Disaster Recovery - Creating Asset Catalogs

So I have spent the memorial weekend down here in New Orleans attending the IT Pro Disaster Recovery Conference. When I was on stage talking about asset catalogs, and the extrodinary value it is for a small business, some people were asking for the best practices "checklist". They wanted guidance on what that would look like. Normally I would never quote an ISO standard for small business, as they typically don't gel well. But I am going to do so here.

Within ISO 17799, all businesses should strive to maintain appropriate protection of their assets. This is accomplished by ensuring all information assets are accounted for, and that there is an owner accountable for them. Along side of a documented business workflow, they need to be classified, labeled and properly protected.

Making up an Asset Catalog, in regards to information systems atleast, would include :

• Information - Operational processes, documentation, manuals, databases, data files etc
  
• Software - LOB applications, operating systems, configuration settings etc
  
• Physical assets - telco equipment, computers, storage media, fax and copy machines, furniture, building premises etc
  
• Services - Utility companies, ISPs, telcos, product suppliers etc

Once you know WHAT belongs in the asset catalog, now you need to determine WHO is responsible for each item. When documenting this, its good to associate the items to a job title and their positions opposed to individual people. This way, whomever is in that role can understand their responsibilities and asset ownership. As an example, as we discussed total devistation from a fire, the "accounts payable" role would ensure "cheque book" was an asset required in his or her role. Ensuring you can pay for new items needed during recovery is kind of important... and knowing WHO has access to cheques is critical. (May not be the perfect example, but you get the idea)

So for those of you that asked for guidance.... check out ISO 17799. Seem too overwhealming? Hire an information security professional who enjoys DR. That's what we are here for. You are a consultant yourself? Don't feel ashamed to ask for help. an infosec pro is there to help.