Security disaster recovery

Managerial control is estabhshed and documented through a series of SOPs. These SOPs are system design, use, and control pohcy statements. They summarize procedures of system security, disaster recovery, normal use, data archive and backup, error response, documentation, testing, and other important aspects of control. 

System management (e.g., formal contract or SLA, system management documentation, documented responsibilities, overviews of system components, existence of and adherence to change control procedures, backup and restore procedures, physical and logical security, Disaster Recovery Plans)... 

Does the computer room have limited access (e.g., are the servers physically/ logically secure) 2. Are there provisions for power backup 3. Is there a disaster recovery plan and is it periodically tested 4. Is there environmental monitoring 5. Are there off-site back-up facilities for key documents and software Is it readily retrievable ... 

Are there SOPs or other procedural documentation for the computer room security, back-up/recovery and disaster recovery ... 

Physical access controls (limited access) (all listed implementation features must be present) This area is related to the procedures for limiting physical access to an entity while ensuring that properly authorized access is allowed. Disaster recovery Emergency operating mode Equipment control (into and out of site) Facility security plan Procedures for verifying access authorizations prior to physical access Maintenance records Need-to-know procedures for personnel access Sign-in for visitors and their escorts, if appropriate Testing and revision... 

The current good manufacturing practices (GMP) state that Laboratory records shall include complete data derived from all tests necessary to assure compliance with established specifications and standards [5]. This includes all electronic and hard copies of raw data, laboratory notebooks, and/or worksheets and reports. Additionally, the regulations require that records shall be readily available for authorized inspection [6]. Consequently, the organization must have a well-defined audit trail for the generation, storage, and retrieval of reports and raw data. It must also be shown that there is adequate document management and security of all raw data and reports in terms of both disaster recovery and prevention of falsification of results. 

List the SOPs that must be developed in order to use the VUS in an appropriately compliant fashion. Include SOPs on operation, maintenance, administration, security, backup, and disaster recovery. Some of these may be combined into one document. If the exact document names and number are known, list them otherwise use generic names. 

Procedures and plans supporting business continuity (Disaster Recovery Plans and Contingency Plans) must be specified, tested, and approved before the system is approved for use. Business Continuity Plans will normally be prepared for a business or an operational area rather than for individual computer systems. It is likely that the only way to verify the plan is to walk through a variety of disaster scenarios. Topics for consideration should include catastrophic hardware and software failures, fire/flood/lightning strikes, and security breaches. Alternative means of operation must be available in case of failure if critical data is required at short notice (e.g., in case of drug product recalls). Reference to verification of the Business Continuity Plans is appropriate during OQ/PQ. 

There were no written user standard operating procedures. .. [for] system validation, hardware and software change control, revalidation, user operations, security guidelines, software revision control, virus detection, disaster recovery, and backup and audit trail archival. [FDA 483, 1999]... 

Data entry system security — virus protection, access management, disaster recovery, archive, and retention... 

Record locking to prevent parallel access, security to prevent inadvertent or malicious modification, disaster recovery, maintenance of referential integrity... 

Validation Report Glossary of Terms Document Index Navigation Aid Updated Training Records Support Procedures (System Management, Change Control, Disaster Recovery, Security Practice, Performance Monitoring, Periodic Review)... 

Servers should be located in secure locations subject to appropriate environmental controls and protected against risks of flooding, fire, etc. Business Continuity Plans and Disaster Recovery Plans should be in place to manage catastrophic events. Such plans should be periodically tested. 

Configuration management Disaster recovery plans/procedures Vims protection Backup and Restoration Security Management... 

Any treatment of security in the context of document management would be remiss if it did not mention audit trails and disaster recovery. 

Adequate alternative arrangements should be available, i.e., disaster recovery procedure, for systems which need to be operated in the event of a break-down. The procedures to be followed if the system fails or breaks down, should be defined and tested. Regular backups of all files should be stored in a secure location to prevent wilful or accidental damage. Any failure and remedial action taken should be recorded. 

Data handling (e.g., access control, data security/integrity, GxP compliance of data entries and edits, data processing procedures. Disaster Recovery/Contingency Plans, archiving and retrieval of data)... 

Clear and proper procedures must be in place for using the system (procedures and/or user manual), backup and restoration, periodic evaluation, maintenance and problem management, safety and security, training. Disaster Recovery and Contingency Plans, business continuity, change control, and system retirement. 

Maintaining Security Level during Operations (includes Maintenance, Change Management and Incident Handling), Disaster Recovery and Business Continuity Planning). This is a critical issue in context of safety certification Security outlives rather quick its life time, so frequent updates are necessary - quite opposite to what safety people want, to avoid re-assessment and re-certification ... 

Hoopes, J. 2009. Virtualization for security including sandboxing, disaster recovery, high availability. Waltham Syngress. 10, 20-25. 

The response phase should use the American Medical Association s DISASTER algorithm. This stands for Detect, Incident Command, Scene Safety and Security, Assess Hazards, Support Required, Triage and TLeatment, Evacuation, and Recovery. An explosion is... 

Once the plans have been formulated, they should be tested and documented to see if they work. Failure to test the recovery plan will give a false sense of security and compound any disaster. 

The QQ also needs to test some of the system specification requirements. These include security (i.e., authorized users can access the software, unauthorized users cannot), recovery (the software can be reinstalled and critical data recovered from original media or backup systems in the event of either accidental or disaster-related events), and boundary tests (e.g., maximum users allowed, maximum data set size). 

---