EDMOND D. JONES is certified as a Master Business Continuity Planner (MBCP) by the Disaster Recovery Institute, International. His involvement with continuity planning began in 1964 and continued throughout his 20-year military career. This experience included planning for various types of organizations, including data processing organizations. Working in the commercial sector since 1985, he has assisted 100's of businesses in the United States and Canada in defining and establishing their business continuity programs and plans. Mr. Jones has been an instructor for the Disaster Recovery Institute, International; assisted in development of the Institute's Professional Practices; and, was responsible for designing the review course for candidates preparing for the MBCP examination. In addition, Mr. Jones was one of the first members of the Disaster Recovery Institute to be elected to serve on the Institute's Certification Board. Mr. Jones has had articles published in the Disaster Recovery Journal and been an expert source for articles in ComputerWorld and the Law Office Administrator.
(IP001001) Emergency Logon Identification
In order to maintain production schedules it is sometimes necessary for personnel to perform maintenance on data within the system to which they are not authorized access by the Application or Data Owner. To achieve this objective, [Information Security] will set up and maintain an emergency identification for all platforms. The passwords for these identifications will only be provided when an emergency situation has arisen and upon the specific request of an individual authorized to use the emergency logon identification. Once used, the password associated with the emergency identification will be changed by [Information Security] on the next business day.
To control access to the emergency identification and provide accountability, a list of personnel authorized to obtain the emergency identification and password will be maintained by the [Information Security]. The initial list and all changes to this list will be approved by the [Title: CIO or Direction Information Services].
The emergency logon identification is to be used in emergency situations only by those personnel designated on the list maintained for this purpose by [Information Security]. Use of the emergency logon identification is limited to the resolution of data and operating system problems that are having an adverse impact upon production and to accomplishing scheduled system updates.
All uses of the emergency logon identification will be reported to the [Title: CIO or Direction Information Services].
Policy Superceded:
Responsible Department:
Effective Date:
[Signature President/Chief Executive Officer]
- - - - - - - - - -
(IP003001) Virus Protection
One of the major threats to our computer systems is an assault by a virus program. The most common ways these programs can be introduced into our systems is by the downloading of files from the internet or other external computers, connections to the internet or other external computers and loading files to our systems from diskettes which we receive from other companies or bring from home.
To reduce this threat to our systems, Anti-Virus software is installed on all desktop computers and LAN file servers. Firewalls are also installed to protect these systems from outside connections. This software should become operational when the system is booted and should remain operational at all times while the system is operating in order to check files for the presence of virus programs before they are filed on the system.
To further reduce the threat, diskettes are not authorized for use in any [Your Company Name] computer unless they have been scanned prior to use by the Anti-Virus software. This includes diskettes that are brought into the office from home.
Keeping Anti-Virus Software Current
Periodically associates using personal computers will be notified that an update to the Anti-Virus software is available. This update should be downloaded and installed on the associate's personal computer when the message is received.
Checking External Diskettes and Other Portable Storage Media
[Information Systems] will establish procedures to scan all diskettes and other portable storage media received in the course of business by all [Your Company Name] departments. These procedures will be applicable at all company facilities.
Virus Discovered on a Computer
If a virus program is detected on a [Your Company Name] computer, the discovery shall be treated as a security violation and be reported to [Information Security] immediately. [Information Security] will take appropriate action to have the virus removed, determine what damage the virus may have caused, determine other systems that may have been infected, and attempt to determine how the virus was introduced to the system.
Policy Superceded:
Responsible Department:
Effective Date:
[Signature President/Chief Executive Officer]
