Risk audits

As with other infrastructure topics, IT often only comes to the forefront when system failures occur or business processes can no longer be maintained. This can become expensive under certain circumstances. Wouldn’t it be better to ensure it doesn’t come that far in the first place? But issues are pushed aside as long as everything is running, as daily operations often involve many other, much more urgent matters demanding attention.

From my perspective, however, every company should at least have fundamentally considered the following topics to some extent in order to minimize risks to business continuity:

Data Security & Recovery:

Which data is crucial to your business processes and reporting obligations? Where is this data stored, how is it secured against disasters (fire, hacking, ransomware, hardware failure, deletion, etc.)? How do you access your passwords for recovery? Which data must be restored and in what order?

Data Protection

Where do personal data such as addresses, names, etc., occur, and how are they secured against unauthorized access? How do you ensure that you can reproduce or delete this data upon request? How do you document the consent of employees and customers to the processing of this data? How well can you comply with requests from authorities regarding this data?

Disaster Plan

What happens if the workplace becomes inaccessible, or a crisis occurs (pandemic, severe weather, infrastructure/power outage, hacking, etc.)? Which systems are critical, which can be done without? What alternatives exist? How flexible are the systems and processes? Can a switch to an alternative business location / workplace be made quickly? Who has which responsibilities and knowledge, where is what information documented: If a major crisis occurs in multiple locations, you may not receive external support for a long time and therefore every little that you prepare in advance decreases future impact.