Biomedical Engineering Reference
In-Depth Information
e. Has the facility coordinated its emergency
IT plans with those of its vendor(s)?
f. Are the IT vendor's emergency plans
addressed in the contract between the
facility and the vendor?
g. Has the facility established plans for
communicating and coordinating with its
IT vendor(s) in the event of an emergency?
h. Are these communication and coordina-
tion plans incorporated into the contract
between the facility and the vendor?
the facility to restore operations within hours or
days, depending on the level of service purchased.
A cold site, by contrast, generally does not allow
for immediate restoration of data operations and
communications. A cold site usually consists of
pre-arranged contracts for the lease of computers,
equipment, and space in an emergency, as well
as off-site storage of data tapes. Although a cold
site is a less expensive option, it will take more
time for that site to become fully operational. The
choice of whether to maintain a hot site, cold
site, or some combination of the two, will depend
on the facility's need to immediately restore data
operations and communications in an emergency.
Conducting a business analysis or HVA can help
determine the facility's capacity to handle “down-
time” in its data operations and communications,
and guide the selection of backup services and
facilities.
D. Mitigation of ISP Failure
A specific element for consideration in relation
to the facility's emergency IT planning is how to
maintain Internet Service Provider (ISP) service
during and following an emergency.
1. Does the facility maintain two separate ISP
relationships in the event that one ISP fails?
Does the organization prefer to have the second
ISP arranged as a back-up service (in which
case it will only be activated if the primary
ISP fails), or does the facility wish to maintain
two fully functioning ISPs at all times?
2. Does the organization maintain a service-
level agreement with its ISP provider(s) that
guarantees immediate service if the facility
experiences problems with the ISP? Does
the agreement include a provision specifying
the service that the organization expects to
receive during and following an emergency?
1. For how long can the facility afford to be
without its IT services?
2. How serious is the effect of having the
facility's IT services unavailable?
3. Has the facility conducted a business analysis
regarding the effects of losing its IT services,
or is loss of IT services included in the HVA?
4. How much is the facility willing to spend to
ensure that the continuity of IT services is
maintained (e.g., on a real-time basis; on a
delayed-response basis)?
5. Does the facility's IT vendor(s) maintain hot
or cold sites that will be used to protect the
facility's IT services?
6. Would it be less expensive to contract with an
IT vendor to provide the facility with hot site
or cold site backup, as opposed to contracting
for the backup system directly?
E. Maintaining a Hot or Cold Site
The organization will need to decide whether to
maintain a “hot site” for some or all IT services
(either directly or through an IT vendor). A hot
site is a physical location to which the facility
can move its data operations and communications
in the event of an emergency. The hot site will
be configured to the facility's specifications, with
computers, printers, Internet services, and work
stations for staff. The hot site maintains the same
data as is maintained at the facility, either through
regular backups or through real-time synchroniza-
tion. In case of an emergency, a hot site will allow
VI. Finance (Green)
The Finance Section Chief makes arrangements
to ensure the organization's continued financial
health, from recording the cost of emergency
response to arranging credit for needed supplies and
coordinating financial arrangements for emergency
