The accumulation of IT security incidents in higher education has increased steadily in recent years. These incidents were associated with severe impairments of IT operations, up to and including a complete standstill of the universities.
In order to be able to act quickly and purposefully in the event of a serious process or resource failure, good preparation is essential. HITS IS provides various services in the field of preventive IT emergency management. The focus of preventive IT emergency management is process-based preparation for the rapid restoration of regulated and secured IT operations.
Emergency and crisis situations resulting from security incidents require additional measures from IT emergency management and the cross-process coordination of several people and teams, as well as a targeted communication strategy. The central organization establishes uniform processes that are continuously improved. The aim is to support Bavarian universities in introducing and improving their business continuity management process.
Scope of Services and Service Specifics
The "IT Emergency Management in the GRC Tool" service consists of two different service packages that can be used independently of each other:
Advice
The consulting includes the documentation of the steps necessary for the implementation of a BCM process in the GRC tool. In detail, the consulting package includes:
- Advice on the recording of assets, including grouping, and the subsequent risk assessment as part of the business impact analysis in the GRC tool.
- Review of the existing BCM documentation in the GRC tool with regard to completeness, usability, and conformity with common standards. The results of the review will be discussed in an additional consultation, including suggestions and suggestions for improvement.
- Advice on individual adjustments in the GRC tool, provided that they facilitate the implementation of the IT emergency management process or contain added value in terms of usability and conformity with common standards. HITS IS collects the change requests of all universities participating in the framework agreement in order to bundle duplicate requests and thus ensure cost-efficient implementation.
Workshop "IT Emergency Management in the GRC Tool: First Steps"
To make it easier to get started with the topic of business continuity management within the framework of the GRC tool, HITS IS offers workshops. In the workshop, examples will be used to explain how the BCM process can be implemented in the GRC tool. Participation is subject to prior registration. Afterwards, the training documents will be made available to the participants. The workshop does not require any previous knowledge in the field of IT emergency management. The basic steps of the BCM process that are relevant to the GRC tool will be taught in the workshop. Since part of the workshop will be held as a hands-on event, the availability of the GRC tool is a prerequisite for participation, which will be requested when registering.
Service Parameters
Advice
- The use of the consulting package will be made available within two weeks.
Workshop "IT Emergency Management in the GRC Tool: First Steps"
- A prerequisite for participation in the workshop is access to an instance of the GRC tool at the respective institution.
- Dates for the workshop are offered. Pre-registration is required to participate in the workshop.
- As part of the workshop, additional documents will be developed and made available to the participants.
- The number of participants for each workshop is limited.
- The Requirements for using the service are the willingness to independently record assets as part of the business impact analysis, as well as the willingness to continuously improve the processes associated with business continuity management. In addition, a person responsible for the implementation of the BCM process must be defined for the respective institution.
Requirements
The service "IT Emergency Management in the GRC Tool" requires the simultaneous use of the service "ISMS Consulting and Support of the GRC Tool. In addition, the following requirements must be met:
- The BCM project manager must be known
- Self-contained asset capture and continuous maintenance
User / Customers
This service is made available to the following categories of users.
| User class | Note |
|---|---|
| (1), (2) | only for members of the Digital Network of Bavaria |
| (3), (4), (5), (6) | not available for these customers |
The "IT Emergency Management in the GRC Tool" service can be used by all participating institutions in the framework contract.
Additional fees and billing
Licenses or external services to customize the GRC tool that exceed a certain quota may incur additional fees. In order to avoid or reduce external costs, it is advisable to report all change requests to the GRC tool centrally to HITS IS. In the event of frequent enquiries, a cost-effective implementation by GBTEC can be negotiated at a central location.