Information systems strategy

Information and communication systems strategy designated ICSS - for oil and gas distribution pipelines is based on a system architecture that includes four components ... 

Information Systems Risk Management Protection Strategies Government Actions... 

Complete and absolute security is a theoretical construction no information system can be made totally secure, unless it is locked in a room with no access at all and nobody is allowed to use it. On the other hand, security measures carry a cost, which is usually proportional to their effectiveness. Therefore, the best we can do is to secure information systems as best as possible within a given, finite, monetary budget. The purpose of all protection strategies is to reduce the risk that the information infrastructure is exposed to and, as some risk will always remain, to mitigate or accept this remaining risk. To do this, because the risk function is increasing in all its elements, one must reduce one, more, or all the elements of risk. As it is... 

Support for research and development in security, aiming at threat and vulnerability reduction, should be a key element in the national R D support program and should be linked to the broader strategy for improved network and information security. Likewise, the national standardization organizations should accelerate their work on interoperability, certification, electronic signatures, further development and deployment of IPv6 and IPSec, and should also review and promote the use of all relevant security standards, including but not limited to the Common Criteria for Information Systems Assurance. 

Adler, D. J. (1998). Instrumentation and process control system strategy. In Automation and Validation of Information in Pharmaceutical Processing (J. F. DeSpautz, ed.), pp. 59-68. Dekker, New York. 

Processes used to determine functional criticality, such as FMEA, have already been discussed within this chapter. Similarly, FMEA and other risk assessment tools can be used to determine the scope of validation. The risk of failure increases as information systems supporting the EMS strategy deviates from a standardized solution that is, the level of tailored development increases. In addition, the extent to which a product is utilized within industry, in particular pharmaceuticals, must be taken into consideration when determining the scope of validation. 

The PQ will demonstrate the consistent operation of the system once released for operational use. The scope of the PQ for an information system is described in Table 31.17. During the PQ period, it is preferable that legacy systems and manual systems are operated in parallel. This approach is not withont difficnlty and the strategy for parallel operation must be carefully planned. The PQ will reqnire the collation of records such as change control, operator logs, etc., across many sites. The procednres and responsibilities for the collection of records in support of the PQ must be established in advance of system cut-over. Further, the PQ review team must be determined to ensnre that personnel are available to conduct the review, considering the pressures that will be exerted by the business to divert resources onto the next project. 

---