Auditing Disaster Recovery Management - Auditing Information Systems: Enhancing Performance of the Enterprise - page 127

software enables creation of large storage which backup administrators can use to perform
backups of large volumes of data and data recovery more easily.
Virtual storage has been very useful in many enterprises which require large disk space but
cannot afford the high cost of such systems. An enterprise can develop a storage area net-
work which they can use to pool several storage devices on the network and use as a large
single-storage unit. Enterprise networks have many computers with spare storage which is
normally not used. A storage area network can be used to achieve this purpose.
Once backups have been taken, it is important that tests are performed to ensure that
data can be restored. Enterprises are required to come up with policies and procedures on
backup testing. More advanced backup systems are able to test data backups as backups are
being taken. Testing restoring backups is still required in order to ensure that in the event
of a disaster data can be restored.
Many enterprises develop test plans which are used to test backups and restoration of data.
Test plans and procedures should be robust so that backups are fully tested. The IS auditor
should review evidence on testing backups so that it can be confirmed that backups are be-
ing performed as well as testing backup restoration.
Recovery Strategies
Enterprises can implement recovery strategies in different ways depending on their needs
and how they want to recover data and IT systems in terms of time, level, and point of re-
covery. High-level recovery strategies cost more than low-level recovery strategies. Choos-
ing a particular strategy would depend on the assessment by the enterprise using a cost-be-
nefit strategy. Figure 9.3 shows a pyramid structure of recovery strategies with those ap-
pearing on top being low-cost strategies.
Figure 9.3 Recovery Strategies
Hot sites - This is a strategy where the enterprise provides a similar environment as the
main data centre with all the equipment available such as servers, workstations, network
equipment, and offices. The site might also have current data which is replicated to the hot
site every few minutes or seconds. The environmental controls should also be at the level
as the main data centre. In some hot sites, data may not be available and will be required
to be loaded on to the servers before the users can make use of the facility. Ordinarily what
should be missing are user connections. In the event of a disaster, all the enterprise requires