Page 183 - Courses

Exploring Corrective Controls

Establish Incident Response Plan (IRP)
1. Develop incident response plan.
2. Define incident response toolkit.
3. Develop breach notification process.
4. Develop incident response playbooks.

Deploy, Verify, and Maintain Operational Resiliency Program Capabilities
1. Deploy program awareness and training for business continuity, disaster recovery, and
incident recovery.
2. Maintain the resiliency program and business continuity, disaster recovery, and incident
recovery plans.
3. Exercise business continuity, disaster recovery, and incident recovery capabilities.
4. Establish crisis communications and align with crisis management.
5. Align with emergency response and external agencies coordination.

Examples of Failures in Operational Resiliency

Documented cases demonstrate how companies or entire industries have sustained significant
financial damage due to their lack of preparedness for unforeseen disasters, including:
 A 2020 Mercer study discovered that 51 percent of companies worldwide lack the business
continuity plans necessary to take action.
 According to Square 3, 40 percent of small businesses fail after a natural or man-made
disaster.
 According to CoreLogic, in 2016, Hurricane Matthew caused an estimated $4 to $6 billion
(USD) in insured property damage along the east coast of the United States, from Florida to
North Carolina.
 Delta airlines suffered a power outage at their operations center in Atlanta on August 8, 2016.
This resulted in the cancellation of almost 1,000 flights and the grounding of an additional
1,000 flights in the days following, and an estimated cost of $150 million (USD).
 A ransomware attack on the city of Atlanta, GA, resulted in massive and extended impacts
that were felt for days. The attack affected law enforcement’s ability to write incident reports,
and affected gaining access to archived video footage. It caused a halt on processing of ticket
payments, water bills, business licenses and renewals, and also knocked out Wi-Fi at one of
the busiest airports in the country (Hartsfield-Jackson Atlanta International).
 Hartsfield-Jackson Atlanta International Airport: “Ratgate” switch, used to activate
redundant power supply was damaged by flames in 2017, causing the airport to close for over
12 hours.

Cost of Data Loss

For an organization to have a viable operational resiliency program, the board and executive
management must support it through funding and resources to implement and maintain the
program and its plans. Data loss is incredibly costly to organizations — $3.68 million (USD) lost on
average in 2020, according to a study done by IBM — and is typically contributed to one of five major
categories:

Copyright © 2021 by The Institute of Internal Auditors, Inc. All rights reserved.