Text · page 6 of 16
the District’s computers, thereby possibly infecting those computers and/or the District’s network. Internet browsing increases the likelihood of computers being exposed to malicious software that may compromise PPSI. As a result, the District’s IT assets and any PPSI they contain have a higher risk of exposure to damage and PPSI breach, loss or misuse. Why Should the District Have a Disaster Recovery Plan? To minimize the risk of data loss or suffering a serious interruption of services, District officials should establish a formal written disaster recovery plan (plan). The plan should address the potential for sudden, unplanned catastrophic events (e.g., fire, computer virus or inadvertent employee action) that could compromise the network and the availability or integrity of the financial system and any PPSI contained therein. Typically, a plan involves analyzing business processes and continuity needs, focusing on disaster prevention and identifying roles of key individuals and necessary precautions to take to maintain or quickly resume operations. The Board and District Officials Have Not Established a Disaster Recovery Plan The Board did not adopt a comprehensive written plan to describe how officials would respond to potential disasters. The District contracted with Erie 1 Board of Cooperative Educational Services (BOCES) for certain IT support services. One of the services related to school district disaster recovery planning – which cost approximately $15,000 annually – included providing a plan template and assistance to help refine the plan for specific school district needs. However, the District did not use this service. The Director told us he previously asked BOCES for a template and assistance with creating a plan, but BOCES did not provide any template or guidance. Without a formal, written plan, the District has an increased risk that it could lose important data and suffer serious interruption in operations. What Do We Recommend? The Board should: 1. Ensure that officials monitor employee and student compliance with the AUP. 2. Adopt a written disaster recovery plan. 4 Of f ic e of t he New York State Comptroller