Rise of the Checklist

-

Rise of the checklist




With thanks to the coronavirus, there has been a rise in checklists; what you should or shouldn’t do and so forth.

Well here is another one, but this time with a twist.

Let’s suggest for the moment that there is no business continuity plan [BCP] in place, or if there is a plan [created to satisfy a client] but quite frankly isn’t worth the paper upon which it was printed, then:
  • What did the IT team have to put in place, at a rush and without testing [probably] to enable staff to work from home?
    • Make a list
  • What did the HR team have to put in place, at a rush and without testing [probably] to enable staff to work from home?
    • Make a list
  • What did the payroll team have to put in place at a rush to ensure that staff can continue to be paid?
    • Make a list
  • What did team leaders have to put in place, at a rush, to ensure that staff working from home are supported; do not feel isolated; do not become stressed?
    • Make a list
  • What did the business have to put in place, at a rush, to ensure that the business premises remained physically secure whilst everyone was working from home?
    • Make a list
  • What is going to happen when everyone comes back into the office; what needs to be checked?
    • Make a list
If you haven’t got it yet, this is called learning lessons; the purpose is to learn from the mistakes made during the current crises so that if ever the world goes awry again, you have a workable plan.

Regrettably if that 100-mile-wide meteor is headed in your direction, no amount of planning is going to help. Sorry.

Looking at the table above you will probably notice that there are various departments/functions/services of the business that come into play. They do not sit in isolation; they work together.

Whilst in this day and age the emphasis is upon disaster recovery (DR) in the event those cybers come attacking, the reality of a pandemic is upon the world. Your business continuity [DR is a subset of the business continuity] plan should have been documented, tested, reviewed, tested again, and maintained.

So, with the lesson learned process in mind, and whilst at home shooing the cat away from the keyboard, the business needs to start looking at how it is going to improve matters once the COVID-19 has bitten the dust.

If you haven’t cottoned onto the irony of a raft of cybersecurity checklists being published by those who have Certified you or trained you in information and cyber security, then corona is the least of our problems. Subtle as a brick.

For all your information and cyber security training needs…😀

KanSecurity Ltd [NRL]

Popular posts from this blog

Risk and micro, small business

-
Image
Risk; why is it so difficult? Information security risk management, or if you wish cyber security risk management; either way it appears to cause a bit of a problem. Over many years now I have seen and audited different concoctions, the majority of which fail completely to be effective in managing the risk.  That said, I have also seen some scarily good processes, many of which are application driven rather than spreadsheet driven. This is an out and out plug, but the best and most effective examples have usually be driven by Acuity Risk Management's Stream application .  However, for the micro or small business the best approach is to keep things simple, for the moment at least. Risk description - there are excellent definitions for risk published within various ISO documents. However it all boils down to the following: Source (what is the source of the thing that could happen - internal or external parties) Event (what is going to occur) Cause
Read more

Risk and Certification

-
Image
Risk too...for Certification The previous discussion on information and cyber security risk was focused toward the micro and small business; the purpose being an attempt to get their ball-rolling on looking at risk. Certification to ISO/IEC 27001:2013 (information security management system (ISMS), requirements) needs the business to seriously focus on information and cyber security risk. In fact, clause 6 (Planning) and its sub-clauses are all focused on risk; this is the 'plan' element of the plan, do, check, act (PDCA) dance. On the other hand, clause 8 (Operation) and in particular 8.2 and 8.3 are all about carrying out risk assessment and treatment, the 'do' element of PDCA. The International Organisation for Standardisation (ISO) does not dictate to your business any particular process or methodology for risk. But, whatever process you adopt it must produce consistent, valid and comparable results (clause 6.1.2b).  If not, the syst
Read more

Sleepless nights, and business owners

-
Image
What keeps the business owner up at night? I am talking about owners of the micro, small, and in some cases medium sized business; those owners who on a daily basis put their heart and soul into building their business and doing all they can to keep it running successfully; making profit; keeping customers happy; employing people etc. The farthest thing from their minds will be information and cyber security.  It could even be suggested that the mere mention of the subject is likely to result in a furrowed brow followed by, this is what I pay the IT Service Provider to look after. It is not surprising then that the evangelist, having worked in the information and cyber security space for many years, comes across disinterest; disregard; and perhaps just a bit of indifference when the subject is raised. That is not meant to insult the business owners, it’s simply a fact of the evangelist's life. For 20 years and more so many thoughts around how to change mind-sets h
Read more