Text · page 7 of 15
Why Should the City Have a Written IT Contingency Plan? IT contingency planning involves analyzing business processes in the event of a disruption and identifying roles of key individuals and necessary precautions to take to maintain or quickly resume operations. As part of the contingency planning process and to minimize the risk of network access disruption, data loss or suffering a serious interruption of services, officials should establish a formal written IT contingency plan (plan) that includes guidance on systems recovery. The IT contingency plan should address the potential for sudden, unplanned events (e.g., fire, computer virus or inadvertent employee action) that could compromise the network and the availability or integrity of the IT system and data. This is particularly important given the current and growing threat of ransomware attacks. In addition, the IT contingency plan should be periodically tested and updated to ensure key officials understand their roles and responsibilities in a disaster situation and to address changes in security requirements. City Officials Did Not Have a Written IT Contingency Plan The Council and City officials did not develop and adopt a comprehensive written plan to describe how officials would respond to potential disruptions or catastrophic events. Consequently, in the event of a catastrophic event or network compromise, officials have no written guidelines or guidance to minimize or prevent network access disruption or loss of equipment and data. While officials acknowledged they did not have a plan, they believed that their current unofficial procedures of preparing multiple backups throughout the week was sufficient. Without a formal written plan, officials cannot ensure that in the event of a disaster they would be able to restore network access, critical IT systems, applications or data in a timely manner. Depending on the severity of an incident, officials may need to expend a significant amount of time and financial resources to resume City operations. Furthermore, essential employees may not be aware of their roles which could complicate the City’s ability to recover from an incident. As a result, the City has an increased risk that it could lose important data and suffer serious interruption in operations. What Do We Recommend? The Mayor and City officials should ensure that the IT Specialist: 1. Disables unneeded and/or dormant network user accounts identified during our audit and periodically review network user accounts to identify unneeded or dormant accounts. 2. Restricts the use of generic network user accounts and develop written procedures to monitor the use of these accounts. Of f ic e of t he New York State Comptroller 5