R&M Data Center Handbook

www.datacenter.rdm.com
2.3.2. IT Risk Management
IT risk management helps to ensure an organization’s strategic objectives are not jeopardized by IT failure.
The term risk refers to any negative deviation from planned values – whereas chance refers to any positive
deviation.
Reasons to implement an IT risk management system:
• Legal aspect
o
• Economic aspects
o
o
o
o
• Operational aspects
o
Careful management (see SOX, KonTraG, RRG)
Providing fundamental support by reducing errors and failures in IT systems
Negotiating advantage with potential customers by enhancing their trust in the ability to supply
Advantage in rating assessment of banks for credit approval
Premium advantages with insurance policies (e.g. fire and business interruption insurance)
Wide range of applications and saving options
There are four classic risk response strategies:
• Avoidance
• Mitigation
• Transfer
• Acceptance
IT risks can be categorized as follows:
• Organizational risks
• Legal and economic risks
• Infrastructural risks
• Application and process-related risks
2.3.3. IT Compliance
IT compliance means conforming to current IT-related requirements, i.e. laws, regulations, strategies and
contracts. Compliance requirements typically include information security, availability, data storing and data
protection.
IT compliance mainly affects stock corporations and limited liability companies (Ltd.) since in these companies
CEOs and management can be held personally liable for compliance with legal regulations. Non-observance may
result in civil and criminal proceedings. The Federal Data Protection Act in Germany specifies a custodial
sentence of up to two years or a fine in the event of infringement.
Frequently, there are standards and good practice guidelines to comply with, generally by contractual agreement
with customers or competitors.
The core task basically involves documentation and the resulting adaptation of IT resources as well as the
analysis and evaluation of potential problems and hazards (see also risk analysis). IT resources refer to hardware,
software, IT infrastructures (buildings, networks), services (e.g. web services) and the roles and rights of software
users. It is crucial that the implementation of compliance is understood to be a continuous process and not a
short-term measure.
2.3.4. Standards and Regulations
There are numerous bodies responsible for developing and specifying security standards and regulations
worldwide.
Page 28 of 156 © 08/2011 Reichle & De-Massari AG R&M Data Center Handbook V2.0