designated in the procedures. 7.) Did the procedures for returning confidential materials after disaster response and recovery have been concluded clear and executable.

Front 218

17. What elements make up a test scenario?

Back 218

: 1.) Test scenario element. 2.) The date and time the test will be executed. 3.) The duration of the test in hours or days. 4.) The scope of the test including which work groups, departments, or facilities will participate in the test. 5.) If outside contractors or emergency service organizations will be involved in the test. 6.) The nature of the test such as a natural disaster test, a human error incident, or and accidental event. 7.) How the response will be monitored. 8.) How the notes of the monitors will be analyzed. 9.) How feedback will be given to employees.

Front 219

18. During a scenario test, what types of activities can be measured using quantitative data?

Back 219

Response time, completion of containment, lock down, and shut down tasks

Front 220

19. During a scenario test, what types of activities can be measured using qualitative data?

Back 220

How well procedures worked, how well employees performed, how well employees responded to unanticipated situations, and how well employees solved problems during disaster response

Front 221

20. What information should be included in the scenario test evaluation report?

Back 221

title page, table of contents, executive summary, test scenario description, chronology of events, synthesized evaluation results, recommended changes in plans or procedures, recommendations for further training or changes in training content or process, exhibits and attachments.

Front 222

21. In the scenario test evaluation report, what data sources are used to create the chronology of events?

Back 222

Disaster response activity logs, reports and forms completed by the disaster response team

Front 223

22. In the scenario test evaluation report, what data sources are used to create synthesized evaluation results?

Back 223

Reports from monitors, completed evaluation forms, results of debriefing sessions

Front 224

1. Explain the meaning of the maintenance mode in disaster recovery planning.

Back 224

After the disaster recovery plan and procedures are developed, implemented, and tested, the disaster recovery planning team enters a new phase of operation. The disaster recovery planning team will enter the maintenance mode to monitor, test, and modify the disaster recovery plan to keep it current with changes in organization structure, business operations, and new technologies that can ease the recovery process.

Front 225

2. What are the advantages of keeping corporate security representatives as full-time members of the disaster recovery planning team during the maintenance mode?

Back 225

Corporate security staff will always play a key role on many disaster response teams.

Front 226

3. What are the advantages of keeping representatives of the IT and Network Management departments as full-time members of the disaster recovery planning team during the maintenance mode?

Back 226

The IT and network management departments maintain critical infrastructure that is often constantly evolving and changing.

Front 227

4. What are the major options for keeping a person in the organization that has primary responsibility for maintaining the disaster recovery plan?

Back 227

Have a full-time or part time disaster recovery coordinator in place or have a middle to high level manager from an administrative department lead the effort.

Front 228

5. What internal sources can provide information to update contact persons, team composition, and notification lists in the disaster recovery plan?

Back 228

Human Resources department, business unit managers, department managers.

Front 229

6. What internal sources can provide information to revise procedures that become outdated because of changes to evacuation procedures, building plans for use by responders, and maps that show the location of dangerous or valuable materials?

Back 229

Property managers, building maintenance staff, plant engineers, department managers.

Front 230

7. What internal sources can provide information to revise procedures because of changes in the manufacturing process that introduce new materials or eliminate existing materials that may be hazardous

Back 230

Manufacturing managers, product designers, research and development staff.

Front 231

8. What external sources can provide information to update procedures because of additional or reduced emergency services for local response organizations?

Back 231

Emergency service organizations, local and regional disaster response organization.

Front 232

9. What external sources can provide information to update procedures because of changes in roads, exits, access, and public construction projects?

Back 232

: Local and state public departments

Front 233

10. What external sources can provide information to update procedures because of changes in laws or regulations that may affect an organization directly or indirectly?

Back 233

: Local, state, and federal public departments, industry organizations, professional organizations.

Front 234

11. What organizations can provide information to update procedures because of internal and cross-border terrorist threats in specific countries or locations?

Back 234

National law enforcement agencies such as the FBI and counterparts in other countries.

Front 235

12. What organizations can provide information to update procedures because of shifts in political, economic, and social conditions in specific countries?

Back 235

The U.S. Department of State and counterparts in other countries, international organizations such as the World Bank and the United Nations.

Front 236

13. What organizations can provide information to update procedures because of changes in security conditions and alerts for specific industry groups?

Back 236

Industry associations, business organizations.

Front 237

14. Explain the handling instructions of “urgent,” “important,” and “routine” on the disaster planning monitoring report, and how the planning team should respond to these instructions

Back 237

Urgent – must be dealt with immediately. Important – must be dealt with in less than two weeks. Routine - can be dealt with at next meeting.

Front 238

15. Explain three approaches to monitoring compliance with procedures that are designed to ease disaster recovery.

Back 238

: Random monitoring by the disaster recovery planning coordinator. 2.) Regularly schedule checks by the department managers. 3.) A system for employees to report violations.

Front 239

16. Why should organizations monitor new technologies in consideration of their disaster recovery needs?

Back 239

The technology design and marketing process will continue with the same marketing and feedback cycles. As technology becomes more reliable and more resilient to failure organizations will have new opportunities to acquire and deploy technologies that can reduce down time and ease the process of disaster recovery.

Front 240

17. What possible changes in organizational relationships might disaster recovery planners need to address?

Back 240

: 1.) Business partner is acquired by or merges with your organization. 2.) Two business partners merge with each other. 3.) Business partner is acquired by or merges with another organization with which there has been no prior relationship. 4.) Business partner ceases to exist and goes out of business. 5.) Your organization is acquired by or merges with another organization.

Front 241

18. What are the advantages and disadvantages of setting dates for a comprehensive review of the entire disaster recovery plan?

Back 241

Advantages: assures complete reviews of all plans and procedures are accomplished. Disadvantages: is time consuming and requires considerably resources.

Front 242

19. What are the advantages and disadvantages of allowing departments or facilities to set their own schedules and monitor themselves when reviewing the disaster recovery plan to support maintenance efforts?

Back 242

: Advantages: requires fewer resources and allows unit independence and autonomy. Disadvantages: is time consuming and requires considerably resources

Front 243

20. What methods can you use to overcome resistance to ongoing maintenance of the disaster recovery plan?

Back 243

1.) Give recognition to departments and facilities that help to keep disaster recovery plans and procedures updated. 2.) Give recognition to individuals that do outstanding work to keep disaster recovery plans and procedures updated. 3.) Schedule regular motivational presentations about the importance of maintaining the disaster recovery plan. 4.) Include maintenance of the disaster recovery plan in the duties of department managers. 5.) Include efforts to maintain the disaster recovery plan in the performance evaluations of department managers. 6.) Reiterate the importance of maintaining the disaster recovery plan when there is national or local news about disasters.

Front 244

21. What steps should you take to ensure quality control when updating Intranet or Web server versions of the disaster recovery plan?

Back 244

: 1.) Verify that the source documents being used to make updates are the correct versions. 2.) Transfer documentation into format for the Intranet or web server. 3.) Check to make sure all information has been transferred from source documents. 4.) Use spell checking software if available. 5.) If necessary, create graphics, tables and charts. 6.) Have a copy editor read the Intranet and web server versions to assure accuracy. 7.) Have a copy editor review the graphics, tables and charts in the Intranet and web server versions to assure accuracy. 8.) If applicable, check all hyperlinks from a remote station to assure that they work properly. 9.) Post changes notices on the Intranet and web server. 10.) Notify all users that changes have been made.

Front 245

22. What steps should you take to ensure quality control when updating training modules for the disaster recovery plan?

Back 245

: 1.) Verify that the source documents being used to make updates are the correct versions. 2.) Transfer documentation into a format for training materials including training manuals and Power Point presentations. 3.) If necessary, create graphics, tables and charts. 4.) Use spell checking software if available. 5.) Have a copy editor read the training material for accuracy and correctness. 6.) Have the disaster recovery coordinator review the revised or new training material. 7.) Rehearse the revised or new training modules. 8.) If necessary, modify the revised or new training modules. 9.) Pilot the revised or new training modules with employees. 10.) Have employees complete evaluation forms for the training sessions. 11.) If necessary, modify the revised or new training modules based on employee evaluations.