R&M Data Center Handbook

www.datacenter.rdm.com
2.3.6. Potential Risks
According to a report by the IT Policy Compliance Group of 2010, 80 percent of companies have poor visibility into
their IT risks, taking three to nine months or longer to classify their IT risk levels. Inability to prioritize risks, lack of
a comprehensive risk view and inadequate control assessments all contribute to this problem.
Liability Risks
Need for
regulation, need
for action
Strategic
tasks
Conceptual
tasks
Operative
tasks
Responsibilities Legislation Potential damage and losses
Management /
CEO
Supervisory Board
Management /
CEO
Data Protection
Officer
Head of IT
Management / CEO
Data Protection
Officer
Head of IT
Staff
See
regulations
See
regulations
Employment contract
See
regulations
Employment contract
Commercial Code (HGB)
Copyright Act (UrhG)
Penal Code (StGB)
Excerpt: Liability Risk Matrix (Matrix der Haftungsrisiken), Bitkom, as of March 2005
- Losses due to system failure
- Insolvency
- Increased costs of corporate loans
- Loss of insurance coverage
- Image loss
- Monetary fines
- See strategic tasks
- Data loss
- Unauthorized access
- Virus infection
- Loss due to failed projects
- Loss of claims against suppliers
- Loss of development know-how
- No annual audit confirmation
- Taxation assessment
- Imprisonment
- Corporate shutdown/loss of production
- Capital losses
- Image loss
- Loss of business partners or data
Companies have taken to including limited liability for negligent behavior in agreements between managing
directors and the company. In the case of limited-liability companies, members have the option of declaring
acceptance of the managing director, rendering any claims for damages against the company null and void. This
is not true in the case of stock corporations, where acceptance of management does not result in the waiver of
damage claims.
Good insurance is a valuable asset because...
… Managers fail to see their liability risks
… Managers are usually not clear about the scope of their liability risk
… There is a growing risk of being held liable for mistakes at work and losing everything in the process
… Managing directors and management can be held liable if they fail to provide sufficient IT security for their
companies
… The boss is not the only one held liable!
Operational Risks
Operational risks – as defined in Basel II – are "the risks of loss resulting from inadequate or failed internal
procedures, people and systems or from external events".
The primary focus, in terms of operational risks, is on:
• Information system failures
• Security policy
• Human resource security
• Physical and environment security
• IT system productivity
• Keeping systems, procedures and documentation up-to-date
• Information and data of all business operations
• Evaluation and identification of key figures
• Clear, previously drawn-up emergency plan
• Backups of the entire data base
Page 34 of 156 © 08/2011 Reichle & De-Massari AG R&M Data Center Handbook V2.0